Privacy Policy

Last updated: August 11, 2026

Hymnal is a personal, non-commercial project run by an individual — not a company. It exists so people can find hymns and sing them together. It collects the minimum it needs to do that, and nothing it collects is ever sold or used for advertising.

What we collect

If you lead sessions (signed-in users)

Signing in uses your email address and nothing else — we send a sign-in link to it instead of storing a password. Your email is used to sign you in and for nothing more: no newsletters, no marketing, no sharing. The sessions you create — their name, join code, and the hymns queued and led in them — are stored in our database so the service works.

If you join a session (no account needed)

Attendees don’t create accounts and never give us an email. Your browser keeps a few values in its own local storage: a random device identifier, the nickname you choose (if any), which queue entries were yours, the last session you joined (this one stops being used after a few hours), and your lyrics text-size preference.

If you join by scanning a QR code, your browser asks for camera permission. The camera is used for one thing — reading the join code off the screen or handout in front of you — and the reading happens on your device. No image, video, or anything else from your camera is sent to us or to anyone else.

Some of that also reaches our database. When you add a hymn to a queue, the entry is saved with the nickname you chose and your device identifier attached. Your nickname is shown to everyone in the session — that’s its purpose — while the device identifier is never sent to other people’s browsers; it exists so you can remove your own request and so a leader can block a disruptive device. If a leader does block or allow a device, we store a one-way hash of that identifier for that session, not the identifier itself.

While you have a session open, your nickname is also broadcast live to the others in that session so the room can see who’s here. That live list isn’t stored — it disappears when you close the page.

Clearing your browser data clears the copy on your device, but it does not remove the queue entries already saved in the session. See How long we keep things.

Operational data

Like nearly every website, the infrastructure Hymnal runs on (web hosting, the database, and the provider that delivers sign-in emails) processes requests and keeps short-lived technical logs — things like IP addresses — for security and reliability. We also use your IP address in the moment to enforce rate limits, so nobody can flood a session with requests. Where a rate-limit counter is written to our database, it’s stored as a one-way hash — your IP address itself is never saved there — and kept for about an hour, swept out as later traffic passes through. We use these providers to run the service, not to profile you.

Cookies and third-party scripts

The only cookies Hymnal itself sets are the sign-in cookies that keep leaders signed in. There are no advertising cookies and no cross-site tracking. Your browser also talks directly to our database — that’s how a session stays in sync on every phone at once — and three third-party pieces run alongside it:

Vercel Web Analytics — our host’s built-in page counter, loaded on every page. Vercel states it identifies visitors without cookies. It records page views along with the coarse details Vercel attaches — referrer, country, device type. We send it no custom events and nothing about who you are.
Sentry error reporting — when something breaks, the error and its stack trace are sent to Sentry so it can be fixed. It is configured to send no IP addresses, no cookies, and no user identity; performance tracing and session recording are switched off entirely; and session join codes and sign-in links are stripped out of every error before it leaves your device.
Cloudflare Turnstile — a security check on the sign-in page only, so the sign-in email can’t be used to spam strangers. Cloudflare processes that check under its own privacy terms. It doesn’t run anywhere else on the site.

Browsing and searching hymns happens against our own catalog. Searching doesn’t send anything about you to Hymnary.org or anywhere else outside the service — only a link you deliberately tap takes you off-site.

How long we keep things

Plainly: we don’t currently delete old sessions automatically. When a session ends it stays in the database, along with its queue history — including the nicknames and device identifiers attached to those entries. Sessions are kept so a leader can look back at what was sung; there is no scheduled purge or anonymization job behind that, so assume this data is kept indefinitely until someone asks us to delete it.

Two exceptions, because they’re built to expire: rate-limit counters are kept for about an hour and swept out as later traffic passes through, and the live attendee list exists only while people have the session open.

What we never do

Sell or rent your personal data. To anyone. Ever.
Show ads or share data with advertisers.
Send marketing email.
Ask attendees for personal information to sing along.

Deleting your data

Leaders: email us and we’ll delete your account. Deleting it also deletes every session you own and everything inside them — the queue history, and the nicknames and device identifiers of the attendees who joined.

Attendees: clearing your browser data removes the values stored on your device. To have a nickname removed from a session’s saved queue, ask that session’s leader to remove the entry, or email us with the join code and the nickname and we’ll do it. We handle these by hand — there’s no self-service delete button — so allow us a few days.

Children

Hymnal is a general-audience service and doesn’t knowingly collect personal information from children. Attendees never provide personal details beyond an optional nickname.

Changes

If this policy changes, the new version will be posted here with an updated date.

Contact

Questions or requests: gethymnalapp@gmail.com.