Privacy Policy
Spicy Lyrics application portal. Last updated .
We keep what the role process needs: who you are on Discord, the applications you send, and the votes and notes about them. Applications are seen by you and by the people who handle them, never by the public. We keep them until you ask us to delete them. Usage statistics are cookieless and are never told who you are. To see, correct or delete your data, email [email protected].
1. Who is responsible
The portal is operated by Spicy Lyrics, from Slovakia (EU). For the processing described here, Spicy Lyrics is the controller under the General Data Protection Regulation (GDPR).
Write to [email protected] about anything on this page, or reach us on our Discord server at discord.gg/lyrc. Both reach a person. We have not appointed a data protection officer, because Article 37 GDPR doesn't require one of us.
2. What this covers
This policy covers this website, the Spicy Lyrics application portal, where members apply for community roles and Spicy Lyrics Staff vote and decide on them.
The other Spicy Lyrics services, such as the website at spicylyrics.org, the Spicetify extension, the Discord bot, the lyrics API and the developer platform, have their own privacy policies.
The portal has its own sign-in, separate from the one on spicylyrics.org. You use the same Discord account for both, but the account record here is a different one, and deleting one doesn't touch the other.
3. What we process, why, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Your Discord user ID, username, display name and profile picture address, read from your account as you use the portal and saved when they change, and when we first and last saw you (updated about every 10 minutes while you use it) | To know who you are, and to show your name on your applications and on the votes and notes you write | Contract, Art 6(1)(b) |
| Your account with Clerk, our login provider, and the Discord account linked to it, including the email address Discord shares with Clerk | To sign you in. Our server reads your account to find your Discord ID. We never save your email address, and don't use it | Contract, Art 6(1)(b) |
| Whether you are in our Discord server, which roles you hold, and when you joined, asked from our Discord bot on page loads and on every action | To check what you can apply for, vote on or decide. Roles are never taken from your browser | Contract, Art 6(1)(b) |
| The TTMLs credited to you as their maker, with upload dates, and the number of them; the titles and artists of tracks you pick | To check an opening's credited-TTML requirement, and to let you pick tracks in an answer | Contract, Art 6(1)(b) |
| Your applications: the questions as asked, your answers, the tracks you picked, and a snapshot of your roles, time in the server and credited TTMLs when you sent it; then the status, who decided and when, the decision note, your roles at the decision, and whether the bot gave the role | To decide your application, and afterwards to keep a record of what was decided and why | Contract, Art 6(1)(b), while it is open; legitimate interests, Art 6(1)(f), for the record afterwards |
| A Discord message to you when your application is decided: the opening's title, the result, the role and a link to your application, sent by our bot to your Discord ID | To tell you the result without you having to check. You can stop these by not allowing messages from the bot in Discord | Legitimate interests, Art 6(1)(f) |
| Votes: who voted, the vote (yes, unsure, no or recused), the written reason, and when | To decide applications with reasons. A vote is about the applicant and the voter both | Legitimate interests, Art 6(1)(f) |
| Staff notes: who wrote them, the text, and when | To discuss an application among the people deciding it | Legitimate interests, Art 6(1)(f) |
| A history of each application and opening: who sent, withdrew, voted, changed or took back a vote, added a note (not its text), decided or confirmed, whether the role was given, and who created or edited an opening | To be able to show how a decision was reached, and by whom | Legitimate interests, Art 6(1)(f) |
| Openings: their text and rules, and who created them | To publish openings and keep track of who wrote them | Legitimate interests, Art 6(1)(f) |
| Usage statistics, described in section 6 | To see which pages and features are used, so we know what to fix | Legitimate interests, Art 6(1)(f) |
| How you interact with each page, such as the timing of pointer movements, scrolling and key presses (never what you type), collected in your browser by Cloudflare's bot detection | To tell people from bots, and keep automated abuse off the portal | Legitimate interests, Art 6(1)(f) |
| Error output from our server when something fails, which can include a Discord ID or an application ID | To find out why something broke. It stays in our server's console output and is not sent to any logging service | Legitimate interests, Art 6(1)(f) |
About the legitimate interests. Our interest is running a fair and accountable process for handing out roles of trust in our community, where every decision has written reasons and can be explained later, and keeping the portal working. The data stays between you and the people who handle your application, and it is never used for anything else. You can object to any of it under section 11.
