Product privacy
Your story is not content inventory.
This page explains what the current product does with song choices and relationship stories. It also names the decisions that still need an owner-approved legal policy before production accepts personal stories.
Most visitors can use WeddingMelody without telling us who they are. Search and filter choices stay in the page address after the hash sign. Saved song IDs stay in the browser's local storage.
A personalized song brief is different. In the default public configuration, generation is disabled, so typed story fields are not submitted. If generation is enabled later, the interface must state that clearly before the visitor sends the brief.
Using the free finder
What stays in the browser, and what leaves it.
Filters and saved songs
Finder state uses a URL fragment, which is not part of the request sent to WeddingMelody's server. A shortlist saves catalog song IDs in local storage so it can survive a refresh on that device.
Shared shortlist links
An optional shortlist name and its song IDs also sit in the fragment. WeddingMelody does not receive them when the page opens, but anyone who receives the full link can read the list in their browser.
Spotify previews
No Spotify iframe is requested until a visitor chooses Preview on Spotify. The player then loads from Spotify, which receives the connection request and may use cookies or similar technologies under its privacy policy and cookie policy.
If generation is enabled
The story crosses a different boundary.
Live generation and payment remain off by default. These are the controls already built for preview and future production use.
- Submission
- The brief is sent only when the visitor chooses the generation action. Names, meeting story, memory, preferences, and avoid instructions are validated on the server.
- Storage
- Names, story details, generated titles and lyrics, and revision instructions are encrypted before database persistence. Sound preferences and operational job fields remain separate.
- Provider
- The approved music provider would receive the details needed to create or revise the song. No live provider will be enabled until its processing, retention, rights, and customer-delivery terms are approved.
- Audio
- Completed audio is copied into private WeddingMelody-controlled object storage. Playback and downloads use short-lived signed delivery links instead of exposing the storage object.
Controls and limits
What a visitor can control today.
Can I remove a private song?
The browser that owns a generated song receives a deletion control. It removes the brief, job, generated title and lyrics, revisions, and stored audio. Storage cleanup failures are treated as an operations issue that still needs removal.
How private is an unlisted song link?
It is excluded from search engines and is not listed publicly, but it is still a bearer link. Anyone with the URL can view the private page, so it should be shared only with intended recipients.
Does WeddingMelody use an ownership cookie?
Only the generation flow creates an anonymous, HTTP-only ownership cookie. It lets the same browser resume and delete its song. The current cookie is set for 30 days; that is not yet a promise about database retention.
What about analytics?
GA4 is not mounted by this repository. When the owner adds it, URL fragments must be stripped because they can contain shortlist names and song IDs. Names, story text, lyrics, pronunciation notes, and form contents must never be sent to analytics providers.
How can I ask about my data?
Email elizabeth@weddingmelody.com. Elizabeth is WeddingMelody's support voice; the About page explains that role.