Legal
Privacy Policy
Effective · Last updated
This policy explains what personal data WorldBestSong collects, why, and what you can do about it. It stands on its own, but our Terms of Use also apply. Using WorldBestSong is subject to this policy.
A few details on this page are still being finalised. For anything you need now, email support@worldbestsong.com.
The short version
- We collect only what we need to run your account and show your reviews: username, email, password (stored only as a secure hash), display name, bio, and your ratings, reviews and likes.
- Your ratings, reviews, username, display name and bio are public. Your email address is never shown.
- No ads, no analytics, no tracking cookies. We never sell or rent your data.
- We use one login cookie (it lasts until you close your browser unless you choose "Keep me signed in"), plus short-lived security cookies while you sign in with Google or Apple (where available).
- Our website and database are hosted outside India, in the United States and elsewhere.
- You can delete your account at any time in Settings. For anything else, email privacy@worldbestsong.com.
Who we are
WorldBestSong (https://worldbestsong.com) is run by [Your full legal name], an individual based in India. Postal address: [Postal address for legal notices, including country].
We decide how and why your personal data is used. That makes us the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under the EU and UK General Data Protection Regulation ("GDPR").
- Questions about how we process your personal data: privacy@worldbestsong.com
- Complaints: our Grievance Officer, [Grievance Officer's full name], at grievance@worldbestsong.com (see Complaints)
- Our representative in the European Union: [EU representative: name, address, email]
- Our representative in the United Kingdom: [UK representative: name, address, email]
We follow India's Information Technology Act, 2000 and the rules made under it and, for people in the EU and UK, the GDPR. Most duties under India's DPDP Act and the DPDP Rules, 2025 formally start in May 2027. We already give you the notice, choices and rights they describe, and before they start we will update our record-keeping to match them (see How long we keep data). This policy covers WorldBestSong only, not the other sites we link to.
What we collect
When you browse (no account needed)
- Request data. Like every website, our host receives your IP address, browser type (user agent), the page you ask for (including any search words in its address), and the time. Our hosting provider keeps these request logs for up to 30 days.
- Your country. Our host works out your approximate country from your IP address. We use it to show charts and search results for your country. We don't store it with anything about you, but the two-letter country code can appear in link addresses (for example
?c=in). - Searches. What you type into search is sent from our servers to Apple's and Deezer's search services to find songs. Your IP address and account are not sent. We don't save searches in our database or link them to your account. Search results may be cached for up to 6 hours. Because search words appear in the page address, they can show up in your browser history and our host's request logs.
- Bot check. On song pages we check whether the browser type looks like a search-engine bot, so bots don't use up our YouTube search allowance. We don't store the result.
When you create an account
- With email and password: your username, email address and password. We never store your password itself, only a secure one-way hash (bcrypt). Your display name starts as your username.
- With Google or Apple (where available): from Google or Apple we receive a unique account ID, your email address, whether they have verified that email, your name and, if they include it, when you last signed in to them. If you use Apple's "Hide My Email", we get a private relay address (ending in @privaterelay.appleid.com) instead of your real email. We never receive your Google or Apple password, and we don't store your profile picture. If another WorldBestSong account already uses that email address, we don't join the two: you can log in to that account and connect Google or Apple in Settings, or create a separate account without an email address. See Google and Apple sign-in.
- For every account: an internal account ID and the date you joined. Before we create an account, you must confirm that you are at least 18 and accept our terms. We record when you did this, which version of our terms you accepted and how (password, Google or Apple sign-up, or our on-site notice), and when you last saw our rules reminder. If your account was created before we added this step, we ask you the next time you use the site, and you can't post or like reviews until you answer.
- Optional: a bio, and a different display name, which you can set in Settings.
- If we suspend your account: when and why.
When you use your account
- Ratings and reviews: your star rating (½ to 5 stars), any review text, and when you posted and last edited it.
- Likes: which reviews you marked as helpful. Other people only see the total number of likes on each review.
- Login sessions: when you log in, our database stores a hash of your login token, your account ID, when the session expires, and when you last logged in or confirmed it's you in that session (changing how you log in, or deleting your account, needs a recent confirmation). We don't record your IP address or device with it.
Security and abuse prevention
To stop spam and password guessing, we count attempts. For this we briefly store:
- your IP address, when you sign up, log in (including with Google or Apple), or open a search result that isn't on WorldBestSong yet;
- the username or email address typed into the login form, even if no account matches it; and
- your account ID, when you post or like reviews, confirm it's you, change your password or connect Google or Apple.
Each record only matters for 10 to 60 minutes. Expired records are deleted automatically (see How long we keep data).
When you contact us
Your name and email address, what you tell us, any documents you send (for example a copyright notice), and our replies.
