- Legal
Privacy policy
Your lyrics, audio and project files are never transmitted to us. LyricBinder reads your files locally and displays them. If you choose to edit a local lyric file in LyricBinder’s edit mode, the changes you make are saved to that file on your machine. It has no upload path for your creative work, switched on or off.
1. Who this covers
This policy applies to leftonmarket.com (the “site”), to LyricBinder (the “software”), and to anything you send us by email. “Left on Market”, “we” and “us” means the company that publishes them: Jeffrey Terrel, doing business as Left on Market, 52 Sheridan St #5, San Francisco, CA 94103, United States.
2. What we collect
This is the complete list. If something isn’t here, we don’t collect it.
- Opt-in usage analytics (software). Off by default. If you turn it on, each event contains: which feature was used (for example, that a lyric file was linked or Singer view was opened); the plugin version and format (VST3, Audio Unit or standalone); your operating system and version and 32/64-bit architecture; your device's language and region setting; the name and version of the DAW hosting the plugin; and a random identifier created on your machine. Like any internet request, it reaches PostHog from your IP address. We have PostHog set not to store IP addresses with events. Before the address is discarded, PostHog may use it to add an approximate location (such as country or city) to the event, and that location may be stored.
- Website analytics (this site). When you load a page, PostHog receives the page address, the page you came from, your browser and operating system type, screen size and language, and the time. Like any internet request, it reaches PostHog from your IP address. PostHog uses it to add an approximate location (such as country) and to compute an anonymous hash that rotates daily, which is how visitors are counted for that day. We have PostHog set not to store IP addresses with events. No cookie or local storage is used, and the hash can't be connected across days or to you. We also record when you click a Buy button, along with the page it was on.
- Update checks (software). LyricBinder checks for new versions by asking the GitHub Releases API for the latest published release. This check cannot be turned off. GitHub receives your IP address and the request. We send no identifier and no information about your files. If a newer version exists, the plugin tells you and, if you click, opens the installer download or release page in your browser. It never downloads or installs anything by itself.
- Purchases (software). Paid licenses are sold through Polar, which acts as the merchant of record: Polar, not us, takes your payment and collects the details it needs to do so, such as your name, email address, billing address, country, tax information and payment details. We never see your full card number. We receive order information from Polar: your name, email address, country, what you bought, the amount, and your license key.
- License activation (software). When you activate or deactivate a license in the plugin, it sends Polar: your license key; a one-way hash of an identifier of your computer (we never see the identifier itself, and the hash is different for each of our products); your computer's name as set in your system settings, plus the operating system, which appear in your device list so you can tell your machines apart; and the plugin name, version and operating system version. Because the computer name is something you chose, please don't put personal information in it if you'd rather not share it. The start date of any free trial is stored on your own machine only.
- Diagnostic reports (only if we ask you). To troubleshoot a specific problem, we may send you a diagnostic tool. It is not part of the normal download and does nothing unless you run it and choose to submit. A submitted report sends your macOS and plugin information, crash logs, plugin validation results and any note you add to a GitHub issue in our releases repository. That repository is private. Reports are visible only to us and to GitHub as the host.
- Email you send us. Your address, your message, and anything you attach, such as a bug report or crash log.
- Newsletter and launch-list emails. If you give us your address to be told about new Left on Market software or releases, it is stored by our email provider, Kit, and used only to send you those updates. Every message has an unsubscribe link.
- Standard web request data (site). The web host that serves this site may keep ordinary server logs, such as IP address, browser type, pages requested and time. Our host is DreamHost.
3. What we never collect
Even with analytics enabled, the following are never sent, recorded or seen by us:
- Your lyrics, or any part of their contents
- Your section names or song titles
- File names, folder names, or paths on your machine
- Your Google account details, or the contents of any connected document
- Your audio, project files, or mixdowns
- The raw identifier of your computer, which never leaves it
- Your name, email address, or IP address in analytics
- Anything from your DAW session beyond what the plugin needs locally to display your lyrics (bar, beat, tempo and play state), none of which leaves your machine
4. How we use what we collect
- Analytics: to see which features are used and which are ignored, and which DAWs, systems and regions we need to support, so we know what to fix or build next. We don't use it for advertising, profiling, or building a record of any individual.
- Purchases and licenses: to sell you the software, issue and verify your license key, limit how many computers it is activated on, and let you manage your devices.
- Update checks: to tell you a new version exists.
- Diagnostic reports: to find and fix the specific problem you asked us to help with.
- Email: to answer you and follow up on bugs. A support email does not put you on a mailing list. Newsletter and launch-list messages go only to people who signed up.
- Server logs: to keep the site running and protect it from abuse.
- Legal: to comply with law and to establish or defend legal claims.
If we ever want to use data for a purpose not listed here, we will update this policy first and, where the law requires, ask you.
5. How you're identified in analytics
Only by a random identifier generated on your own machine. It isn’t derived from your hardware, your account, or anything about you, and it isn’t linked to any other identity. If you opt out, that identifier is deleted.
Turning it off. Analytics can be switched off at any time from the About panel inside the plugin. Off means nothing is sent, not a reduced set and not a delayed batch. You can toggle it as often as you like.
6. Google Docs access
If you connect a Google Doc as a lyric source, LyricBinder requests Google’s drive.file scope. That grants access only to the specific files you pick, not to your Drive as a whole. Access is read-only. Document contents are read on your machine to display them and are never sent to us or to any third party. You can revoke access at any time in your Google Account permissions.
