What leaves your phone

This page is the honest inventory. Your songbook lives on the phone and has no copy anywhere else. Four things do use the network: importing a page, which you ask for; crash and usage reports; the Pro purchase; and the checks that keep the import service from being abused.

The inventory

Four lines on the left. The first happens only when you tap "This is it".

What it does

The text of a page you import, to be cleaned up into a chord sheet
Which screens get opened, and crashes when it crashes
The Pro purchase and its receipt, through Apple, Google and RevenueCat
A random anonymous identity and an app integrity check, for the import allowance

What it deliberately does not

Your songs, lyrics or chords, once saved
Your set lists or your play history
Anything you type into search, or a song title in any report
Your contacts, your location, or an advertising identifier
Your name or email — there is no account to give them to

The content that leaves

Turning a page into a chord sheet

The one thing a phone cannot do well by itself, and it waits for you to ask.

The page loads on your phone, the way any page does in a browser. When you tap "This is it", the app reads the text of that page — or only the part you selected, if you selected some — and sends it to our own server along with the page's address and title, the song title and artist you searched for, the language of the title, and the app's version. The server passes the text to Google's Gemini API, checks what comes back against the page, and returns the chord sheet to your phone.

The page text is not stored. Our server keeps no copy of it and no copy of the result, and its logs record how the import went — the site's host name, how long it took, whether it worked — never the text, the lyrics or the full address. Our server holds the model key, which is why the request goes through it rather than straight from your phone.

What else goes with it is an identity, because the free imports have to be counted against somebody: an anonymous Firebase identity, created the first time the app starts, that is not your name or anything about you. The server keeps a count of imports against it and nothing else.

The other ones

Crashes, screens, and the purchase

Labels about the app. Never a word of what is in it.

The app reports to Google Firebase which screens get opened and when it crashes. A screen arrives as its pattern — the play screen as /play/:songId, not the song — so no song title, lyric, chord or search you type is ever part of it. A crash report says which line of our code failed, not what was on the screen.

Buying Pro goes through Apple or Google, and the app uses RevenueCat to check that a purchase exists, under the same anonymous identity. The import service asks Firebase App Check whether the request comes from the real app, which is how it stays a service for people using the app rather than a free proxy for anyone.

There is no switch for the reports in the app, which we would rather state than bury. What is reported is built so that it cannot describe your songs.

Consequences

What local-first actually costs you

Being honest about the upside means being honest about the trade. Your songbook lives on one device, which is exactly the point and also means a lost or wiped phone takes it with it unless your phone's own backup carried it. There is no account and no cloud copy of your songs to fall back on.

The other side of it is that a saved song does not depend on us. The library, the set lists and the play view work with no network at all, and would go on working if the import service were ever switched off. The privacy policy says the same thing in more detail.