What we don't collect
- No analytics, advertising or tracking tools, no third-party scripts, no social media widgets, and no browser fingerprinting.
- Nothing is stored in your browser apart from the cookies listed below (we don't use local storage).
- No precise location, no phone number, no payment details (the service is free), and no data bought about you.
- We don't ask for sensitive information. Reviews are public, so please don't include sensitive details (such as health, religion or sexuality) about yourself or anyone else.
How and why we use it
| Why | What data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, log you in and keep it secure | Account details, sign-in provider details, login sessions | Performing our contract with you (Art. 6(1)(b)) |
| Publish your ratings, reviews and profile, and work out song averages and charts | Ratings, reviews, likes, display name, bio, join date | Performing our contract with you (Art. 6(1)(b)) |
| Prevent spam, abuse and attacks, and keep the service working | IP address, login name typed, account ID, request logs | Legitimate interests (Art. 6(1)(f)): keeping the site and your account safe |
| Show charts and search results for your country | Approximate country (not stored) | Legitimate interests (Art. 6(1)(f)): showing relevant music |
| Handle reports, copyright notices and legal requests, moderate content, and respond to authorities | The content concerned, account details, what you or others send us | Legal obligations (Art. 6(1)(c)) where a law applies to us; otherwise legitimate interests (Art. 6(1)(f)): keeping the community safe and lawful |
| Keep records of your consent, age confirmation and rules reminders, and keep the registration details of deleted accounts and copies of removed content for 180 days | Consent and reminder dates, account details, removed content | Legitimate interests (Art. 6(1)(f)): complying with Indian law that applies to us and being able to show what was agreed and done |
| Answer your messages and privacy requests | Contact details and what you tell us | Performing our contract, legal obligations, or legitimate interests |
- India (DPDP Act): we process your account data with the consent you give when you create your account, for the purposes above. Without consent, we process data only for the "legitimate uses" the Act allows, such as meeting a legal obligation or complying with a court order.
- What you must provide: to create an account you need an email address, username and password, or a Google or Apple account. Without one you can still browse, but you can't rate or review.
- No profiling: we don't use your data for advertising or profiling, and we don't use it to train AI models. We make no automated decisions with legal or similarly significant effects. The only automatic decisions are temporary rate limits ("too many attempts, try again later"). Charts use a public formula based on everyone's ratings (see About).
- New purposes: if we want to use your data for a new purpose, we'll update this policy first and, where the law requires, ask for your consent.
What is public
Public (anyone can see these, and search engines can index them): your username, display name, bio and the month you joined; all your ratings, including star-only ratings, with dates and an "edited" label; your written reviews; your rating statistics (count, average and star distribution); and how many likes each of your reviews has. Your profile is at /u/your-username, and song pages with ratings are listed in our sitemap.
Private: your email address, password hash, which reviews you liked, your Google or Apple account ID, your login sessions and security records, your consent records, and any suspension.
Anything public can be seen, copied and shared by anyone, and may stay in search engine caches for a while after you delete it. The DPDP Act doesn't cover data you make public yourself, but we still honour your requests to correct or delete it.
Google and Apple sign-in
This section applies if you sign in with Google or Apple (where available).
- What we receive: a unique account ID, your email address, whether the provider has verified it, your name and, if the provider includes it, when you last signed in to it (we use this only to decide whether your login counts as recent). We only ask for basic sign-in information. We get no access to your contacts, files, YouTube account or anything else, and we don't store your profile picture. Apple shares your name only the first time you sign in, so if you don't finish creating your account then, you'll type it in yourself later. We use the sign-in only to confirm who you are: we don't keep Google's or Apple's access tokens.
- How we use it: only to create your account, sign you in, keep your account secure, and contact you about your account. When you create an account, we suggest your first name as your display name and a username based on it (never on your email). Both are public; you can change them before you create the account, and the display name any time in Settings. Nothing is created until you confirm your age and agree to our terms.
- What we never do with it: use it for advertising, sell it, share it with data brokers or information resellers, use it to judge creditworthiness or for lending, or use it to train AI models.
- Sharing: only with the service providers who host our site and database, as described above.
- Protection: it is sent over encrypted connections and stored with the rest of your account, with access limited to the site operator.
- Keeping and deleting it: we keep it while you have an account. If you start signing up but don't finish, what Google or Apple sent us stops being usable after 15 minutes and is deleted within a day (straight away if you press Cancel). If you disconnect Google or Apple in Settings, we delete that connection straight away. When you delete your account, we delete it, except the registration details Indian law requires us to keep privately for 180 days (see How long we keep data).
- Apple private relay addresses: if you hide your email, we only use the relay address. We won't try to link it to your real identity or to other information about you without your consent.
