隱私權政策
沿用 App 與 Google Play 所提供的完整雙語政策。
LyricGlass Privacy Policy
Effective 21 October 2026. This policy covers LyricGlass for Android, including the current preparation build. A public policy does not mean the app has launched on Google Play.
The current closed-test candidate omits Apple Music sign-in and account-bound Apple lyrics. It does not open Apple's sign-in web components or use a Music User Token. The optional-connection section below applies only to older or explicitly opted-in private builds, not this closed-test candidate.
Developer: Ronnie Wong. App: LyricGlass (cc.ronnie.lyricglass).
Support and privacy contact: llqoli@gmail.com.
Website: https://ronniewong.cc/.
Microphone and front camera
While recognition runs, LyricGlass continuously uses the microphone to identify surrounding music. Raw audio is processed in memory by ShazamKit and the local sound model. It is not saved as a recording or sent to our server. ShazamKit sends acoustic signatures to Apple's matching service. Apple states that these signatures cannot be converted back into the original recording and that raw audio is not shared with Apple. Recognition needs an internet connection. ShazamKit information
The front camera supplies face-position and confidence metadata to animate the character locally. Normal operation does not read image pixels, save or transmit camera images, identify people, create face embeddings or infer a person's emotions. An explicitly enabled development HUD can show the latest image transiently in memory without saving it. Camera attention can continue with the screen off and attempt to wake the screen when someone approaches.
Android displays foreground-service notifications. Stop stops microphone recognition; the independent camera service continues. Revoke camera or microphone permission in Android app settings to disable the dependent feature. Android Force stop stops both services. Screen wake requires the relevant Android grants and does not bypass a secure lock screen.
Music and lyric requests
Recognized song identifiers, ISRC, title, artist, optional album and duration are used to request catalog information and lyrics. Recipients, according to enabled sources, are Apple, the Cloudflare-hosted LyricGlass Worker, Musixmatch, Netease and LRCLIB. Musixmatch requests pass through the Worker; Netease and LRCLIB requests go directly from the phone. Network services receive connection information including source IP addresses. These transfers provide recognition, catalog lookup, lyrics and service security; they are not audio uploads.
The app uses an encrypted device access credential. The Worker verifies its hash and stores a per-credential rate-limit bucket and count. This state is overwritten by subsequent rate-limit activity; there is no scheduled expiry of an inactive bucket. The current version does not create a LyricGlass user account. Existing private devices retain their provisioned key. The preparation build also contains the Play activation process described below. It is enabled for the owner-authorized internal installation test. External testing and public release remain pending acceptance and source-rights work.
Cloudflare processes server requests for us. Its operational records can include request paths, status, timing and connection metadata. Query strings are redacted from newly recorded Worker request URLs. Previously recorded query strings may remain until the platform's retention period expires. Workers Logs has a maximum seven-day retention, depending on the account plan; we do not export these logs to another logging destination. Our Worker does not keep a separate database of song queries or receive microphone recordings, camera images or Apple Music User Tokens. Cloudflare's own security and network records are governed by its privacy policy. Cloudflare privacy policy, Workers Logs retention
Google Play activation
Without a private device key, the app first checks activation availability with the LyricGlass Worker. If unavailable, Start shows a visible failure. Existing private installations keep their saved private credentials. Enrollment is currently enabled for the owner's one-account internal acceptance test.
The current LVL candidate checks its installed signing certificate locally in Android. It asks Google Play Licensing for purchase or installation entitlement. Google Play processes its account, application, device and connection information for this query. Google returns a signed license block containing the result, package name, app version, a challenge number, timestamp and an app-specific user identifier. The app sends this block, its signature and a random installation value to our Worker over HTTPS. The Worker verifies Google's signature, package, version, challenge and freshness before granting access. The reply does not provide us your Google email, password or payment-card details.
The signed license block and its user identifier exist only in memory in the app and Worker; they are not stored or logged. The phone keeps the random installation value and hourly access credential under Android Keystore encryption. The Worker binds its credential to the installation hash and keeps only the existing rate-limit bucket/count, without an account or purchase database. A new Google-signed license is requested for renewal. Clear storage or uninstall removes local values; it does not delete records held by Google or Cloudflare. Google's own retention follows its privacy policy.
This candidate does not call Play Integrity or request device attestation. Earlier internal version 18105 used Integrity, including app/licensing/device signals; its failed activation test did not create an account or store the proof. Replacing that flow does not delete Google's existing records. Google Play licensing overview, server-side license verification, Google privacy policy
Apple Music connection in private builds
This feature is not included in the current closed-test build. Existing private Apple connection data and caches are preserved, but the closed-test build does not decrypt or use them. The following describes only private builds that explicitly include Apple Music sign-in.
