Privacy Policy

Last updated: 14 September 2026

1. Controller

2. The Song in the Air app

Nothing is transmitted to us

The app contains no analytics framework, no crash reporter, no advertising identifier and no interface to any service of ours. There is no server that could receive usage data, because the app contacts none.

What stays on your device — and only there

The app stores locally on your iPhone, in its own database:

• the servers and renderers on your network you last used,
• the tracks you have starred,
• your settings (language, volume behaviour, diagnostics switch),
• from version 1.2, for your subscription: the end of the current period, whether it is set to renew, and the latest time seen so far (so that setting the device date back cannot defeat the subscription check).

None of this leaves your device. Deleting the app deletes it. You can also clear it yourself at any time under Settings → Reset.

Connections on your own network

To do its job, the app talks to devices on your local network: media servers (Synology, MinimServer, Plex and similar) and renderers. The requests exchanged are those defined by the UPnP standard. This communication happens strictly between devices you own.

Requests to the internet

The app is built for your own network and works fully there. In a few places it fetches supplementary information from the internet. We draw an honest line between what happens automatically and what you trigger:

Automatically, without your involvement:

• Cover art lookup. When your server provides no image for an album, or only one too small for the screen, the app queries MusicBrainz for the release and fetches the front cover from the Cover Art Archive. The artist and album name are transmitted, along with your IP address. This happens as you browse your collection, without you asking for it.
• Label and genre details come from the same source (MusicBrainz) when your server does not supply them.

When you open the artist panel — opening it is your decision, but the requests that follow are not confirmed one by one, so they are named here in full. Only the artist name is transmitted, along with your IP address:

• MusicBrainz — the artist record and the links stored with it.
• Wikidata — resolves the artist to the matching Wikipedia entry, so that a band called American Football does not return the sport.
• Wikipedia — the biography shown in the panel.

Only when you tap them: buy and concert links (Amazon, Discogs, Bandcamp, HHV, Ticketmaster, Eventim, Songkick, setlist.fm) open in your browser, not inside the app.

In every case your IP address reaches that provider, because any request on the internet requires it technically, and their own privacy terms then apply. All four are run by non-profit foundations: MusicBrainz and the Cover Art Archive by MetaBrainz, Wikipedia and Wikidata by Wikimedia. Both are based in the United States, so every one of these requests is a transfer to a third country. The app identifies itself to them by name and version, as MusicBrainz requires. Legal basis for the automatic lookups: Art. 6(1)(f) GDPR (legitimate interest in presenting your collection completely).

These lookups cannot be switched off at present. A setting for it is planned; until then this page states what actually happens rather than a promise the app does not keep.

App Store, subscription and in-app purchase

Downloading and updating happens through Apple's App Store. Apple processes data there as its own controller (your Apple Account, download statistics and similar). We receive only aggregated, non-personal reports from Apple. See Apple's Privacy Policy for details.

From version 1.2 the app is a subscription. Purchase, payment, renewal, cancellation and refunds are handled entirely by Apple (in the EU by Apple Distribution International), which is independently responsible for them. The app verifies Apple's signed purchase receipts on your device; payment details, your name or your Apple Account address never reach us. The legal basis is the performance of the contract you enter into by subscribing (Art. 6(1)(b) GDPR); storing the subscription details locally is strictly necessary for it (§ 25(2) no. 2 TDDDG).

So that a device date set back in Settings cannot defeat the subscription check, the app occasionally asks www.apple.com for the current time. Only the date from the response is used; as with any request on the internet, your IP address is transmitted to Apple.

3. This website

Hosting and server logs

The site is hosted by ALL-INKL.COM — Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Each request is automatically logged: date and time, resource requested, volume transferred, referrer, browser and operating-system identification, and IP address. These records are necessary to operate the site and defend it against attacks, and are deleted after a short period.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). A data-processing agreement under Art. 28 GDPR is in place with the provider.

Typefaces

All fonts are served from our own server. There is no connection to Google Fonts or any other font service, so no IP address is passed to a third party.

Cookie-free audience measurement

We count page views using our own mechanism on our own server. It sets no cookies and stores nothing in your browser. That is why this site shows no consent banner — there is nothing to consent to.

Recorded per view: timestamp, page requested, the domain of the referring site (not the full address), your browser's language tag, and the window width.

Your IP address is not stored. A checksum is derived from your IP address and browser identification together with a random value regenerated every day, so that repeat views within one day are not counted twice. Each daily random value is deleted within 48 hours; once it is gone, the checksums of that day cannot be reproduced — not by us, and not by anyone holding the IP address. Recognising you across days is therefore not something we could do.

If your browser signals "Do Not Track", no measurement takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring reach of our own service).

What this website does not do

• no cookies,
• no Google Analytics or any other third-party analytics,
• no ad networks, no social-network tracking pixels,
• no embedded third-party content — the product film is served from our own server,
• no sharing of data for advertising purposes.

Contacting us by email

If you write to us, we process what you send solely to handle your enquiry. Legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for contract-related matters. We delete correspondence once it is no longer needed and no statutory retention period applies.

4. Recipients and transfers outside the EU

We receive no data from the app and pass none on. The only processor we engage is our hosting provider for this website, based in Germany.

The app is a different matter, and it would be misleading to fold the two together. It does cause transfers outside the EU, and not all of them are triggered by a deliberate act on your part:

• Automatic, while you browse: cover art and release details are requested from MusicBrainz and the Cover Art Archive, operated by the MetaBrainz Foundation in the United States. You do not confirm these individually — they happen as the app builds the view.
• When you open the artist panel: requests go to MusicBrainz (MetaBrainz Foundation, United States) as well as Wikipedia and Wikidata (Wikimedia Foundation, United States). Opening the panel is your decision; the individual requests are not confirmed separately.
• Only on an explicit tap: the buy and concert links, which open in your browser and are outside this app from that point on.

None of these providers is a processor acting on our behalf. We have no contract with them and no data flows back to us; each is a public interface queried anonymously. What reaches them is the artist name, sometimes the album name, and your IP address, which any internet request requires. There is no adequacy decision covering them and no standard contractual clauses, because there is no processing relationship to cover — the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in showing your collection completely, as stated in section 2.

These lookups cannot be switched off at present. If that matters to you, the app remains fully usable without internet access: everything except artwork upgrades and artist information works on your own network alone.

5. Retention

• Server logs: short-term, then deleted automatically by the host.
• Audience measurement records: 12 months, after which only totals remain, without individual views.
• Email correspondence: until the matter is settled, subject to statutory retention periods.
• Data inside the app: until you delete it or remove the app.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR). Write to the address above.

One honest note: our audience measurement deliberately collects nothing that could identify you. We therefore cannot answer an access request about your person there — not out of unwillingness, but because the link simply does not exist (Art. 11 GDPR).

7. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

8. Changes

If the app or this site changes, we update this policy. The version published here, bearing the date above, is the one that applies.

This is a translation provided for convenience. In case of discrepancy, the German version prevails.