Privacy policy
Last updated 24 September 2026
Written in plain language to describe exactly how LimeLight works today. It has not yet been reviewed by a lawyer; if anything here is unclear, write to us and we will answer.
The short version
LimeLight makes videos in your browser, on your own computer. Your songs, artwork, footage, photos, logos and fonts stay on your device. We keep an account (email and password) only if you make one, your plan, and — when you are signed in — the settings of your projects. We do not sell your data, run advertising trackers or use analytics scripts. A few optional features send something out; each one is listed below and says so at its button.
What stays in your browser
The song, cover, footage, photos, logo, font and lyrics you add to the studio are processed in your browser. They are kept in your browser's own storage (see the table below) so your projects reopen on the same device, and the finished video is written on your own computer. None of that media is uploaded to make a video.
What leaves your browser
- Your account, if you make one: your email address and password (stored hashed by Supabase). The sign-up form asks for nothing else; the account's display name is the part of your email before the @ until you change it. We also keep your plan, its Stripe status, release passes, lifetime seat, monthly usage counters, your referral code and, if you arrived through one, who referred you.
- Project settings, when you are signed in: after every save, a project's settings — the look, colours, effects, trim, and the text you typed (title, artist, album, lyrics, captions, section edits) — sync to your account so you can reopen the project on another device. The song, cover and other media never sync; the other device asks for them again. You can remove a project from your account in the Projects panel. Signed out, nothing syncs.
- Shared looks, only when you press Publish: the look's visual settings (never your media, title or lyrics), its name and one line about it, and the name you type into “Shown as” — or “Anonymous” if you leave it blank. Published looks are public at their own page and in the community library.
- Anonymous export stats, only if you tick the box in the export dialog: four numbers describing the song (tempo, punch, dynamics, brightness), the look, what kind of video and which formats, and the plan. No account, no name, no audio.
- Transcribe from the song (paid plans, where offered): a small, compressed copy of that song is sent to our server, which passes it to OpenAI's transcription service and returns the words with their timings. We do not keep the copy; OpenAI's API terms apply to the processing.
- AI pictures (paid plans, where offered): Paint a background and Paint a scene set send OpenAI a description LimeLight writes from your cover's colours, what the analysis heard in the song and the words you typed. Extend the cover to the frame also sends your cover image, so it can be continued outward. The picture comes straight back to your browser; we keep neither what was sent nor the picture. “Make scenes from the cover” without AI happens entirely in your browser.
- Make it 3D and Time them to the singing run AI models inside your browser. The first use downloads the model files (about 50 MB and 110 MB) from Hugging Face and jsDelivr, which see your network address as with any download; your cover and your song never leave your computer.
- Posting from the Social tab (paid plans, where offered) — see the next section.
- Payments go to Stripe on Stripe's own page; we never see your card number.
Posting to YouTube, Facebook, Instagram and TikTok
Posting a finished video to YouTube or Facebook sends the file straight from your browser to that platform with your own account. You sign in on Google's or Meta's own window; the permission they give back (for YouTube: upload videos and read your channel's name) is held in the page's memory for that visit and is gone when you close the tab. We never see the file, your login or that token, and we store no YouTube or Facebook data on our servers.
Instagram and TikTok only accept a link, so if you tick the box at that button the finished video is copied to our file storage (Cloudflare R2) under a signed link that stops working within the hour, and the copy is deleted as soon as the post is through. TikTok's permission is sealed inside the ll_tiktok cookie that only our server can read; disconnecting TikTok or clearing your cookies removes it.
Where the studio offers Post everywhere, you connect your accounts on the page of a posting service, Upload-Post, under a profile named after your LimeLight account. That service holds those connections and posts on your behalf when you press the button, fetching the same temporary copy. When you schedule a post (up to seven days ahead, one at a time or a release week), its copy is kept under a link signed until half a day past the post's time, deleted when you cancel it or, once the post has gone out, the next time you open the Social page, and removed automatically eight days after it was made. The list of your posts and their links under Your posts is kept in your own browser. You can disconnect any account there at any time, and their privacy policy applies to what they hold.
YouTube. LimeLight uses YouTube API Services. By posting to YouTube from LimeLight you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke LimeLight's access to your Google account at any time at security.google.com/settings/security/permissions. Because we store no YouTube data on our servers, revoking access leaves nothing of it with us; if that ever changes, we will keep YouTube data no longer than 30 days and delete it within 7 days of your revoking access or asking us to.
The waiting list
While LimeLight is not yet open, the front page collects email addresses for a waiting list. If you join it we store your email address, the sentence you agreed to when you gave it, the date, and — only when the link you arrived through carried them — where the link was shared and the referral code of whoever sent you. We also store a one-way hash of your network address, which lets us stop a script signing up a thousand times; the address itself is never written down. That page stores nothing on your device: no cookies, no local storage, no analytics or tracking scripts of any kind.
We use the list for one thing: to tell you when LimeLight opens, and to give you the free release pass promised on that page. We do not sell or share it. Every email we send will have an unsubscribe link, and you can ask us to delete your address at any time by writing to olkona75@gmail.com.
The label tools
If you use the older record-label tools behind the dashboard, what you enter there — artists, releases, lyrics, and the audio and covers you upload — is stored with Supabase and in our file storage (Cloudflare R2), and their AI features send your text to OpenAI (and web searches to Tavily). The studio does not use any of this.
