PRIVACY POLICY
Effective date: June 9, 2026

SangBoken is operated by R. Hegge.
Contact: heggerob@gmail.com

This Privacy Policy explains what personal data may be processed when you use the SangBoken website and why.

1. Account sign-in
SangBoken may let you sign in with Firebase Authentication using Google or Apple.
When you sign in, Firebase and the selected identity provider may process account identifiers such as your user ID, email address, display name, provider ID, authentication tokens, and related security information.
Firebase ID tokens are used to confirm that requests for private sync and account-backed actions come from an authenticated user.

2. Data processed directly in your browser
This web version stores certain data locally on your device, including favorites, pinned songs or books, text-size settings, language choice, theme preference, recent book selection, and private notes you choose to keep in the site.
This local data is stored in your browser so the website can remember the experience you asked for.

3. Synced private app state
If you sign in, SangBoken may sync private app state with the SangBoken backend, including favorite song IDs, liked song IDs, pinned book IDs, pinned song IDs, private notes by song ID, sync revision data, platform, app version, and a device identifier used for sync reliability.
Public likes may be recorded as account-backed song-like events so the service can maintain like status and counts.

4. Technical and server-side data
When you visit the website, technical request data may be processed to deliver and protect the service. This can include IP address, date and time, requested URL, referrer, user agent, and similar log information handled by the hosting or infrastructure provider.

5. Contact and rights-request data
If you send an email about privacy, copyright, support, or corrections, your contact details and message content may be processed to handle and document the request.

6. Why the data is used
Data may be used to operate the website, authenticate users, sync requested private state, remember local settings, keep the service secure, respond to inquiries, investigate rights-related notices, and improve reliability.

7. Legal bases
Where applicable under the GDPR, processing may rely on one or more of the following legal bases: your consent, performance of a service you request, compliance with legal obligations, and legitimate interests in operating, securing, and administering the website.

8. Sharing
Personal data is not sold.
Data may be processed by authentication, hosting, infrastructure, security, database, sync, or email providers to the extent needed to operate the website or respond to requests.
For sign-in, relevant account data may be processed by Firebase, Google, Apple, or the identity provider you choose.
Information may also be disclosed where required by law or where necessary to handle a rights claim, legal request, or abuse issue.

9. Retention
Local browser data remains on your device until you remove it, clear browser storage, or use site controls that overwrite or delete it.
Synced private app state is kept while needed to provide account-backed features, unless deleted, overwritten, or no longer required.
Operational logs and correspondence are kept only as long as reasonably necessary for security, troubleshooting, legal compliance, or handling the request in question.

10. Your rights
Depending on applicable law, you may have rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent where processing is based on consent.
You may also have the right to complain to your supervisory authority, including Datatilsynet in Norway.
If the relevant data exists only in your browser storage and is not available to the operator, you can usually delete it by clearing the site data in your browser or by removing the saved items inside the site.

11. Cookies and similar storage
SangBoken uses browser storage for essential user-requested features such as saved notes, favorites, pins, and appearance settings.
At the time of this version, SangBoken does not intentionally use advertising cookies or analytics cookies in the web app itself.
If that changes, this policy and any required consent flow should be updated.

12. International transfers
If service providers process data outside your country, any required transfer safeguards should be used under applicable law.

13. Changes to this Privacy Policy
This Privacy Policy may be updated from time to time.
The effective date will be updated when material changes are published.

14. Contact
Privacy questions or requests can be sent to heggerob@gmail.com.