- Disconnecting: you can stop using Google sign-in at your Google Account connections, and Sign in with Apple in your Apple Account settings under Sign-In & Security (Apple's guide). This stops future sign-ins but doesn't delete your WorldBestSong data. To delete that, delete your account in Settings. In Settings you can also disconnect Google or Apple from your WorldBestSong account, as long as you keep another way to log in (a password, which you can set there, or the other provider). We don't currently receive notices from Apple when you stop using Sign in with Apple, so your account stays until you delete it.
- Changes: if we change how we use Google or Apple sign-in data, we'll tell you and ask for your consent before using it in the new way.
Our use of information received from Google APIs follows the Google API Services User Data Policy.
YouTube API Services
WorldBestSong uses YouTube API Services to find YouTube and YouTube Music links for songs.
- Our servers send the YouTube Data API only song information (artist and title searches, and video IDs to check). We send no information about you, and we don't access, collect or store any YouTube account data.
- We store the matching video ID with the song and refresh or delete it within 30 days. We don't embed YouTube videos or show ads. Links take you to YouTube.
- By using WorldBestSong, you agree to be bound by the YouTube Terms of Service.
- Google's handling of data is described in the Google Privacy Policy (http://www.google.com/policies/privacy).
- We never ask for access to your YouTube account. You can review and remove apps' access to your Google account at Google's security settings.
International transfers
We are based in India. Our website is hosted by Vercel Inc. in the United States, our database is hosted by Turso (region AWS us-east-1 (N. Virginia, USA)), and Google and Apple may process sign-in data in other countries. So your data is stored and processed outside your country, including outside India, the EU and the UK.
- India: the DPDP Act allows transfers abroad, except to countries the Government of India restricts.
- EU and UK: India has no EU or UK "adequacy decision". For the United States, Vercel Inc. is certified under the EU-U.S. Data Privacy Framework and its UK Extension. For other providers, we rely on the safeguards they offer, such as the European Commission's Standard Contractual Clauses (with the UK Addendum), where available. Email privacy@worldbestsong.com to learn more about these safeguards.
How long we keep data
| Data | How long we keep it |
|---|---|
| Account details (username, email, password hash, display name, bio, sign-in provider ID), and records of your consent and rules reminders | Until you delete your account |
| Registration details of a deleted or closed account (username, email, display name, sign-in provider ID, join date) | Kept privately for 180 days after the account is deleted, as India's IT Rules require, then erased. During that time the username (and, for accounts we closed, the email and any connected Google or Apple account) can't be used for a new account. |
| Ratings, reviews and likes | Until you delete them or your account, or we remove them for breaking our rules |
| Unfinished Google or Apple sign-ins and sign-ups (account ID, email, whether it's verified, first name) | Up to 15 minutes, then deleted automatically, normally within a day |
| Login sessions | Until you log out or 30 days pass. Expired sessions are deleted automatically. |
| Security records with your IP address, login name or account ID | Used for 10 to 60 minutes, then deleted automatically, normally within a day of expiring |
| Request logs kept by our host | up to 30 days |
| Database backups | Deleted data can remain in our database provider's backups for up to 24 hours before it is gone for good |
| Cached song search results (not linked to you) | Up to 6 hours |
| Copies of content we removed after a report, notice or order, or for breaking our rules | Kept privately and unchanged for 180 days, as India's IT Rules require (longer only if a court or authority asks), then erased. If a removal is reversed, the content goes back on the site. |
| Messages and requests you send us, and records of reports, notices, orders and our decisions | As long as needed to deal with them, and then up to 3 years in case of disputes. |
We may keep specific data for longer only if the law requires it or we need it for a legal claim, and only for that purpose.
From May 2027: India's DPDP Rules, 2025 will require us to keep logs of how we process personal data, and the related data, for at least one year, including after an account is deleted, to detect and investigate security incidents. We will update this table before that rule applies.
How we protect data
- Every connection uses HTTPS, and browsers are told to always use it (HSTS).
- Passwords are hashed with bcrypt. Login tokens are stored only as hashes.
- Login cookies are HttpOnly, Secure and SameSite, which protects against common attacks.
- Google and Apple sign-ins use one-time codes and signed tokens that we check with Google and Apple. We never connect accounts just because their email addresses match.
- Changing how you log in, or deleting your account, needs a recent login or a fresh check with your password, Google or Apple. Google doesn't always ask for your password again: its check can rely on the Google account already signed in on that browser. Changing your password or disconnecting Google or Apple logs out your other devices.
- Rate limits slow down password guessing and spam.
- Security headers protect pages, and our API keys stay on our servers.
- Only the site operator can access the database (and our providers, only as needed to run their services).
No system is perfectly secure, so please use a strong password that you don't use anywhere else.
Data breaches
If a personal data breach affects you, we'll tell you without delay, by email or on the site, in plain language. We'll explain what happened and when, the likely effects on you, what we are doing about it, what you can do to protect yourself, and who to contact.