About free-text answers. Please keep sensitive information, such as your health, beliefs, sexuality or political views, out of your answers. Openings must not ask for it. If you include it anyway, it is used only to decide that application, and you can ask us to remove it.
4. Where the data comes from
Some of this doesn't come from you directly. Article 14 GDPR asks us to say where it comes from.
| Source | What comes from there |
|---|---|
| You | Your answers, and the votes, notes and openings you write |
| Clerk and Discord, when you sign in | Your Discord user ID, username, display name and profile picture |
| The Spicy Lyrics Discord bot | Whether you are in our server, your roles, when you joined, the TTMLs credited to you with their upload dates, and the username of your public TTML profile on spicylyrics.org, so the people reviewing your application can open that profile |
| Other members | Votes, reasons, notes and decisions that Spicy Lyrics Staff write about your application |
| Spotify | Titles and artists of tracks, read first from the track cache the spicylyrics.org website keeps, and asked from Spotify only when missing. They describe songs, not you |
5. Who sees your application
- You see your answers, the status, and the decision note if one was written. The portal doesn't show you the votes, who cast them, or staff notes. You can still ask us for them (section 11).
- Spicy Lyrics Staff who handle applications see your name and profile picture, your answers and snapshot, every vote with its reason and who cast it, the staff notes and the history. Which applications a staff member can see depends on their role.
- Our Discord staff channel. When you apply, the bot posts the opening's title and role there with a link to the review page. It never posts your name or your answers.
- Your Discord DMs, when your application is decided. The bot tries to message you the opening's title, the result, the role and a link to your application. Nobody else is sent it, and it leaves out any note from the person who decided. If your Discord settings don't allow messages from the bot, none is sent.
- On Discord, when you are accepted. The bot gives you the role, and Discord records it in our server's audit log as accepted by the person who decided, with the application ID. People on our server with audit log access can see that entry, and Discord keeps it under its own rules. The bot also keeps a record of each role it gave: the application ID, your Discord ID, the role and when. It needs that record so the same application can never give the role twice.
- The public sees none of it. Applications never leave the portal. Openings, which hold no applicant data, are shown to signed-in members and announced in our Discord server.
6. Usage statistics
We count how the portal is used with Umami, an open-source analytics tool we run on our own server. It is reached through an address on this website. No analytics company receives the data, and it is never sold, shared or used for advertising.
What is sent with each page view: the page's address with anything after a ? removed and any ID in it replaced by a placeholder, so every application counts as the same page; the page title, which is generic, such as “Application”; the page you came from, treated the same way; your screen size and browser language. Three actions are counted as well: sending an application (with which opening it was), voting (with the vote, and whether it replaced an earlier one), and taking a vote back.
What Umami works out itself: your browser, operating system and type of device from the request, and the country, region and city your connection appears to come from, from your IP address, which it doesn't store. To tell visits apart, it derives a code from your IP address and browser mixed with a value that changes every month, so visits in different months can't be linked.
What is not sent: your name, username, Discord ID or account, your answers, votes or reasons, and application IDs. We never tell Umami who you are, even when you are signed in. Staff review pages are counted the same way, with their IDs replaced.
One honest caveat: the time of a counted action could in principle be matched against the time an application or vote was saved in our own database. We don't do that. We look at the statistics only in aggregate, and we never use them to look anyone up.
The tracker sets no cookies and stores nothing on your device. It reads a few things your browser tells every website (screen size, language, the page address and the referring page) to send them with the visit, which we do on our legitimate interest in understanding how our own site is used. It doesn't react to Do Not Track or Global Privacy Control. If you don't want to be counted, a content blocker that blocks the analytics script stops it entirely.
