RemoteHub for Songhub Privacy Policy

Last updated: October 19, 2026

This policy explains how Bana Computing ("we", "us") handles information in the RemoteHub for Songhub Android app (com.banacomputing.songhublink), the songhub.link web remote, and related relay services (together, the "Service"). Bana Computing is based in the Philippines. Contact: banacomputing@gmail.com.

Summary

• Basic remote control (join a room, search, queue, play) works without an account. Optional Google sign-in unlocks My Songs and playlists, which are stored in Google Firebase (Cloud Firestore).
• We don't sell your data or use advertising or crash‑reporting SDKs.
• Playlist share links (/p/<code>) expose a snapshot of that playlist to anyone who has the link.
• Relay connection data is short‑lived. Cloud My Songs and playlists stay until you delete them or ask us to.
• Lyrics and playback timing for synced lyrics come from the SongHub device you are connected to, pass through the relay in real time and are never stored by us.

What the Service includes

• RemoteHub for Songhub — the Android / Android TV app that connects to SongHub on your local network and opens a room on our relay.
• songhub.link — the web remote (Cloudflare Worker) guests use to search, queue and control playback, and (optionally) sign in for My Songs and playlists.
• Showcase site — product pages at banacomputing.com/remotehub, including this Privacy Policy and the Terms.

Optional Google account (My Songs and playlists)

Sign‑in is optional and is used only for My Songs and playlists on songhub.link. Joining a karaoke room and controlling playback do not require Google sign‑in.

• Authentication is provided by Google Firebase Authentication (Google sign‑in). Google's own terms and privacy policy also apply to that sign‑in flow.
• From your Google account we use identifiers needed to keep you signed in (such as your Firebase user id) and, for display in the remote UI, your name, email and profile photo if Google provides them. We do not receive your Google password.
• Favorites and playlists are stored in a named Cloud Firestore database (remotehub) in Google Firebase / Google Cloud, typically under paths such as users/{your-id}/mySongs and users/{your-id}/playlists.
• Each saved song entry may include song code, title, artist and when it was added. Playlists may include a name, color, song list and an optional share code.
• My Songs and playlists live in the cloud under your Google account for this Service. They are not kept as a local song library on the RemoteHub Android device for that feature.

Playlist share links

If you share a playlist, we create a snapshot copy (not a live view of your private playlist) under a short code, for example https://songhub.link/p/<code>, stored in Firestore (for example under shares/{code}).

• Anyone who has the link or code can read that snapshot, including people who are not signed in. Treat the link like a public URL.
• The snapshot may include the playlist name, songs (codes, titles, artists), and a short owner display name derived from your Google profile name.
• You can stop sharing in the app, which removes the public snapshot so the old link stops working. Deleting the playlist also removes its share snapshot when possible.
• Do not put private or sensitive information in playlist names or expect share links to stay secret.

Data stored on your Android device (RemoteHub)

The app keeps a randomly generated host secret and key, each player's room number and access code, the last local IP addresses of your SongHub players, and your app settings (such as theme, startup and picture‑in‑picture options) in its private storage. This stays on the device, is excluded from backups where we configure that, and is removed when you uninstall the app. Uninstalling RemoteHub does not by itself delete My Songs or playlists stored in Firebase under your Google account.

Data processed by our relay server (songhub.link)

• A one‑way hash of your access code, never the code itself.
• Room reservations, kept for up to 7 days.
• Short‑lived join tokens (about 5 to 30 minutes) and web remote sessions (up to about 12 hours).
• IP addresses, used for rate limiting and abuse lockouts, deleted automatically when they expire.
• If you enter an optional name, it is kept with the songs you queue to show "added by" labels, only until those songs leave the room's queue or the room is reset.
• Song lists, queue updates, playback commands and Show QR on your device requests pass through in real time for the active session and are not kept as a long‑term library on the relay.
• Now‑playing song details, lyrics and playback timing (clock and countdown) from your SongHub device are forwarded unchanged in real time and are not stored on the relay.

Picture‑in‑picture and Show QR on your device

RemoteHub can show this device's 7‑digit access code and QR in its own picture‑in‑picture window on the device screen. The picture‑in‑picture window is optional and off by default; you can turn it on with the "Picture‑in‑picture on Home" setting in Settings so it appears when you press Home. A guest connected to your room can tap "Show QR on your device" on songhub.link to ask the app to show it, and the app replies only whether the QR was shown. That request and reply carry no personal information.

Synced lyrics (songhub.link)

Synced lyrics are off by default; you can turn them on in Advanced on songhub.link. The lyrics and their playback timing come from the SongHub device you are connected to, through the RemoteHub app, pass through the relay unchanged, and are only displayed for the song that is playing. We do not save lyrics on our servers or in your browser. Only your on/off choice and lyrics timing adjustment are kept in your browser's local storage.