We'll also report the breach as the law requires, for example to the Data Protection Board of India, India's CERT-In, and EU or UK data protection authorities.
Your rights
Wherever you live, you can ask us to:
- Access your data: a summary of the personal data we hold about you, how we use it, and who we have shared it with (see Who we share data with).
- Correct or update it. You can change your display name and bio in Settings, where you can also set or change your password and connect or disconnect Google or Apple. Email us to change your username or email address.
- Delete it. Delete single reviews on the song page or your profile, or delete your whole account in Settings → Delete account. Your account and content disappear from the site immediately. We keep your registration details privately for 180 days, as Indian law requires (see How long we keep data).
- Get a copy of your account data, ratings and reviews in a machine-readable format (JSON), by email.
- Withdraw your consent by deleting your account. It's as easy as signing up. Withdrawing consent doesn't affect what we did before.
- Restrict how we use your data in some cases (EU and UK).
- Nominate someone to use these rights for you if you die or become unable to (India, and we offer it to everyone). Email us from your account's address with your nominee's name, contact details and relationship to you. You can change or cancel a nomination the same way.
- Complain (see Complaints).
Your right to object. If you are in the EU or UK, you can object at any time to our use of your data based on legitimate interests (security, country-based results and moderation). We'll stop unless we have compelling legitimate grounds, or we need the data for legal claims.
How to make a request
- Email privacy@worldbestsong.com.
- To help us confirm it's you, send it from the email address on your account (or tell us whether you sign in with Google or Apple), and include your username. We may ask for more information to check your identity, and use it only for that.
- We acknowledge requests within 24 hours and aim to complete them within 7 days. Complex requests can take up to one month, and we'll tell you why. Only in rare cases, where EU or UK law allows it, we may need up to two more months; we'll explain why within the first month. We never take more than three months in total, or more than 90 days, whichever is shorter.
- Requests are free, unless they are clearly unfounded or excessive.
- Every reply includes a contact who can answer questions about your data.
Your duties (India)
When you use your rights under the DPDP Act, you must:
- follow the law;
- not pretend to be someone else when giving us personal data;
- not make false or frivolous complaints; and
- give only information that can be verified as genuine when asking for corrections or deletion.
Breaking these duties can lead to a penalty of up to ₹10,000 under the DPDP Act.
Complaints
Please contact us first. We'd like the chance to put things right.
Grievance OfficerName: [Grievance Officer's full name]
Email: grievance@worldbestsong.com
Address: [Grievance Officer's postal address]
We acknowledge complaints within 24 hours and resolve them within 7 days.
- India: if you're not satisfied, you can complain to the Data Protection Board of India. The DPDP Act requires you to use our grievance process first. The Board takes complaints online; we'll link to its complaint service here once it opens. For decisions about content, you can also appeal to the Grievance Appellate Committee (see our Terms).
- EU and EEA: you can complain to the data protection authority where you live or work, or where you think the problem happened (list of authorities).
- UK: email privacy@worldbestsong.com with your complaint. We acknowledge it within 24 hours, as above (UK law allows up to 30 days), look into it, and tell you the outcome. If you're not satisfied, you can complain to the Information Commissioner's Office.
- Elsewhere: you can contact your local data protection authority.
Children
WorldBestSong isn't for children. You must be 18 or older to create an account, and we don't knowingly collect personal data from anyone younger (including children under 13). We don't track children or show them targeted ads (we don't show anyone ads).
If we learn that an account belongs to someone under 18, we delete it and its data. If you are a parent or guardian and think your child has signed up, contact our Grievance Officer at grievance@worldbestsong.com.
Do Not Track and California
- We don't track you across other websites, and we don't let third parties do so through our site. So Do Not Track and Global Privacy Control signals change nothing here: there is nothing to switch off.
- We don't sell or share personal information, as the California Consumer Privacy Act defines those terms.
- You can review and change your information as described in Your rights, and we'll tell you about changes as described below.
Changes to this policy
- We update this policy when our practices change, for example when new sign-in options launch. We change the "Last updated" date at the top.
- For significant changes, we'll let you know in advance with a notice on the site and, where we can, by email. Signed-in users also see a notice after any change. If a change needs your consent, we'll ask for it first, and you can't post or like reviews until you answer.
- Earlier versions are available on request.
- This policy is written in English. You can ask for it in Hindi or another language listed in the Eighth Schedule to the Constitution of India by emailing privacy@worldbestsong.com.
Contact us
- Website: https://worldbestsong.com
- Privacy questions and requests: privacy@worldbestsong.com
- Grievance Officer: [Grievance Officer's full name], grievance@worldbestsong.com
- Post: [Your full legal name], [Postal address for legal notices, including country]