7. Cookies and browser storage
| What | What it does | How long |
|---|---|---|
| Clerk session cookies | Keep you signed in and protect your session | Set by Clerk, see their privacy policy |
| Cloudflare bot protection | Cloudflare, which sits in front of the site, may set cookies such as __cf_bm, or cf_clearance after a challenge, and its bot detection script reads how you interact with the page and may store data in your browser, all to tell people from bots | Set by Cloudflare, usually minutes to hours |
There is no cookie banner, because nothing in this table needs consent. Section 109(8) of the Slovak Electronic Communications Act (No. 452/2021 Coll.) requires consent before anything is stored on or read from your device, unless it is strictly necessary for a service you asked for. Signing in and keeping the site safe from bots are exactly that, and Cloudflare's bot detection uses what it reads for nothing else. The usage statistics in section 6 store nothing on your device, and we set no advertising or tracking cookies.
8. Who else your data reaches
We don't sell personal data and we run no advertising. Your data reaches the following, and no one else:
| Who | What reaches them |
|---|---|
| Clerk, Inc. (sign-in) | Your account: the Discord account you sign in with, including the email address Discord shares, and your sessions. Your browser may load profile pictures from Clerk's image servers |
| Cloudflare, Inc. (network) | All traffic to the portal passes through Cloudflare, which sees your IP address and the pages you request. Cloudflare also adds a bot detection script to each page, which sends it signals about how you interact with the page (section 3) |
| Our hosting provider | Everything in section 3. It supplies the server in the United States where we run the portal, its database and cache, and our Umami instance |
| Our Discord bot | Not a third party: it is ours. It receives your Discord ID to check your roles and credited TTMLs, to give a role and to message you the result, and keeps the record described in section 5 |
| Discord | The role the bot gives you, the audit log entry for it, and the message the bot sends you when your application is decided. Your browser may load profile pictures from Discord. Discord handles this as a separate controller, under its own privacy policy |
| Spotify | Our server asks Spotify for track titles by track ID. Nothing about you is sent |
We also disclose data where the law requires it, for example to a competent authority with a valid order.
9. Transfers outside the EEA
We operate from Slovakia, but our server is in the United States, and Clerk and Cloudflare are US companies, so your data is transferred to and processed in the United States.
For providers certified under the EU-US Data Privacy Framework, the transfer rests on that adequacy decision. For any that aren't, it rests on the European Commission's Standard Contractual Clauses in that provider's data processing terms, under Article 46(2)(c) GDPR. Ask us at [email protected] which one covers a given provider, and we will tell you and send you the clauses.
The General Court upheld the Framework on 3 September 2025 (Latombe v Commission, T-553/23), and an appeal is pending before the Court of Justice (C-703/25 P). If the Framework falls, the affected transfers move to Standard Contractual Clauses and this page will say so.
10. How long we keep it
- Applications, votes, staff notes, the history, openings, and your name and profile picture: no fixed period. We keep them for as long as we run the role process through the portal, because the process depends on them: the waiting period after a decline is worked out from past applications, staff look at earlier applications when you apply again, and a decision may need explaining later. Until then they are deleted when you ask us to (section 11), or sooner when staff delete an opening, which deletes the applications sent to it along with their votes, notes and history.
- Short-lived copies: a marker that your profile is up to date, with your Discord ID, for 5 minutes; your roles for about 15 seconds and your credited TTMLs for about a minute, in our server's memory.
- The bot's record of roles it gave: for as long as the bot runs, because it stops a role being given twice. Your Discord ID is removed from it when you ask us to erase your data.
- Usage statistics: Umami has no automatic expiry, so they stay until we delete them. They never contain your IP address or your Discord ID.
- Server error output: for as long as our server keeps its console output.
Deleted data can remain in backups until they are replaced.
11. Your rights
If the GDPR applies to you, you have the right to:
- access the data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- have it erased;
- restrict how we use it;
- receive it in a structured, machine-readable form (portability);
- object to anything we do on legitimate interests (section 3). We then stop unless we have compelling grounds that override your interests, or need it for a legal claim.
