Import policy: what you can bring in and how

What the importer actually does

When you paste a supported link, the server makes an HTTPS request to the public page, downloads it within size and time limits and hands it to the editor to parse as text. Redirects are revalidated against the allowed host list, and credentials, non-standard ports and non-HTTPS schemes are rejected.

The downloaded content is never executed, never mounted as a page and never stored: it is used to extract the lyrics and chords the editor shows you. There is no cache of third-party songs and no public index.

Supported hosts

The list is deliberately short: Cifra Club (including its Brazilian domain), LaCuerda and Ultimate Guitar. If your song lives somewhere else, paste the text or import a file; the editor does not send requests to arbitrary domains.

The list is reviewed as the chord-site landscape changes. If a supported site alters its markup, the parser may stop understanding it until it is updated; pasting the text remains the most stable route in the meantime.

Content you may import

Chordleaf publishes nothing of what you import. Every person processes their own copy in their browser and is responsible for the content. If a work is copyrighted, respect its licence and the terms of the source site.

• Your own songs, transcriptions and arrangements.
• Public-domain material or content whose licence allows that use.
• Material you have the right to use in your rehearsal, class or service.

What is not acceptable

The endpoint exists for occasional imports of songs the user is preparing, not as a public scraping API. If abuse is detected, the service can be switched off.

• Using imports to get around paywalls, sign-ins or access controls.
• Downloading pages in bulk to build catalogues or databases beyond personal use.
• Publishing or redistributing third-party lyrics and chords as your own.
• Probing the service to work around the request limit.

Technical limits and why they exist

Chord sites enforce their own limits too: datacenter addresses often get a 403 or 429. Chordleaf does not evade them; it reports what happened and suggests pasting the text or importing a file instead.

• HTTPS and known hosts only, with no credentials or non-standard ports.
• A maximum page size, a timeout and a limited number of redirects.
• A per-address request limit that protects the running cost of the service.
• The feature can be switched off in a given installation.

Changes and contact

This policy may be updated when the supported hosts or the technical limits change. Questions and issues are handled in the GitHub repository; vulnerabilities have a private reporting channel.

If you are unsure whether a specific use fits this policy, open an issue before automating anything: clarifying it is easier than undoing an abuse.