Privacy policy

The controller under the GDPR is Christian Harms, trading as HAINZ. Email: hainz@birdbeat.eu. The postal address is in our legal notice. BirdBeat is a one-person business, so whoever reads your email also wrote the code.

BirdBeat runs on servers of ALL-INKL.COM, Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. They host it for us under a data processing agreement (Art. 28 GDPR).

To deliver a page, the server has to process your IP address, the address requested and your browser's user agent. Like every web server, theirs keeps a log: date and time, the address requested, the user agent, the referring page and technical details such as the status code. Your IP address is fully anonymized before anything is stored. That includes the counting call in section 7.

Why: to deliver the site, keep it secure, find errors and see simple visitor numbers. Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a website that works, stays safe and roughly knows how often it gets visited.

How long: 30 days, then the logs are deleted automatically. From the logs, our host builds statistics for us, such as page views per day and browser types. They contain only totals, no IP addresses. We never combine logs or statistics with the counts in section 7.

No cookies. Not even the edible kind. BirdBeat does store things in your browser, because a groovebox that forgets your beat is just a box.

• Your work (IndexedDB, database “BirdBeatDB”): projects, recordings, imported files and chops.
• The app itself (Cache Storage, service worker): so BirdBeat also starts offline.
• Your settings (localStorage): whether shaking is on, your CHOP settings (how many hits and slices), your recording length (free, or 1, 2 or 4 bars) and when your last backup file was saved, for the backup reminder.
• What the app already showed you (localStorage): tips seen, help offered, coach progress, install hint, demo heard, birds unlocked in your album and which projects the app already offered a name for. So it doesn't repeat itself like a stuck loop.
• Your privacy choices (localStorage): that you've seen the first-visit note, and your COUNTS: OFF choice.

None of this is sent to us. We can't see it, and we can't delete it for you.

Legal basis: storing and reading this information is strictly necessary to provide the app you asked for (Section 25 (2) no. 2 of the German TDDDG). To show you the right help, the app also checks on your device whether it runs as an installed app or in the browser; the result is neither stored nor sent.

The microphone is only on while REC records (red), and only after you allow it in your browser. The sound goes straight into your device's storage. You can revoke the permission at any time in your browser settings.

On phones, BirdBeat can read the motion sensors: tilting the phone steers the filter (TILT) and shaking it creates a variation of your beat (SHAKE). The sensor values are used on the spot, on your device, for this only; they are neither stored nor sent. Some browsers ask for permission first. You can switch SHAKE off in the app.

You're in control. Under YOUR DATA you can export everything as a ZIP or press DELETE ALL DATA. That deletes everything except your COUNTS: OFF choice, because forgetting your “no” would be rude. Clearing this site's data in your browser deletes everything, including that choice.

Recordings can contain voices, names or your roommate's opinion of your hi-hats. That can be personal data.

They stay on your device. No upload, no copy, no cloud. We never receive them, so we don't process them and we are not the controller for them.

If you share or publish a recording, you are the one sharing it. Make sure everyone on it is fine with that (see our terms). If you email us a recording or a backup, section 5 applies.

The contact page and the feedback button simply open your own mail app. Nothing passes through our website.

If you write to us, we process your email address, your message and anything you attach, so we can answer. The feedback email comes pre-filled with the app version and the last error message (200 characters at most). The “Fill in” button can add your phone and browser type; it reads them on your device and only writes them into the mail. You see all of it before you hit send and can delete it.

Legal basis: Art. 6 (1) (f) GDPR, our interest in answering you. If your message is about using BirdBeat, also Art. 6 (1) (b) GDPR.

Our mailbox is also hosted by ALL-INKL.COM, under the same data processing agreement. We delete emails at the latest 6 months after your matter is settled, unless the law makes us keep them longer.

Nobody, apart from our host as processor. No ads, no third-party trackers, no external scripts, fonts or services on this website or in the app. No transfers outside the EU or EEA from here. Our Instagram profile is a separate presence outside this website; section 8 covers what that means for your data.

When you export or share something, the file is saved on your device or goes wherever you send it through your system's share dialog. That's your call, and that service's rules apply there.

We count how often things happen in BirdBeat, so we know what works, what nobody uses and what breaks.

What gets sent. A short message to our server with an event name from a fixed list (for example: app opened, beat made, export, or a broad error class like “microphone” or “storage”), the app version and, for some starts, a tag from a fixed list: where the link came from (like ?src=hn), or “pwa” when you open BirdBeat from the icon you put on your home screen. Each event goes at most once per page view. Never sent: an ID, a cookie, text, an error message or audio.

What the server does. It sees your IP address and user agent, because that's how the internet works. It turns the user agent into one of three groups: Android, iOS or other. Then it adds one to a daily total.

What it stores: event, device group, app version, link tag and the daily total. What it doesn't store: IP address, user agent, time of day or anything else that identifies you. Think of a clicker at the club door: it knows how many, not who.

Server log. Like any request, the counting call shows up in the host's log, with your IP address already anonymized (section 2). The log can't see what was counted.

When. Only after the first-visit note, once you tap GOT IT or leave the start page. Never if your browser sends Global Privacy Control. Never after you switch COUNTS: OFF.

Legal basis. Art. 6 (1) (f) GDPR. Our legitimate interest: improving BirdBeat and fixing errors with as little data as possible. Since we keep only totals, your interests are barely touched.

Your right to object (Art. 21 GDPR). You can object at any time, no reason needed. Switch COUNTS: OFF under YOUR DATA, or turn on Global Privacy Control in your browser. Then the app sends nothing more. The switch works per browser and device.

On your device. To respect your choice, the app stores the COUNTS: OFF setting and reads the Global Privacy Control signal. Both are strictly necessary for that (Section 25 (2) no. 2 TDDDG).

How long. The counts are anonymous. We still delete them after 24 months.

We run an Instagram profile, @birdbeat, to tell people about the app. Provider: Meta Platforms Ireland Limited, Ireland. Legal basis: Art. 6 (1) (f) GDPR, our interest in informing people about BirdBeat.

The profile lives on Instagram, not here. Visiting it, or following a link from it to this website, means Meta processes your data under its own terms; we have no influence on that and nothing here connects to Meta (same CSP as everywhere else: no external scripts, no embeds, see section 6). Our Instagram links carry no tracking parameter, so we can't tell from a visit here that it came from Instagram.

Meta gives us aggregated Insights about the profile (totals only, no data about individual visitors). Where we and Meta jointly decide what Insights are collected, we are joint controllers with Meta for that part under Art. 26 GDPR; the allocation of responsibilities and your rights are set out in Meta's own terms for Page/profile Insights. Unverified, not legal advice: whether Meta transfers this data outside the EU/EEA, and on what basis, is something we have not reviewed ourselves.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Just email us.

Honest note: we hold almost nothing that points to you. Your work is on your device, and you can export or delete it yourself at any time.

You can also complain to a data protection supervisory authority, for example the one where you live or the one responsible for us (Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany).

You don't have to give us any data. Without the technical data in section 2 the site simply can't load. We make no automated decisions about you and build no profiles.

When BirdBeat changes, this page changes too. The date at the top tells you when.