How. Email [email protected] or message us on Discord. Tell us what you want and your Discord username or ID. If we can't tell the request is yours, we may ask you to confirm it from your Discord account. It is free, and we answer within one month. For a complex request we may take up to two more months, and we will tell you if we do.
Access includes what others wrote about you. Votes, their reasons, staff notes and decision history about your application are your personal data too, even though the portal doesn't show them to you. Ask, and we will give you a copy. We may leave out who wrote something, or part of it, where giving it to you would harm someone else's rights.
Correcting an application. You can't edit an application once it is sent. Withdraw it and apply again, or ask us to correct it.
Erasure is done by hand, within the one-month deadline. There is no delete button in the portal. We delete the applications you sent, with the votes, notes and history on them, and your name and profile picture. Where you voted on, wrote notes about or decided someone else's application, or wrote an opening, we keep those records but replace your name and Discord ID with a placeholder for a deleted member, because they are part of someone else's decision. Something another member wrote in their own words can still mention you; ask, and we will look at it. We also remove your Discord ID from our bot's record of roles it gave. We may keep what we need to establish or defend a legal claim.
Three things erasure here does not do:
- Deleting your sign-in account under Account doesn't delete anything else in the portal. Email us as well.
- Erasing your data on spicylyrics.org doesn't reach the portal. It removes you from the bot's record of roles it gave, but not from the portal's own database.
- It doesn't remove roles you already hold on Discord. Ask our staff on Discord for that, or say so in your request.
Complaints. If you think we handled your data unlawfully, please tell us first, since most things are quickest to fix directly. You can also complain to a supervisory authority at any time without contacting us. Ours is the Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk. If you live elsewhere in the EEA, you can complain to your own national authority instead; the European Data Protection Board lists them.
12. Automated checks
The portal checks an opening's published requirements before it lets you apply: that you are in our Discord server, hold the roles it needs, have been in the server long enough, have enough credited TTMLs, don't already have an open application or the role, and are past any waiting period after a decline. Where an opening lets the votes decide, it counts the votes people cast and, once enough are in, accepts or declines the application whichever way most of them went.
Cloudflare, which sits in front of the portal, also checks automatically whether a visit looks automated, from your connection and from how you interact with the page. If it does, you may be shown a challenge or blocked.
We don't think these checks are decisions with legal or similarly significant effects on you, so Article 22 GDPR doesn't apply. If one refused or blocked you wrongly, tell us and a person will look. Apart from telling people from bots, we do no profiling.
13. Children
You must be at least 13 years old to use the portal, or older if the law where you live sets a higher minimum for a service like this. You must also meet Discord's own age requirements, since you sign in through Discord.
Article 8 GDPR sets a higher age (16 in Slovakia) for services that rely on a child's consent. Nothing here relies on consent, so that threshold isn't the one that applies; 13 is our minimum. If you believe we hold data about someone too young to use the portal, email [email protected] and we will remove it.
14. How we protect your data
- All traffic is served over HTTPS through Cloudflare.
- Every action checks your roles with our Discord bot again. Roles are never taken from your browser.
- Applications are shown only to the people whose role allows it, as section 5 describes.
- We never handle passwords. Sign-in is done entirely by Clerk and Discord.
- The portal only adds to an application's history. It never edits or deletes an entry, except when the whole application goes with a deleted opening.
No system is perfectly secure. If a personal data breach is likely to put your rights at high risk, we will tell you and the supervisory authority, as Articles 33 and 34 GDPR require.
15. Changes to this policy
If we change what we collect or why, we update this page and the date at the top. The new version takes effect immediately when we publish it. There is no notice period, and the version on this page under that date is the one in force. For a significant change, we will say so on the portal or on our Discord server, but that announcement is not a condition of the change taking effect.
A change applies to processing from publication onwards, not to what we already did. Where something would need your consent, we will ask for it before we start. A change never shortens the rights data protection law gives you.
16. Contact
[email protected], or discord.gg/lyrc. The Terms of Service cover how the portal works and what is expected of you.