Privacy Policy
AI Karaoke is an app that generates songs with AI and lets you sing karaoke with your real voice. This page explains what we collect, where it goes, and how you delete it.
PrivacyInfo.xcprivacy manifest in the app declares
NSPrivacyTracking = false, and that is verifiable.1 · Who holds your data
The data controller (under Vietnam's Personal Data Protection Law 91/2025/QH15, in force since 1 January 2026) is
the operator of this app, operator of ai.vkara.net and the AI Karaoke app. For any question, request or complaint about
your data, write to hotro@vkara.net; we reply within 72 hours.
2 · What we collect
| Type | Details | Why |
|---|---|---|
| Identity | Sign-in is with Apple or Google only. New (since 6 October 2026): your Sign in with Apple user identifier; your Google user identifier, email address and name, which Google gives the app when you choose "Continue with Google". We never receive your Apple or Google password. Kept from before: accounts created with an email address and password before 6 October 2026 still keep that email and a hashed password until they move to Google sign-in or are deleted. @handle, display name, profile picture, bio, language. | So you can sign in again and others can recognize you. |
| Voice | Recordings of you singing. | This is the core of the app: mixing with the backing track, building videos, scoring. |
| Photos and video | Selfies and video captured while you sing, if you turn the camera on. Videos we build. | As the background of lyric videos, and as the face for lip-sync MVs. |
| Content you post | Captions, hashtags, comments, private messages, the song ideas you type. | To show on the feed, to message each other and to generate lyrics. Private messages are automatically checked for profanity and outside links before sending. |
| Activity | Likes, saves, follows, videos watched, blocks and reports. | So the feed does not repeat videos you have seen, and so blocking and reporting work. |
| Purchases | Apple transaction identifiers (for monthly plans also the transaction and subscription-chain identifiers, the plan and its expiry date) and the diamonds credited or debited. | To keep the wallet ledger and to refund correctly when a generation fails. We do NOT receive or store your card details — Apple handles all payment. |
| Technical logs | Your IP address, time, the path you requested and device type — recorded automatically by our web server for every request, except crash-report submissions. | To find bugs and block attacks. Kept for 14 days, then deleted automatically. We do not use the logs to build behavioral profiles, and we never write emails or passwords into them. |
| Crash reports (only if you turn them on) | Reports produced when the app crashes, hangs or runs too heavily, plus performance measurements (launch time, memory, how often iOS ended the app). iOS produces these reports for the app regardless of your iPhone's Analytics setting; the app sends them only if you turn on Profile → Settings → Privacy → Send crash reports (off by default). They contain the app version, iOS version, device model, date (no time of day) and the code location of the fault. | To find and fix crashes. They are not linked to your account. The server uses your IP address only in memory to throttle bursts; we do not store your IP address with them or log those requests; they contain nothing you typed. Turning the switch off deletes unsent reports from your device. Because they are not linked to an account, reports already sent cannot be deleted with the account; they are deleted after 90 days. |
| Push notifications | Your Apple device token, if you agree to notifications. | To tell you when a song is ready or when someone interacts with you. |
When content is reported, even a private message, our moderators see only the reported content, not the rest of the conversation. Content reported by at least 3 people may be temporarily hidden from the feed while it is reviewed. Some reports may be resolved automatically using pre-set criteria — for example removing content that clearly violates the rules, or closing reports that time out without meeting the criteria — without anyone reviewing them first.
We do not collect GPS location, contacts, health data, financial data or web-browsing history. The IP address in the logs tells us your network region, not a GPS location.
3 · Where your data goes
To generate songs and build MVs, some data has to be sent to outside services. The complete list, with nothing hidden:
| Recipient | What it receives | When | Where it is processed |
|---|---|---|---|
| Anthropic (Claude) | The song idea you type, and the lyrics that are written | Each time you create a new song | Stored in the United States; model inference may run in other regions (default "global") |
| Google (Gemini) | The song idea you type (after it is condensed), to pick a matching lyric style | Each time you create a new song | No fixed country: may be stored transiently or cached in any country where Google or its agents have facilities |
| kie.ai (Suno) | Lyrics and a style description. For lip-sync MVs: the photo and voice clip you choose | When music is generated, and when you build an MV | kie.ai: United States and possibly other countries; no specific servers published Suno: Via kie.ai (location not published). Suno's own policy: servers in the United States |
| ByteDance (OmniHuman) | Lip-sync MV model: the photo and voice clip you choose, passed through kie.ai | When you build an MV, if the plan uses this model | Via kie.ai (location not published). BytePlus's own policy: Singapore, Malaysia, United States, Hong Kong, Indonesia, Japan |
| Kuaishou (Kling) | Lip-sync MV model: the photo and voice clip you choose, passed through kie.ai | When you build an MV, if the plan uses this model | Via kie.ai (location not published). Kling's own policy: servers in Singapore |
| OpenAI | The photo you upload, when you choose "AI scene" instead of your own photo | Only when you choose an AI-generated background | No fixed country published for the default API (a US/Europe option exists for eligible customers) |
| Cloudflare (R2) | All files: voice, photos, video | Always — this is where files are stored | Mainly the United States and the European Economic Area; may be accessed from other countries |
| Apple | Verifying purchases, and delivering push notifications | When you buy diamonds or receive notifications | Generally stored in the United States (Apple Inc.) |
| Apple (sign-in) | Your identifier in the app, and your name if you choose to share it (never a password) | When you choose "Sign in with Apple" | Generally stored in the United States (Apple Inc.) |
| Google (sign-in) | Your identifier, email address and name, which Google gives the app (never a password) | When you choose "Continue with Google" | No fixed country: may be stored transiently or cached in any country where Google or its agents have facilities |
We do not share your data with anyone outside this list.
