Privacy policy

This English translation is provided for convenience only. The legally binding version is the German Datenschutzerklärung.

Protecting your personal data is important to us. Below we explain in detail which personal data we process when you use the Tunetorch website and the Tunetorch app for Android, for what purposes, and what rights you have.

Sections 2 to 5 concern the website, section 6 concerns the Android app; sections 7 to 10 apply to both.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Marcus Schmitt
Brentanostraße 5
63768 Hösbach
Germany

Contact:
Email: mail@tunetorch.de
Direct message: Contact form

2. Provision of the website and server log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

What data is collected?

• Information about the browser type and version used
• The user's operating system
• The user's internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system reaches our website (referrer)
• Websites accessed by the user's system via our website

Purpose of processing

The temporary storage of the IP address by the system is necessary to deliver the website to the user's device. For this, the user's IP address must remain stored for the duration of the session.

Storage in log files also serves to ensure the functionality of the website. In addition, the data helps us optimise the website and ensure the security of our information technology systems (e.g. defending against and investigating DDoS attacks or misuse). The data is not analysed for marketing purposes in this context.

Legal basis

The legal basis for the temporary storage of the data and the server log files is Art. 6(1)(f) GDPR (legitimate interest in ensuring the security and functionality of our information technology systems).

Storage period

The data is deleted as soon as it is no longer required for the purpose for which it was collected. For data collected to provide the website, this is the case when the respective session ends. Data stored in log files is generally deleted or anonymised after 7 days at the latest.

3. Registration and user account

Users can register on our website to create a user account. This account is required to manage your server connections (licences) and your Pro subscription.

What data is processed?

• Email address
• Username of your choice
• Password (stored exclusively as a cryptographic hash)
• Date and time of registration and of the last sign-in
• The language in which we send you emails (German or English)
• IP address on failed sign-in attempts and a hash of the email address entered (both to protect against brute-force attacks)
• For each active sign-in, a session identifier together with the sign-in time, expiry date, IP address and browser/device identifier (user agent)

Purpose of processing

Registration is required to provide certain content and services on our website (e.g. managing licences/servers and your Pro subscription). The password hash is used to authenticate and secure your account. The stored language determines the language of the emails we send you about your account; it is taken from the language in which you use the website when you register.

The session data is technically necessary so that you stay signed in without having to enter your password again on every page. It also makes it possible to end a single sign-in specifically – for example when you sign out, or after a password or email change, which invalidates all other sessions.

If you change your email address, we additionally send a notification to your previous address. This serves your account security alone: your email address is the way you can reset your password – an unnoticed change would lock you out of your account. The previous address is not stored for this; it is used only for this one message.

If someone tries to register with an email address that already has an account, we do not create a second account; instead we send that address a notice with links to sign in and to reset the password. For this we only use the data already stored for your account.

Legal basis

Where a user has registered, the legal basis for processing the data is the performance of a contract or the implementation of pre-contractual measures, Art. 6(1)(b) GDPR.

Storage period

The data is deleted as soon as it is no longer required for the purpose for which it was collected. For the data collected during registration, this is the case when the registration on our website is cancelled or modified (account deletion). You can delete your user account yourself at any time in your profile settings.

A session becomes invalid 30 days after sign-in at the latest, when you sign out, and on a password or email change. Expired session data is then removed as part of system maintenance; when your account is deleted, it disappears completely in any case.

When your account is deleted, we also remove what is tied not to the account but to your email address: an unused verification code from the contact form and emails to you that are still waiting to be delivered. If a voucher is bound to your address, it is deactivated and the address is removed from it.

Emails we send you (for example to confirm your address or to reset your password) are kept in our database until they are delivered, usually for only a few seconds. If our mail server is disrupted, we retry delivery for up to about two hours and then delete the message. We no longer send a message that is older than 24 hours.

4. Contact form

You can reach us via our contact form — as a signed-in user or as a guest.

What data is processed?

• Email address
• Name or pseudonym
• Selected topic and content of your message
• Optional attachments (images and PDF files) that you add to the message yourself
• The language in which you use the website (German or English) — you receive the verification code and the confirmation of receipt in it, and it tells us which language to reply in
• Temporary verification code (sent by email to prevent spam when you write as a guest)
• IP address to limit the sending rate (held only briefly in memory, not stored)

If you are signed in, your name, email address and language are taken from your account; you then do not need a verification code.