Cookies and storage on your device
Everything below is either needed for a feature you asked for or a preference you set. We use no advertising or analytics cookies, so there is nothing to consent to beyond using the feature. You can clear any of it in your browser's site settings; the studio still works, it just forgets.
| Name | Kind | What it is for | How long |
|---|---|---|---|
sb-…-auth-token | Cookie (Supabase) | Keeps you signed in. Set only when you sign in. | Until you sign out, or the session expires |
ll_tiktok | Cookie, httpOnly | Your TikTok posting permission, sealed (encrypted) so only our server can read it. Set only if you connect TikTok in the Social tab. | 365 days, or until you disconnect |
ll_tiktok_state | Cookie, httpOnly | A one-time check that the TikTok sign-in window you return from is the one you opened. | 10 minutes |
ll_preview | Cookie, httpOnly | The owner's private preview link while the site is a waiting list. Visitors never get it. | 30 days |
limelight-last-project | Local storage | Which project to reopen when you come back. | Until you clear it |
limelight-favourite-looks, limelight-recent-looks | Local storage | The looks you starred and the ones you used last. | Until you clear it |
limelight-destinations | Local storage | The platforms you last exported for, so Export remembers them. | Until you clear it |
limelight-phone-ui, limelight-phone-platform, limelight-credit, limelight-sync-ms, limelight-show-order, limelight-seen-quickstart | Local storage | Studio preferences: the phone overlay (and which app's), whether descriptions credit LimeLight, a picture-to-sound timing nudge, the album builder's order, whether you have seen Quick make. | Until you clear it |
limelight-release-date | Session storage | The release date of an album you opened from your label, so the release-week plan in the Social tab starts from it. | Until you close the tab |
limelight-recent-commands, limelight-tips | Local storage | The last few things you ran from the studio's search (Ctrl K), and which of its one-time tips you have already seen. | Until you clear it |
limelight-title-n, limelight-author | Local storage | Which suggested video title comes next, and the name you last published a look under. | Until you clear it |
limelight-tap-mode | Local storage | How Tap along times your lyric lines: a tap as each line starts, or holding the key while it is sung. | Until you clear it |
limelight-share-stats | Local storage | Whether you ticked “share anonymous export stats”. | Until you clear it |
limelight-social-artist, limelight-social-defaults, limelight-post-log | Local storage | The Social page: which artist you last posted for, the links, hashtags and sign-off you set for yourself, and your post log (links to what you posted and the codes that let you cancel a scheduled post). | Until you clear it |
limelight-ref | Local storage | A referral code, only when you arrived through someone's referral link — sent with your sign-up so they get their reward. | Until you sign up or clear it |
limelight-studio | IndexedDB | Your projects: settings plus the song, cover, footage, photos, font and logo you added. | Until you delete the project or clear site data |
limelight-viz | IndexedDB | The analysis of each song (tempo, sections, spectrum), so it opens faster next time. | Until you clear site data |
limelight-library | IndexedDB | Saved styles and artists in the studio library. | Until you clear site data |
Export scratch files | Origin private file system | A video being written while it renders, handed to you as the download. | Removed when the next export starts |
transformers-cache | Cache storage | The downloaded AI models for “Make it 3D” and “Time them to the singing”, so they download once. | Until you clear site data |
Who processes data for us
These services handle data on our behalf, each only for the feature named. Several are used only when the feature is switched on and you choose it.
| Service | For | What they receive |
|---|---|---|
| Supabase | Accounts and database | Your email, hashed password, account and plan rows, synced project settings, shared looks. |
| Stripe | Payments | Your card and billing details (entered on Stripe's page), what you bought. |
| Vercel | Hosting | Every request to the site, including your network address, as any web host sees it. |
| Cloudflare R2 | File storage | A temporary copy of a video you choose to post to Instagram, TikTok or through Post everywhere; files you upload to the label tools. |
| OpenAI | Transcription and pictures (paid plans, when offered) | The song for Transcribe from the song; the prompt, and for Extend the cover your cover image, for the AI picture tools; text for the label tools' AI features. |
| Upload-Post | Post everywhere (paid plans, when offered) | The social accounts you connect on their page, and the temporary video copy they fetch to post. |
| Google (YouTube), Meta (Facebook, Instagram), TikTok | Posting, only when you post | The video, title, description and thumbnail you send, under your own account. |
| Hugging Face, jsDelivr | Model downloads | Your network address when your browser downloads an AI model file from them. Nothing of yours is sent. |
| Tavily | Web search in the label tools | The search the label tools' assistant runs for you. |
Some of these services are in the United States, so your data may be processed there. We also keep short-lived counters that stop abuse (keyed by your account id or a salted hash of your network address, cleared within about a day), and our host keeps ordinary server logs.
How long we keep it
- Your account, its plan and your synced project settings: until you delete your account.
- Published looks: until you ask us to remove them or delete your account.
- Payment records: Stripe keeps them as the law on bookkeeping requires; we keep your Stripe customer id with your account.
- Anonymous export stats: kept, since they identify no one.
- Temporary posting copies: deleted as soon as the post is through; a scheduled post's copy is kept until it has gone out (at most eight days).
- The waiting list: until LimeLight opens and you have been told, or until you ask us to delete it.
Your rights and deleting your data
You can see your details on your Account page, download the data your account holds with “Download my data”, and delete your account and everything tied to it with “Delete my account” — or write to olkona75@gmail.com and we will do it for you and confirm, within thirty days. How deletion works explains what is removed. Depending on where you live, you may also have the right to correct your data, object to or restrict its use, and complain to your data protection authority.
Children
LimeLight is not for children under 13, and we do not knowingly keep data about them. If you believe a child under 13 has made an account, write to olkona75@gmail.com and we will delete it.
Changes
If this policy changes in a way that matters, we will say so on this page and, for paying customers, by email before it takes effect.