Privacy Policy

What we process and why

When you search, we process your song title and optional artist name to find matching recordings. Opening a recording or loading more results also uses recording identifiers and temporary lookup references. Typing in the form, filling the example and reading these pages do not send a music lookup.

We process a random session identifier, request timing and verification results to prevent automated abuse and keep the service available. Our hosting provider also processes your IP address and connection information to deliver and protect the website.

Some lookup request URLs contain search terms and temporary lookup references. Signing a reference prevents tampering but does not encrypt its contents. These URLs may be visible in browser diagnostics or infrastructure records. Please use the fields for song and artist names, and do not enter personal, confidential or sensitive information.

Cookies and verification

Your first lookup sets a necessary cookie named __Host-isrc_session on our public website. It contains a random signed identifier and lasts up to 24 hours. We use it to apply request limits and remember a successful security check. It is not an account or an advertising identifier.

When a security check is needed, we load Cloudflare Turnstile. It processes browser and connection signals to distinguish visitors from automated traffic. Our server sends the verification token and your IP address to Cloudflare to validate the check. A successful check is remembered for 15 minutes; it does not remove request limits. Read the Turnstile Privacy Addendum for Cloudflare’s handling of these signals, including its use of them to improve bot detection.

We do not load advertising trackers or use your lookup data for advertising. Website analytics is described below and is separate from the cookies needed for lookups and security checks.

Website analytics and your controls

Google Analytics 4 is enabled by default on our public website to understand visits, page views and engagement. Google receives page addresses and titles, the referring website, browser and device information, and cookie identifiers. Google also receives your IP address as part of the connection. We do not send song titles, artist names, ISRCs, lookup references or clipboard contents as analytics parameters. Page addresses exclude query strings and fragments; external referring addresses are reduced to their website origin.

You do not need to click an acceptance prompt before analytics starts. You can choose “Turn off analytics” in Analytics settings without affecting song lookups. We keep a previously saved decision to turn analytics off, and we also keep it off when your browser sends Global Privacy Control. Google Signals, advertising personalization and automatic form and site-search tracking are disabled.

Analytics uses cookies named _ga and cookies beginning with _ga_. We configure them to expire after 60 days without extending that lifetime on each visit. We remember your choice in your browser’s local storage under analytics_consent until you change it or clear website data. These identifiers are separate from your necessary lookup session.

We set Google Analytics user-level and event-level data retention to two months, with renewal on new activity disabled. This setting does not limit the retention of standard aggregated reports. Google’s processing and deletion schedules are described in its data retention guidance.

You can open Analytics settings in our footer to change your choice. Turning analytics off stops further collection by our website and removes its analytics cookies. This does not erase data Google has already received. Read Google’s privacy policy and its data privacy information for details about Google’s processing.

Service providers and external links

We use Cloudflare to host and secure the website. Its handling of network and security information is described in Cloudflare’s privacy policy.

Our hosting platform also runs Cloudflare’s browser performance beacon. It sends page-load timing and page-view measurements to Cloudflare without using analytics cookies. This hosting measurement is separate from Google Analytics and is not controlled by the Google Analytics setting. See Cloudflare’s performance data collection for details.

Our server sends the search terms or recording identifier needed for your lookup to Deezer or Apple. Those providers receive the request and related network information. We do not send them your session cookie or Turnstile verification token. Read Deezer’s privacy policy and Apple’s privacy policy for their practices.

Following a recording link takes you to that provider’s website, where its own privacy and cookie policies apply. Our query tool does not load music previews or artwork. Our providers operate internationally, so information may be processed outside your country; their policies describe the applicable safeguards.

What we keep and for how long

We do not save a query history or a persistent catalogue of your search results. Results are held in the current page. Your browser may retain page information according to its own settings.

Our rate-limit records use a keyed hash of your IP address rather than a saved plain-text IP address. Anonymous session and network-limit records are cleared from active storage after 24 hours without activity. This cleanup does not erase Cloudflare platform logs, backups or recovery history. Separate service protection records contain request-budget timestamps, fault counts and cooldowns, without storing your search terms or recording results.

To investigate failures, our application logs record a random request ID, action, response status, duration and result counts. They do not include search text, full results, ISRCs, raw IP addresses, session cookies, lookup references or verification tokens. Default request logs and traces are disabled, and query parameters are redacted from logged request URLs.

Cloudflare currently retains Workers Logs for 3 days on its Free plan and 7 days on its Paid plan. The applicable period depends on our hosting plan. Other platform security records have their own retention rules. See Workers Logs retention.

Your choices and rights

You can remove or block our cookie through your browser settings. Blocking it may prevent lookups or security verification from working. Removing it does not bypass network limits or delete records already held by our providers.

Copying writes only the code or citation you choose to your clipboard. We do not read the rest of your clipboard. We do not maintain an account profile or saved lookup history for this service.

Depending on the law where you live, you may have rights to access, correct or delete personal information, object to or restrict its processing, and complain to a data protection authority. These rights are subject to the conditions and exceptions in applicable law.

Security and policy updates

We use signed session identifiers, limited diagnostic fields and access controls to reduce unnecessary exposure. No internet service can guarantee absolute security.

We will update this policy and its date when our practices change. If we introduce accounts, payments or other features that use additional information, we will describe that handling before those features become available. Read our Terms of Service for the rules that apply to using ISRC Finder.

Contact us

For privacy questions or requests concerning your information, email support@isrcfinder.org.