You may connect an existing Apple Music account through Apple's authorization page in a restricted WebView, or leave this source disconnected. The app stores the returned Music User Token encrypted with Android Keystore protection and sends it only to Apple for authorized requests. Our Worker does not receive this token or your Apple password. LyricGlass does not read your music library, playback history, contacts or payment-card details.
Apple's web components can collect browser/device identifiers, domain and interaction information, and approximate geographic information inferred from the IP address. LyricGlass does not request Android location permission or obtain GPS coordinates. Apple's web-player disclosure describes daily-reset identifiers and retention of web activity for up to two years; signed-in data follows Apple's Apple Music policy, including its legal retention obligations. Our use of MusicKit does not play music or provide personalized recommendations. Apple Music web privacy, Apple Music privacy
On-device models and Google SDK metrics
Sound classification and lyric-affect inference run locally. Lyric affect describes already resolved text, never a nearby person's feelings. ML Kit can identify a lyric's language and translate text locally before classification; it does not send those text inputs or translation results to Google.
ML Kit sends Google device/app information, per-installation identifiers, latency, API configuration, input/output sizes, feature versions, initialization and other API-use events, and error codes. Language ID reports identified languages; translation reports configured source/destination languages and uses Firebase Remote Config and Firebase Installations. Google uses these metrics for diagnostics, usage analysis, maintaining and improving its APIs, and detecting misuse. The SDK also contacts Google for models and updates. These SDK metrics are automatic; not using lyric classification is not a verified way to opt out. They are additional to local processing.
SDK metrics use HTTPS. Google states that ML Kit does not forward the listed metrics to other third parties. This does not mean the data stays on your phone: Google receives it. LyricGlass adds no separate analytics, advertising SDK or advertising tracking. Google's privacy policy governs its metric retention; we do not promise a fixed retention period or an app control to erase data Google has already received. ML Kit data disclosure, ML Kit privacy, Google privacy policy
Local storage, security and deletion
The app stores preferences, encrypted credentials and source-labelled lyric caches with song metadata. The lyric cache has no programmed expiry. Local content-free incident journals retain up to seven days within 32 MiB; a separate process-exit archive retains up to 30 days, 1 MiB and 256 entries. These local diagnostics exclude recordings, images, face coordinates, titles, lyrics and credentials. There is no app flow that uploads them.
All app and SDK off-device transfers use encrypted connections. Our service providers and lyric sources may process requests outside your country. Local data are protected by Android app storage; access tokens additionally use Keystore-backed encryption.
Android Clear storage or uninstall removes local app data. In private builds with Apple Music sign-in enabled, Settings → Disconnect removes the stored Apple Music token; Clear Apple cache removes that source's cache. Disconnect does not promise to erase WebView cookies or provider-side data. Revoke Apple's authorization through your Apple account where applicable. Clearing local storage does not delete Google's SDK metrics or other provider records. LyricGlass currently has no mechanism to request deletion of all collected provider-side data and does not promise automatic deletion of all such data within 90 days. Contact llqoli@gmail.com for privacy questions or requests concerning data under our control; third-party-held records may require the provider's own privacy process.
Audience and changes
LyricGlass is intended for teens aged 13 and above and adults. It is not designed for children under 13, and external lyric catalogs are not child-filtered. Content ratings may differ by country. This page will be updated when the app's data practices change, with a revised effective date.