Data stored in your browser

songhub.link may store a session token, a cached song list (up to about 24 hours), display preferences (such as theme and whether synced lyrics are on), your optional guest name, your terms acceptance, and similar remote settings in your browser's local or session storage. You can clear them from your browser settings. Clearing the browser does not delete Firebase My Songs or playlists.

Cookies, analytics and telemetry

• We do not use advertising SDKs, and we do not sell personal information.
• We do not currently ship third‑party advertising or crash‑reporting SDKs in the web remote. Sign‑in loads Google / Firebase scripts only when you use My Songs or playlists.
• banacomputing.com (including the RemoteHub showcase and these legal pages) uses Vercel Analytics for basic, privacy‑oriented traffic measurement on that site. See Vercel's analytics privacy information.
• Cloudflare, which hosts songhub.link, may process standard request and security logs (for example IP address, user agent, and URLs) as part of delivering the relay. If Cloudflare Web Analytics or similar cookieless measurement is enabled, it is used for basic traffic counts, not for advertising profiles.
• The RemoteHub Android app does not include advertising or third‑party crash‑reporting SDKs.

Service providers (third parties)

• Cloudflare hosts the songhub.link relay and related edge infrastructure. See Cloudflare's privacy policy.
• Google Firebase / Google Cloud provide Authentication and Firestore for optional My Songs, playlists and share snapshots. See Firebase privacy and security and Google's privacy policy.
• Google Play distributes the Android app; Google's policies apply to Play Store installation and updates.
• Vercel hosts banacomputing.com and provides Analytics for that site. See Vercel's privacy policy.

These providers process data on our behalf or as independent services you interact with (for example Google sign‑in). Some processing may occur on servers outside the Philippines.

Android permissions

• Internet, network and Wi‑Fi state, and multicast: to find SongHub on your local network and connect it to the relay.
• Foreground service (connected device), notifications and wake lock: to keep the connection alive while it runs. You can turn it off with Start / Stop RemoteHub in Settings.
• Start at boot: to reconnect automatically when the device turns on.
• Ignore battery optimizations (optional): only if you choose it, so the connection is not paused in the background.
• Display over other apps (optional; to allow it, open Settings → Other devices → Allow “Show QR on your device” from other devices, which opens Android’s Display over other apps setting): used only so RemoteHub can bring its own picture‑in‑picture window to the front when a guest taps "Show QR on your device" while the app is in the background. RemoteHub never draws over other apps, and this permission does not collect or send any data.

Donations

The donate option only displays a GCash QR code. Any payment happens inside GCash, and we receive no payment details through the app.

Security

Connections use encrypted HTTPS. Access codes for rooms are stored on the relay only as hashes, and regenerating the code ends connected web remote sessions. Firestore security rules are meant to keep each signed‑in user's My Songs and playlists private to that account, except for share snapshots you choose to publish. No method of transmission or storage is perfectly secure.

Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, email banacomputing@gmail.com and we will take reasonable steps to delete it.

Your choices, sign‑out and deleting data

• Delete account (Library): when signed in on songhub.link, you can delete your Service account from the Library. That deletes your associated cloud data for this Service — My Songs, playlists and playlist share snapshots — and signs you out. Share links you created stop working once their snapshots are removed. This does not delete your Google account itself; it only removes this Service's Firebase sign‑in and stored library data. You can sign in again later with Google, which starts a new empty library.
• Sign out ends the signed‑in session in that browser without deleting My Songs, playlists or share snapshots.
• Partial edits: you can remove individual songs from My Songs, edit or delete playlists, and stop sharing a playlist without deleting the whole account.
• Uninstalling RemoteHub removes app data on that device. It does not delete Firebase cloud data; use Delete account in the Library (or email us) for that.
• Help by email: if Delete account is unavailable or something remains after you use it, email banacomputing@gmail.com from the Google account you used to sign in (or include enough detail for us to identify it). We will delete or anonymize remaining Service cloud data within a reasonable time, except where we must keep limited records for security, abuse prevention or legal reasons. Relay logs and rate‑limit data expire on the schedules above.
• You can also revoke the app's access in your Google Account permissions, then use Delete account or email us if cloud library data should still be removed.

International processing

We are based in the Philippines. Cloudflare and Google may process and store data in other countries. By using the Service you understand that your information may be transferred to and processed in those locations under their safeguards and applicable law.

Changes

We may update this policy when the Service or our practices change. We will revise the "Last updated" date above. Continued use after an update means you accept the revised policy, to the extent allowed by law.

Contact

Bana Computing (Philippines)
Email: banacomputing@gmail.com