Left on Market’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
How it works: you sign in on Google’s own page, and the sign-in returns to a temporary listener on your own computer (127.0.0.1), so the credentials never pass through a Left on Market server. The long-lived Google refresh token is saved in your operating system’s secure storage (the macOS Keychain) and not in your DAW project. It is only used when you take a Google action. Disconnecting in the plugin asks Google to revoke the token and removes it from your machine.
7. Who else is involved
We don’t sell your information and we don’t share it for advertising. These are the only third parties that can touch data connected to us:
- PostHog: processes opt-in analytics, stored in the United States.
- Polar: sells the software as merchant of record, processes payments and taxes, issues license keys and stores activation records. See Polar's privacy policy.
- Kit: sends our newsletter and launch-list emails and stores subscriber addresses.
- GitHub: hosts software downloads and release information. Following a download link, or an update check, sends your IP address to GitHub under GitHub's privacy statement.
- DreamHost: hosts this website and provides our support and privacy email.
- Authorities and advisers: we may disclose information if required by law or valid legal process, or to our legal and professional advisers where needed.
- A successor: if Left on Market is sold or merged, the small amount of data described here could transfer to the new owner, bound by this policy.
8. This website, cookies and tracking
This site sets no cookies, stores nothing in your browser for analytics, serves its fonts from its own server, and runs no advertising scripts, so there is no cookie banner. We use PostHog, in its cookieless mode, to count visits and clicks on our Buy buttons. It does not record sessions, keystrokes or anything you type, and it honors your browser’s Do Not Track setting. Section 3 lists exactly what each visit sends. If this changes, we’ll update this policy and ask for your consent before anything non-essential is set.
9. Where data is stored and transfers
Left on Market is based in the United States, and PostHog (analytics), Kit (email), DreamHost (web hosting and email), Polar (purchases and licenses), GitHub (downloads, update checks and diagnostic reports) and Google process data in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your information is therefore transferred to the United States. We rely on these safeguards:
- PostHog, Google and GitHub are certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions where applicable), which the European Commission recognizes as providing adequate protection.
- DreamHost offers a Customer Data Processing Addendum.
- Polar describes how it handles international transfers in its privacy policy.
- Kit describes its approach in its GDPR compliance documentation.
Your lyrics, notes and audio are not part of any transfer, because they never leave your machine.
10. How long we keep it
- Analytics events (software and website): one year. Your local software identifier is deleted from your machine when you opt out.
- Order and license records: as long as needed for tax, accounting and legal obligations, and to keep your license working. Polar keeps its own records under its privacy policy.
- Support email: 24 months after the last message, then deleted.
- Newsletter and launch-list addresses: until you unsubscribe or ask us to remove you.
- Diagnostic reports: until we delete the GitHub issue, which we do once the bug is resolved.
- Server logs: 7 days.
We may keep information longer where the law requires it or to resolve a dispute.
11. Your rights
Because analytics are keyed to a random identifier that we can’t connect to you, we often won’t be able to find “your” data. We will help wherever we can. Depending on where you live, you may have the right to:
- know what we hold about you and get a copy;
- correct it or have it deleted;
- object to or restrict our use of it, and withdraw consent at any time (for analytics, by switching it off);
- receive it in a portable format;
- not be discriminated against for exercising these rights.
Email privacy@leftonmarket.com with your request. We’ll reply within 30 days. If you’re in the EEA or UK, you also have the right to complain to your local data protection authority.
California and other US states. We have not sold or shared personal information for cross-context behavioral advertising in the past 12 months, and we don’t use or disclose sensitive personal information for purposes beyond providing the service. You may use an authorized agent to make a request. We may need to verify your identity by replying to the address you wrote from.
Legal bases (EEA and UK). We process purchases and license activations because they are necessary to perform our contract with you, and keep order records to meet legal obligations. We process analytics on the basis of your consent; support email and launch-list messages on the basis of our legitimate interest in answering you and, for the launch list, your consent; update checks and server logs on the basis of our legitimate interest in delivering and securing the software and site.
12. Security
The strongest protection is that we don’t hold your work. Analytics, update and sign-in requests travel over encrypted connections, and Google credentials are held in your operating system’s secure storage, and the data we do hold sits with providers who have their own security programs. No system is perfectly secure, and we can’t guarantee absolute security. If a breach affects you, we’ll tell you as the law requires.
13. Children
Our software and site are made for adult music producers and are not directed to children under 13 (or under 16 in the EEA and UK). We don’t knowingly collect their information. If you think a child has sent us something, email us and we’ll delete it.
14. Other sites
We link to sites we don’t control, including GitHub, Google, Dropbox and iCloud. Their privacy practices are theirs.
15. Changes to this policy
If this policy changes in a way that affects what’s collected, we’ll say so in the release notes for the build that changes it and on this page, with a new date at the top. For material changes we’ll give at least 30 days’ notice where we can, and anything that needs your consent will wait for it. Earlier versions are available on request.
16. Governing law
This policy is governed by the laws of California and the United States, without limiting any mandatory rights you have under the laws of where you live.
17. Contact
Questions, requests or complaints: privacy@leftonmarket.com
Jeffrey Terrel, doing business as Left on Market, 52 Sheridan St #5, San Francisco, CA 94103, United States