Welcome to 16 LYRICS (referred to as "16 LYRICS", "the Application", "we", "us", or "our"), accessible at https://16lyrics.duckdns.org. This Privacy Policy explains in detail how 16 LYRICS collects, uses, processes, stores, protects, and discloses personal data and Google User Data when you authenticate and interact with our real-time messenger and collaboration platform designed for YouTube creators and music community enthusiasts.

1. Information We Access, Collect, and Process

16 LYRICS collects only the minimum necessary information required to provide user authentication, creator identity verification, and real-time messaging functionality. We access the following categories of data:

A. Google User Data (OAuth 2.0)

When you choose to sign in using your Google Account, we request access to specific, approved OAuth scopes:

Google OAuth Scope	Data Accessed	Purpose & Justification
openid	Unique Google OpenID identifier	To authenticate your identity securely via OpenID Connect protocols.
.../auth/userinfo.email	Primary Google account email address	To establish and identify your user account and provide critical account notifications.
.../auth/userinfo.profile	Full name and profile picture (avatar)	To create your initial display profile and render your avatar in chat conversations.
https://www.googleapis.com/auth/youtube.readonly	Read-only YouTube channel public details (Channel ID, Channel Title, Custom Handle, Avatar, Public Subscriber Count, Public Video Count)	To verify genuine ownership of the creator's YouTube channel and display the verified creator badge, custom @handle, and subscriber tier in the community messenger.

B. User-Generated Communications & Content

• Chat Messages: Text messages, emoji reactions, voice voice-notes, and file attachments you explicitly compose and send within one-to-one or group chats.
• Media Files: Photos, audio files, and documents you deliberately upload to share with chat recipients.
• Profile Customizations: Custom bios, username aliases, and theme preferences configured within your account settings.

C. Technical & Session Data

• Authentication Cookies: Secure, HTTP-only session cookies strictly utilized to maintain your authenticated login state.
• Connection Metadata: WebSocket connection states and IP address headers strictly used for rate limiting, DDoS mitigation, and active online presence indication.

2. How We Use Google User Data and Collected Information

We use the data obtained through Google APIs and direct platform usage strictly for the following operational purposes:

3. Strict Prohibition on Selling, Renting, and Sharing Google User Data

16 LYRICS maintains a strict zero-monetization policy regarding personal data:

• We DO NOT sell, rent, lease, trade, or monetize your Google user data or YouTube information to data brokers, advertising networks, or any commercial entities.
• We DO NOT use Google user data for targeted advertising, behavioral profiling, remarketing, or credit evaluation.
• We DO NOT transfer or disclose Google user data to third parties, except in direct fulfillment of core app services (e.g., storing data in our secured database provider) or when required by mandatory legal statutory process.
• We DO NOT use your messages, voice recordings, or Google user data to train third-party artificial intelligence or machine learning models.

4. Human Access Policy

No humans (including 16 LYRICS developers and system administrators) read or inspect user communications or Google User Data, except in the following strictly limited situations:

• We have obtained your explicit prior consent to troubleshoot a specific technical problem or account recovery issue.
• It is strictly necessary for security purposes, such as investigating system crashes, preventing severe platform abuse, or addressing security breaches.
• It is required to comply with applicable laws, valid court orders, or governmental legal processes.

5. Data Storage, Security, and Retention

16 LYRICS implements rigorous technical and organizational security controls:

• Encryption in Transit: All communications between your browser and our servers are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS) and secure WebSockets (WSS).
• Encryption at Rest: Database records, session tokens, and metadata are housed in secured MongoDB Atlas clusters protected with AES-256 encryption at rest.
• Media Storage: Media files and attachments are securely stored using Cloudflare R2 object storage with restricted access controls.
• Data Retention: We retain your Google User Data and chat records only for as long as your account remains active. If you delete your account, all associated personal data and message records are permanently purged.

6. User Control, Permissions Revocation, and Data Deletion

We provide full autonomy and transparency regarding your data:

7. Cookies and Local Storage

16 LYRICS uses only strictly necessary first-party cookies and local storage tokens:

• session / admin_session: Secure, HTTP-only, SameSite cookies used exclusively to keep you authenticated during your active session.
• theme / preferences: Stored locally in your browser to preserve your selected dark/light mode and audio settings.
• We do not employ third-party analytics tracking cookies or advertising tracking beacons.

8. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect enhancements in our application or changes in regulatory legal standards. Any revisions will be published directly on this page with an updated "Effective Date" at the top of the document.

9. Contact Information & Developer Details

If you have questions, inquiries, or requests regarding this Privacy Policy or our data handling practices, please contact us: