Privacy Policy

Last updated: August 2026. This policy explains how csong.in (Csong Bot) handles information when you visit the site, sign in with Google, generate upload tokens, or use the live statistics panel. We aim to collect only what is necessary to run a secure, accountable token system for WhatsApp Channel song uploads.

Data we process

• Google account profile — display name, email address, and unique user ID (uid) provided by Firebase Authentication when you choose to sign in. We do not receive or store your Google password.
• Token records — channel invite link, song string, uid, email, display name, creation timestamp, day key, and used/unused status stored in Firestore. These fields exist so the bot can verify a command once and reject replays.
• Aggregate counters — total token count and a list of distinct uids used only for the public statistics strip and modal. Individual private emails are not shown on the public stats panel.
• Daily count documents — small per-day counters used to build the seven-day and fourteen-day activity charts without scanning the full tokens collection on every load.
• Preferences — theme (dark/light) and cookie consent flags stored in your browser’s local storage only. These never leave your device.

What we do not collect

We do not store your Google password. We do not upload, transcode, or permanently host the audio files themselves on the marketing website; the bot that performs the actual upload runs separately (public group or your self-hosted instance). We do not sell personal data. We do not build advertising profiles from your token history. Self-hosted bot sessions, if you use the Connect Your Own Bot path, are managed under that separate hosting flow and its own documentation; the website only issues the tokens.

Purpose of processing

Authentication prevents anonymous abuse of the public group and of the token system. Token metadata lets the bot reject replay attacks and keeps a short audit trail for operators. Aggregate statistics (counts of tokens and distinct users) may be shown in the live statistics panel without listing private emails publicly. Day-level counters support the activity charts so the site can stay informative without expensive full-collection scans.

Cookies, local storage, and third parties

Essential local storage remembers your theme preference and cookie consent choice. Google Firebase Authentication and Firestore process sign-in and token writes under Google’s terms and security model. Optional AdSense scripts, when active, may set their own cookies under Google’s advertising policies. You can block non-essential cookies in the browser; note that fully disabling storage may prevent sign-in and token generation from working correctly.

Retention and security

Token documents remain for as long as needed for abuse prevention, support, and aggregate statistics. Access is restricted by Firebase security rules so that only authenticated flows and authorised bot processes can read or update the relevant documents. No security method is perfect; protect your Google account with two-factor authentication and treat any shared session or self-hosted bot credentials as sensitive. If we become aware of a security incident that affects personal data, we will take reasonable steps to contain it and, where required, notify affected users.

Your choices and rights

You may stop using the service at any time by signing out and not generating new tokens. You may request deletion of token rows tied to your uid by contacting us with the signed-in email address used for those tokens. We will evaluate legal requests under applicable law. Theme and consent preferences can be cleared by clearing site data in your browser.

Children

Csong Bot is intended for channel admins and operators who are old enough to manage a WhatsApp Channel under WhatsApp’s own terms. We do not knowingly collect data from children under the age required by applicable law for such services.

Changes to this policy

We may update this page when the product or legal requirements change. The “Last updated” date at the top will reflect the latest revision. Continued use after a material change constitutes acceptance of the updated policy where permitted by law.

Contact

Privacy questions: WhatsApp +91 98329 62298 or the Contact page. Please use the same email you signed in with when requesting deletion of token records so we can match the correct uid.