Legal
Privacy Policy
Effective: July 13, 2026
Belter ("we", "us") is a web app that displays real-time synchronized lyrics for music you play through your streaming account, designed for the Tesla in-car browser. This policy explains what we collect, why, and what we never touch — in plain language, because you're probably reading this in a parking lot. Contact us any time at hello@belter.fun.
What we collect
Waitlist
If you join the waitlist, we store the email address you give us, which pricing plan you expressed interest in (if you clicked a specific plan), and where on the page you signed up. That's it. We use Cloudflare Turnstile on the form to keep bots out; Turnstile evaluates your browser environment but does not track you across sites.
Account data (when you use the app)
- An opaque session cookie (
__Host-belter_sid) — secure, HttpOnly, and containing no personal information; it points to a session record on our server. - Spotify OAuth tokens that let Belter see and control your playback. They are stored in our database and we never see or store your Spotify password. The Spotify permissions we request are: read your currently-playing track, read your playback state, and control playback (play, pause, skip, seek — used only when you tap those controls on the Belter screen).
- Song-play counts — how many songs you've viewed lyrics for today and this week, used to enforce the free tier's limits. Counts, not listening history.
- Operational error reports — when something breaks, an error report (message, stack trace, request metadata) may be sent to our error-tracking service so we can fix it.
What we do NOT collect
- Your location. Belter never requests geolocation.
- Anything from your Tesla account — no telematics, no driving data, no vehicle identity. Belter runs in the car's browser like any website and does not connect to Tesla systems.
- Microphone, camera, or any device sensors. Belter does not listen to you sing.
- Advertising identifiers or cross-site tracking. There are no ad networks here.
How we use your data
- To detect your currently playing song, fetch its lyrics, and display them in sync.
- To keep you logged in and refresh your Spotify tokens when they expire.
- To enforce free-tier limits and, for subscribers, to lift them.
- To email you about early access (that's why the waitlist exists).
- To keep the service running — aggregated logs, error rates, and abuse prevention.
We do not sell, rent, or trade your personal data, and we don't profile you for advertising.
Who touches your data (subprocessors)
| Service | Purpose | What they see |
|---|---|---|
| Cloudflare | Hosting, database, caching, bot protection | App data, encrypted at rest |
| Resend | Transactional email (waitlist, launch invites) | Your email address |
| Spotify | OAuth login + playback API | The permissions you grant; governed by Spotify's own privacy policy |
| Lyrics sources (LRCLIB and fallbacks) | Timed lyric text | Song title and artist only — never your identity |
| Sentry | Error tracking | Error reports and request metadata |
When paid subscriptions launch, payments will be processed by Stripe. Stripe will see your billing details; we will only ever see your subscription status — never your card number.
Lyrics and copyright
Lyrics displayed by Belter are retrieved from third-party sources. Belter does not create, host, or claim ownership of lyric text. If you believe a lyric displayed by Belter infringes your copyright, email hello@belter.fun with the information described in 17 U.S.C. § 512(c)(3) and we will respond promptly.
How long we keep things
- Sessions and tokens: until you log out or revoke Belter's access from your Spotify account settings; inactive sessions are pruned automatically.
- Song-play counters: rolling window; older entries are deleted.
- Waitlist email: until you unsubscribe or ask us to delete it.
- Error reports and logs: short retention, then deleted.
Your rights
Wherever you live, we honor the same set of rights: ask us what we hold about you, correct it, export it, or delete it — email hello@belter.fun and we'll respond within 30 days. You can revoke Belter's Spotify access at any time from Spotify's app settings; doing so immediately disables the core feature. EEA/UK residents have these rights under GDPR; California residents under CCPA, including the right not to be discriminated against for exercising them.
Children
Belter is not directed at children under 13 and we do not knowingly collect their data. If you believe we have, contact us and we will delete it.
Security
All traffic is served over TLS. Session cookies are HttpOnly, Secure, and __Host--prefixed. We never store music-service passwords. No system is
perfectly secure — if you find a vulnerability, please email hello@belter.fun.
Changes
If we make material changes to this policy, we'll email registered users and post the update here at least 14 days before it takes effect.