Purpose of processing

The processing serves solely to handle your enquiry. The email verification code verifies guest submissions and protects our systems against misuse; the sending rate limit serves the same purpose.

Legal basis

The legal basis for processing the data you submit is Art. 6(1)(f) GDPR (our legitimate interest in responding to your enquiry). If the contact aims at concluding or performing a contract (e.g. support for licences), Art. 6(1)(b) GDPR is an additional legal basis. The verification code and the sending rate limit for spam protection are based on Art. 6(1)(f) GDPR.

Storage period

Your contact message is not stored in our database. It is delivered immediately as an email to our support mailbox; attachments are sent as file attachments with the same email and likewise do not remain on the web server. The verification code is short-lived and expires on its own. The emails to you (the verification code and the confirmation of receipt) wait briefly in our database until they are delivered, as described in section 3. The data in the support mailbox is deleted as soon as the respective conversation is concluded and no statutory retention obligations prevent this.

5. Server pairing and Pro licences

If you connect your self-hosted Tunetorch server to the website to unlock the Pro features, we process the corresponding licence data.

What data is processed?

• Generated connection codes and your server's installation ID
• Connection status and expiry date of the pairing
• Licence type and billing period (during the free test phase, no payment or invoice data arises)

Purpose of processing

The purpose of the processing is to verify the licence entitlement of your self-hosted Tunetorch server and to provide and manage the Pro features.

Legal basis

The legal basis for this processing is Art. 6(1)(b) GDPR (performance of the licence and usage agreement).

Storage period

The licence and pairing data is stored for as long as the server connection is active. Invoice data and tax-relevant records are stored in accordance with the statutory retention periods (generally 8 years for invoices).

No invoices are issued during the free test phase. When it ends, all Pro subscriptions taken out during the test phase are deleted; your account remains.

6. The Tunetorch app for Android

The Tunetorch app is purely an access app for your own server. It is not a service operated by us: after installation you enter the address of your self-hosted Tunetorch server, and from then on the app communicates exclusively with that server. There is no registration and no account with us in the app, and no server address is preset.

We, as the provider of the app, receive no data

This is not a statement of intent but a property of the app:

• No analytics, tracking or advertising libraries. The app includes only the Android system libraries (AndroidX, Media3, Material) and an HTTP library (OkHttp). It contains no analytics framework, no advertising network and no crash reporting service.
• No connection to us. The app contains no hard-coded address of any server operated by us. Every network connection goes to the address you entered yourself.
• No identifiers. No advertising ID, device ID or installation identifier is collected or transmitted.
• No error or usage reports to us. If an error occurs during playback (typically a dead spot in mobile coverage), the app reports it to your server so that it appears in the administration log there. This report contains the error code, the affected track, the app version and the network type; it does not leave your own server.

Data stored on your device

The app stores the following data locally on the device. It is not transmitted to us or to third parties:

Encryption of stored passwords

The passwords of your server profiles are never stored in plain text. They are encrypted with AES-256-GCM; the corresponding key is held in the device's Android Keystore and – on devices with suitable hardware – bound to a secure chip. The key never leaves the Keystore and cannot be read even by the app.

No cloud backup, no transfer to a new device

The app is explicitly excluded from Android backup – both from cloud backup (for example to Google Drive) and from device-to-device transfer when setting up a new phone. As a result, your server credentials, sessions, downloads and caches are never transferred to Google's servers or to another device. When you switch to a new phone, you set up the app there again.

Data sent to your own server

When you use the app, the following is exchanged between the device and your server: sign-in data, requests for your music library and its cover images, the audio streams, and the report of which track was played when (for “Recently played” and the statistics). How your server handles this data is determined by you as its operator – we have no access to it and no knowledge of it. If the server is operated by another person, that person is responsible for the processing there.

The connection is encrypted via HTTPS by default. An unencrypted connection (HTTP) is only possible if you explicitly allow it when setting up the server; the app points this out at that step.