LyricGlass 隱私權政策
生效日期：2026 年 10 月 21 日。適用於 Android 版 LyricGlass，包含目前的準備 版本；政策可公開閱讀不代表 App 已於 Google Play 推出。
目前封閉測試候選不包含 Apple Music 登入及依賴帳戶的 Apple 歌詞功能，不會 開啟 Apple 登入網頁元件或使用 Music User Token。下方 Apple 連接章節僅適用 於舊有或明確啟用此功能的私人版本，不適用於本次封閉測試候選。
開發者：Ronnie Wong。App：LyricGlass（cc.ronnie.lyricglass）。
支援與隱私聯絡：llqoli@gmail.com。網站：https://ronniewong.cc/。
麥克風與前置相機
辨識執行期間，LyricGlass 持續使用麥克風辨識周圍音樂。原始音訊僅在記憶體 中供 ShazamKit 及本機聲音模型處理，不保存為錄音，也不傳至我們的伺服器。 ShazamKit 會將聲音特徵簽章傳至 Apple 比對；Apple 說明這些簽章無法還原 原始錄音，原始音訊不會分享給 Apple。辨識需要網路連線。 ShazamKit 說明
前置相機提供臉部位置與信心值，在本機調整角色。一般模式不讀取影像像素， 不保存或傳送相機影像，不辨識身分、建立臉部特徵向量或推斷人的情緒。 明確開啟的開發診斷畫面可在記憶體暫時顯示最新影像，不儲存影像。相機 注意功能可在螢幕關閉時繼續運作，並於有人靠近時嘗試喚醒畫面。
Android 會顯示前景服務通知。Stop 停止麥克風辨識，相機服務獨立繼續運作。 從 Android App 設定撤回相機或麥克風權限，可停用依賴該權限的功能；強制 停止 App 可停止兩個服務。畫面喚醒須取得 Android 相應授權，不繞過安全鎖屏。
音樂與歌詞請求
辨識出的歌曲 ID、ISRC、曲名、演出者、選用的專輯與時長，用於查詢音樂 資料及歌詞。依啟用的來源，接收者包括 Apple、Cloudflare 代管的 LyricGlass Worker、Musixmatch、Netease 及 LRCLIB。Musixmatch 經 Worker 請求；Netease 與 LRCLIB 由手機直接請求。服務也會取得來源 IP 等連線資訊。用途是辨識、 音樂資料／歌詞查詢與服務安全，不是上傳錄音。
App 保存加密的裝置存取憑證。Worker 驗證其雜湊，並保存以憑證區分的限流 時段及計數；後續限流操作會覆寫狀態，未使用的狀態沒有排程到期時間。 目前不建立 LyricGlass 使用者帳戶，既有私人裝置保留佈建金鑰。準備版本也 包含下述 Play 啟用流程；目前已為擁有者授權的內部安裝測試開啟。外部測試 及公開發佈仍等待實際驗收及歌詞來源授權。
Cloudflare 代我們處理伺服器請求。運作紀錄可能包含路徑、狀態、時間及連線 資訊。新記錄的 Worker 請求網址會遮蔽查詢字串；先前紀錄中的查詢字串可能 保留至平台保存期限屆滿。Workers Logs 依帳戶方案最多保留七天，我們沒有 將這些紀錄匯出至其他日誌目的地。Worker 不建立另外的歌曲查詢資料庫， 不接收原始錄音、相機影像或 Apple Music User Token。Cloudflare 自己的網路 及安全紀錄依其隱私政策處理。 Cloudflare 隱私政策、 Workers Logs 保留說明
Google Play 啟用
沒有私人裝置金鑰時，App 先向 LyricGlass Worker 查詢啟用是否可用；不可用時 Start 顯示明確錯誤。既有私人安裝繼續使用原憑證。目前入口開啟供擁有者 單帳號內部安裝驗收。
目前的 LVL 候選先在 Android 本機核對已安裝 App 的簽章，再向 Google Play Licensing 查詢購買／安裝授權。Google Play 為此處理其帳戶、App、裝置及連線 資訊，回傳經 Google 簽名的授權資料，包含結果、套件名稱、版本、挑戰值、 時間及應用程式專用的使用者識別碼。App 將這份資料、簽名及隨機安裝值透過 HTTPS 送至 Worker；Worker 核驗 Google 簽名、套件、版本、挑戰值及有效時間 後才提供存取。回覆不向我們提供 Google Email、密碼或信用卡資料。
簽名授權資料及其中的使用者識別碼只在 App／Worker 記憶體處理，不保存或 記錄。手機以 Android Keystore 加密保存隨機安裝值與一小時存取憑證；Worker 將憑證綁定安裝值的雜湊，只保留既有限流時段／計數，不建立帳戶或購買 資料庫。續期時重新索取 Google 簽名授權。Android 清除資料或解除安裝會移除 本機資料，不會刪除 Google／Cloudflare 持有的紀錄；Google 依自身政策保存。
此候選不呼叫 Play Integrity 或索取裝置認證。較早的內部版本 18105 曾使用 Integrity 的 App、授權及裝置結果；其失敗啟用測試沒有建立帳戶或儲存證明。 更換機制不會刪除 Google 的既有紀錄。 Google Play 授權說明、 伺服器授權驗證、 Google 隱私權政策
私人版本的 Apple Music 連接
