Privacy

Who is responsible

DoubleFau UG (haftungsbeschränkt), Pappelallee 78/79, 10437 Berlin, Germany. Email support@subsonify.app. Full company details: Impressum.

The app

The SubSonify app collects no personal data. There is no account with us and nothing in the app reports back to us, because we operate no service for it to report to.

The app communicates with two parties, and neither is us:

• Your music server, whose address and credentials you enter yourself. Those credentials are stored in the iOS Keychain on your device and sent only to that server. Where the server supports OpenSubsonic API keys, the app uses a key so that your password is never stored at all.
• Apple, for purchases and subscriptions. Payment is handled entirely by Apple's commerce system; we never see your payment details. Apple's own privacy policy applies.

Your listening history, playlists, downloads and settings stay on your device and on your own server.

There is one thing you can ask the app to do that reaches a third party, and it is described in full below.

Internet radio

If your music server has internet radio stations configured, the app can list and play them. A station does not come from your server. Your server stores only its name and its address; the audio is fetched directly by your device from the broadcaster's own server, on the open internet.

That means the broadcaster — a party you chose by tapping the station, and one we neither select, operate nor have any relationship with — can see your device's IP address, and whatever else an ordinary web request carries, for as long as you listen. What they do with it is governed by their privacy policy, not ours. We receive nothing from that connection, and we cannot see that it happened.

Because this is the only thing in the app that reaches beyond your own server and Apple, it is treated accordingly:

• the app tells you before the first station plays, in the app, and does not start it until you agree — and asks again every time until you do;
• the app sends the broadcaster no cookies — a station's audio is loaded with an empty cookie store rather than the app's own — and any cookie set for the station's own address is deleted when playback ends, however it ends: you pause it, you tune to another station, the stream drops, or it fails;
• nothing about a station is recorded in your listening history or sent to your server: no scrobble, no play count.

If you never play a station, none of this happens. Radio is off the app's main path by default: it is not one of the tabs the app ships with, and it is hidden entirely when your server has no stations.

This website

These pages are static files served from disk. They set no cookies, and everything they load comes from this domain — the stylesheet, the fonts and the analytics script included. Nothing is fetched from a content delivery network, a font service or an ad network. Since nothing is stored on or read from your device, no consent is required under § 25 TDDDG and a consent banner would have nothing to ask about.

The site is hosted on a server we rent from netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, acting as our processor under a data-processing agreement (Art. 28 GDPR). The server is located in Germany. The web server does not keep an access log.

Visitor statistics

We want to know how often these pages are read and where readers come from. For that we run Umami, an open-source analytics tool, on our own server — the same one that serves this page. No outside service is involved and no data leaves that machine.

When you open a page it records the page address, the referring page, your browser, operating system and device type, your screen size and browser language, your country, and the time.

Your IP address is not stored. It is used in memory only, combined with your browser identification and a random value that rotates automatically, to compute an irreversible checksum that lets two page views from the same visit be counted as one. Because the random value changes, recognising you beyond that window is impossible; recognising you on other websites is impossible in any case.

Nothing is stored on your device — no cookies, no local storage, no session storage.

The legal basis is our legitimate interest in a minimal statistical measure of how our site is used (Art. 6(1)(f) GDPR). The aggregated statistics are kept indefinitely and cannot be traced back to a person.

To opt out: if your browser sends the "Do Not Track" signal, the script is never loaded and nothing is recorded. Any common content blocker also prevents it. You may object at any time in writing to support@subsonify.app (Art. 21 GDPR).

This section is about this website only. The app collects nothing, and there is no equivalent to it inside the app.

The demonstration server

demo.subsonify.app is a music server we run for Apple's App Review, so that reviewers can test the app without setting up a server of their own. It is not a public service and access is by invitation. It runs Navidrome. For anyone who does log in:

• a session token is stored in your browser's local storage, and one cookie holding a client identifier, so the server knows which player is which;
• both exist only to provide the service you asked for by logging in, and are covered by § 25(2) no. 2 TDDDG — no consent is required, and none is requested;
• they are removed when you log out or when they expire.

Scrobbling and external metadata lookups are switched off, so the server talks to nothing outside itself. It runs at a log level that does not record requests, so visitor IP addresses are not retained. The music on it is Creative Commons licensed — credits.

Your rights

Under the GDPR you may request access to, correction of, or erasure of your personal data, restrict or object to its processing, and receive it in a portable form. In practice we hold almost nothing: normally only the email you wrote to us with. The visitor statistics above cannot be linked to a person, so there is nothing there we could hand over without collecting more data than we currently do (Art. 11 GDPR). Write to support@subsonify.app.

You may also complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

Email we receive

If you write to us, we process your message and address to answer it, on the basis of our legitimate interest in replying (Art. 6(1)(f) GDPR). Our mail is hosted by Fastmail Pty Ltd. Messages are kept as long as needed for the matter they concern.