Permissions and what they are needed for

The app requests no permission for location, contacts, calendar, camera, microphone, phone status or access to your photos and files.

Android Auto and voice search

If you use the app in the car, it passes track, album and artist names as well as cover images from your library to the Android Auto application on the same device so that it can display them on the vehicle screen. No data is transmitted to us in the process.

If you start playback by voice command (“Play … on Tunetorch”), your voice input is processed by Google Assistant, not by us; Google's privacy policy applies to this. The app merely receives the recognised search term as text and uses it to search your library.

Download via Google Play

When you download and update the app via Google Play, Google Ireland Limited or Google LLC processes its own data (such as your Google account, device data and the installation process). This happens outside our sphere of influence; Google's privacy policy applies. We do not receive any personal data about individual users from Google.

Legal basis

Local storage is necessary to provide the function you requested; the legal basis is Art. 6(1)(b) GDPR (performance of the usage agreement for the app) in conjunction with § 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act: storage on the device that is strictly necessary). We, as the provider of the app, do not process any personal data.

Storage period and deletion

The caches for images and music are limited to a storage budget: once it is reached, the app removes the oldest entries on its own. All other data remains on your device until you remove it. You have three ways to do so:

• clear the caches in the app's settings (image and music cache, with their size shown),
• delete a server – this also completely removes its credentials, downloads and caches,
• uninstall the app – this removes all local data.

7. Cookies and local storage (LocalStorage)

Our website uses only technically necessary mechanisms to store information on your device.

Which mechanisms are used?

• HttpOnly cookies: We use authentication tokens (access_token_cookie on path / and refresh_token_cookie on path /api/auth). They remain encrypted in the browser and cannot be read by JavaScript.
• LocalStorage / session data: For caching display settings (e.g. dark mode/light mode) or session identifiers.
• Language cookie tt_sprache: If you choose a language with the “DE | EN” switcher, we store this choice in the cookie tt_sprache. It contains only the language code (de or en) and is valid for one year. Our server reads it solely to take you to the chosen language version when you open the home page. It is not set unless you make such a choice.

Purpose and exclusion of tracking

These cookies and storage mechanisms serve exclusively to provide our service, to enable secure sign-in, to protect your session against unauthorised access and to remember the language you chose.

Important note: We use no analytics, tracking or marketing cookies whatsoever (such as Google Analytics, Facebook Pixel or similar). Since only technically necessary cookies are used, displaying a cookie banner is not legally required.

Legal basis

The legal basis for the use of technically necessary cookies is § 25(2) No. 2 TDDDG (strictly necessary storage/access) in conjunction with Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR (ensuring secure sign-in and the functionality owed under the contract).

8. Web hosting and no CDNs

We use a hosting provider to provide our online service.

Server location

Our website is hosted on servers within the European Union (Germany). No data is transferred to third countries outside the scope of the GDPR.

Local integration (no third-party CDNs)

To protect your privacy as well as possible, we integrate external resources (such as fonts, frameworks, JavaScript libraries or statistics modules) exclusively locally. There are no requests to third-party servers (such as Google Fonts, CDNJS or similar) running unnoticed in the background, so your IP address is not transmitted to third parties.

9. Data security (SSL/TLS encryption)

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the padlock symbol in your browser bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

10. Your rights as a data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller:

Right of access (Art. 15 GDPR)

You can request confirmation as to whether personal data concerning you is processed by us. If so, you can request information about the purposes of processing, the categories of data, the recipients and the planned storage period.

Right to rectification (Art. 16 GDPR)

You have a right to rectification and/or completion against the controller if the personal data processed concerning you is inaccurate or incomplete.

Right to erasure (Art. 17 GDPR)

You can request that the personal data concerning you be erased without undue delay if one of the grounds listed in Art. 17(1) GDPR applies (e.g. if the data is no longer needed for the purposes for which it was collected).

Right to restriction of processing (Art. 18 GDPR)

Under the conditions of Art. 18(1) GDPR, you can request the restriction of the processing of personal data concerning you (e.g. if you contest the accuracy of the data or the processing is unlawful).

Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(e) or (f) GDPR.

Right to withdraw consent under data protection law

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.