4 · Public and private videos
When you post, you choose Public or Only me.
- Public: shown on the feed and viewable by anyone, including people without the app (via the share link). Others can sing over (duet) your public video — your voice part is then used in their duet.
- Only me: not on the feed, no share link.
5 · How long we keep it, and how to delete it
Data is kept until you delete it, or until 30 days after you delete your account.
Exception: purchase transaction identifiers for diamonds and transaction / subscription-chain identifiers for monthly plans are kept without any link to your identity (no name, no email) so that a paid or refunded transaction cannot grant diamonds twice.
- Delete a recording or a video: right in the app.
- Delete your account: Profile → ☰ → Settings → Delete account. Once you tap it the account is locked immediately and all of your content disappears from other people's view at once — profile, videos, comments, search.
After 30 days the system deletes permanently, with no way to undo: your profile, recordings, posted videos, comments, wallet ledger, and all of your media files on our CDN (cached copies on the CDN expire within 4 hours). At that point your email and @handle are also released for others to register.
One exception, stated up front: AI songs you created stay but are detached from your account and the text you typed is erased. The reason: other people may have sung that song and posted their own videos — deleting the song would delete the content of people who have nothing to do with you.
Reports are kept after they are handled, even when the content is removed, so the moderation team knows what happened. The moderation log (user IDs, actions, times; no content) is kept for 24 months, even after the account is deleted, to show how violations were handled; dismissed reports about you are deleted with your account.
Backups: we back up the database every night in case of hardware failure and delete every backup older than 30 days. Backups made while your account still exists — including the 30-day grace period — hold your data until they expire, so your data is gone everywhere at most 60 days after you tap Delete account. Backups are used only to recover from incidents, not to restore a deleted account; if we ever restore a backup, we re-apply every deletion you made after it was taken.
Server logs (IP, path) are deleted automatically after 14 days.
6 · Children
The app is not for people under 16. Vietnamese data-protection law treats anyone under 16 as a child and requires parental consent; because the app sells things in-app and lets you post public videos, we set the minimum at 16 instead of asking parents for consent. We do not knowingly collect data from children. If you are a parent and believe your child has created an account, write to hotro@vkara.net — we will delete that account and all data attached to it.
7 · Your rights
Under Vietnam's Personal Data Protection Law 91/2025/QH15 you may know what data is processed · access and receive a copy · correct · delete · withdraw consent · request that processing stop · object to processing · and lodge a complaint.
- View, correct and delete data, and delete your account: right in the app.
- Receive a copy of your data, withdraw consent, stop processing: write to hotro@vkara.net. We reply within 72 hours.
- Complaints: write to us first. If you are not satisfied with how we handle it, you may complain to the competent state authority on personal-data protection (the Department of Cybersecurity and High-Tech Crime Prevention — A05, Ministry of Public Security), or sue under the law.
Withdrawing consent for the use of your voice and face means you can no longer use the video and MV features — the rest of the app keeps working.
8 · Changes to this policy
When there is a significant change we update the date at the top of the page and tell you in the app.
Summary
We collect your account identity (a Sign in with Apple or Google identifier), your voice recordings, photos and videos you choose to capture, the content you post, your in-app activity, and Apple purchase identifiers. We do not track you and we have no advertising SDKs. Private messages are automatically checked for profanity and outside links before sending. The moderation log (user IDs, actions, times; no content) is kept for 24 months, even after the account is deleted, to show how violations were handled; dismissed reports about you are deleted with your account. Crash reports are off by default: if you turn on Profile → Settings → Privacy → Send crash reports, they are not linked to your account, we do not store your IP address with them or log those requests, and they are deleted after 90 days. Our web server logs your IP address, request path and device type for 14 days, then deletes them (except crash-report submissions). Database backups are made nightly and deleted after at most 30 days, so your data is gone everywhere at most 60 days after you tap Delete account. The app is for users 16 and older. You can delete any recording or video, and delete your account entirely, in the app; after deleting, you can sign in again and choose Reactivate within 30 days. Questions: hotro@vkara.net.