目前封閉測試版不包含這項功能。既有私人 Apple 連接資料與快取會保留，但 封閉測試版不解密或使用它們。以下僅說明明確包含 Apple Music 登入的私人版本。
你可在受限 WebView 中透過 Apple 授權頁連接既有的 Apple Music 帳戶，也可 不連接此來源。App 將取得的 Music User Token 以 Android Keystore 保護的 加密儲存保存，只在向 Apple 的授權請求中傳送。Worker 不接收這個 Token 或 Apple 密碼。LyricGlass 不讀取你的音樂資料庫、播放歷史、聯絡人或信用卡。
Apple 網頁元件可能取得瀏覽器／裝置識別碼、所在網域、互動資訊，以及由 IP 推算的大概地區。LyricGlass 不要求 Android 定位權限，也不取得 GPS 座標。 Apple 網頁播放器政策說明每日重設的識別碼，以及最長兩年的網頁活動保存； 登入後資料依 Apple Music 政策及法定保留要求處理。LyricGlass 使用 MusicKit 並不播放音樂或提供個人化推薦。 Apple Music 網頁隱私、 Apple Music 隱私
本機模型與 Google SDK 指標
環境聲音及歌詞情感分類在裝置上執行。歌詞分類只描述已取得的文字，不代表 附近人的情緒。ML Kit 可先在本機辨識語言、翻譯歌詞，再交給本機分類模型； 不將輸入的歌詞文字或翻譯結果傳至 Google。
ML Kit 會向 Google 傳送裝置／App 資訊、每次安裝的識別碼、延遲、API 設定、 輸入／輸出大小、功能版本、初始化及其他 API 使用事件與錯誤碼。語言辨識 回報辨識出的語言；翻譯回報設定的來源與目標語言，並使用 Firebase Remote Config 與 Firebase Installations。Google 將指標用於診斷、使用分析、維護及 改善 API、防止濫用；SDK 也會連線取得模型與更新。這些指標自動傳送，僅 不使用歌詞分類不是經驗證的退出方法；本機運算仍可能伴隨 SDK 網路資料。
SDK 指標以 HTTPS 傳送。Google 表示 ML Kit 不會將列出的指標再轉交其他 第三方；這不代表資料留在手機，Google 仍會接收到資料。LyricGlass 不另加 自建分析、廣告 SDK 或廣告追蹤。Google SDK 指標的保存依 Google 隱私政策； 我們不承諾固定保存天數，也沒有能刪除 Google 已收到指標的 App 控制。 ML Kit 資料揭露、 ML Kit 隱私說明、 Google 隱私政策
本機保存、安全與刪除
App 保存偏好設定、加密憑證，以及含歌曲中繼資料的來源標記歌詞快取。 歌詞快取沒有程式明定的到期時間。本機內容排除型事件診斷最多保留七天、 32 MiB；另外的程序退出摘要最多三十天、1 MiB、256 筆。這些本機診斷不含 錄音、影像、臉部座標、曲名、歌詞或憑證，也沒有主動上傳流程。
App 與 SDK 的離機傳輸均使用加密連線；服務供應商與歌詞來源可能在其他 國家處理請求。本機資料受 Android App 儲存空間保護，存取 Token 另使用 Keystore 保護的加密。
Android 清除儲存空間或解除安裝會移除本機 App 資料。 在啟用 Apple Music 登入的私人版本中，Settings 的 Disconnect 移除保存的 Apple Music Token；Clear Apple cache 清除該來源快取。 Disconnect 不承諾刪除 WebView Cookie 或供應商端資料；需要時可在 Apple 帳戶撤銷授權。本機清除不會刪除 Google SDK 指標或其他供應商紀錄。 LyricGlass 目前沒有能要求刪除全部已收集供應商資料的機制，也不承諾全部 離機資料在九十天內自動刪除。對我們控制的資料或隱私事項，可聯絡 llqoli@gmail.com；第三方持有的紀錄可能需要使用其自身的隱私處理流程。
族群與變更
LyricGlass 供十三歲以上青少年及成人使用，不是專為十三歲以下兒童設計。 外部歌詞目錄沒有兒童內容過濾，各地內容分級可能不同。資料處理方式變更 時，我們會更新本頁及生效日期。
關於這個網站
本網站沒有使用者帳戶、訪客分析或追蹤 Cookie，不會要求麥克風或相機權限。情境示範只在你的瀏覽器內運作。網站託管服務可能處理 IP 位址與一般連線紀錄。
Google Group 測試申請
測試申請在 Google Groups 的外部頁面完成，本站不接收或儲存填寫內容。Google 會處理你使用的 Google 帳號、顯示名稱、Email，以及自願提供的申請理由或裝置資訊。LyricGlass 的群組管理者用於審核申請、確認相容性、安排測試與聯絡。
群組採申請後核准；成員名單與成員 Email 限版主查看，不向一般成員公開。請勿在申請中提供密碼、存取憑證、原始錄音、相機／臉部資料或歌詞。申請不代表 Google Play 測試資格、已購買 App 或已取得免費兌換權益。
你可退出群組，或聯絡 llqoli@gmail.com 撤回申請、處理我們控制的申請資料。Google 持有的資料依其服務與隱私權政策處理，不承諾固定刪除期限。申請資料不會因為退出群組就自動從 Google 的全部系統移除。