Privacy Policy
1. Controller
Gerald Floßmann, Tatzendpromenade 2a, 07745 Jena, Germany. Email: support@songbookbuddy.com. Website: www.songbookbuddy.com
2. General information on data processing
We take the protection of your personal data seriously. Personal data is treated confidentially and in accordance with the statutory data protection regulations (GDPR).
3. Hosting and website operation
Our website is hosted by the following provider: Hostinger International Ltd. When you visit the website, the following data is collected automatically: IP address; date and time of the request; browser type and version; operating system; referrer URL. This data is technically required to provide the website and ensure system security. Legal basis: Art. 6(1)(f) GDPR.
4. Contact
If you contact us by email, Discord, or in-app support, your details including the contact data and information you provide are stored for the purpose of handling the enquiry. Legal basis: Art. 6(1)(b) and, where applicable, Art. 6(1)(f) GDPR.
5. Use of the Songbook Buddy app
To run the app we process, in particular: (a) Account data — email address and authentication data (and, where used, anonymous purchase sessions until you secure them with an email). (b) Licence / purchase data — subscription or one-time purchase status, platform (e.g. Apple, Google, PayPal), and related transaction identifiers needed to deliver entitlements. (c) User library content synced to the cloud — selected personal fields (e.g. song titles, ChordPro text, notes, layout settings) are encrypted on your device before upload (AES-GCM; key derived from your account password). We cannot read those encrypted fields. Limits: identifiers, timestamps, and some structural or shared metadata (e.g. band membership, setlist structure) are stored so sync and collaboration can work; shared band song payloads use separate per-band encryption; person-to-person shares and support reports (including attachments you choose to send) are readable by support/operations so we can help you. (d) Diagnostics — you may send a report from Preferences → About. For signed-in users, a minimized technical report may be sent after unexpected errors (default on; can be turned off). Reports include technical data (version, device/platform, locale, recent logs, sync state; may include file paths). Song lyrics are not included automatically. Legal basis: Art. 6(1)(f) GDPR. (e) Anonymous usage statistics (opt-in, default off) — aggregate counts only (launches, active days, feature use) under a random device identifier, not linked to your sync identity. Legal basis: Art. 6(1)(a) GDPR.
6. Cloud services (Supabase)
We use Supabase (Supabase Inc.) as a processor for: account authentication; encrypted and non-encrypted sync data as described above; licence/entitlement records; support reports; optional usage statistics; and (on the website) certain forms and download-click counters. Processing is not limited to synchronisation. Legal basis: Art. 6(1)(b) and, where applicable, Art. 6(1)(f) or (a) GDPR.
7. Website download statistics
We count installer downloads of Songbook Buddy (DMG, ZIP, APK, Windows setup) from the Download page and from direct requests under /files/ for those installer files. For each event we may store: channel (stable/beta), platform, version, artifact type, link, timestamp, page path, referrer, site host, browser user-agent (and derived device/browser/OS labels), a one-way hash of the IP address (not the raw IP), country code when the CDN provides it, and a source label (website click, in-app update link, or other direct /files/ request). Help packs and other non-installer files under /files/ are not counted this way. No account is required. Legal basis: Art. 6(1)(f) GDPR.
8. Beta portal
The beta area uses Supabase Auth (email and password). Session data is stored in your browser (local storage). You may also submit beta-related emails (newsletter signup, TestFlight / Play tester addresses). Legal basis: Art. 6(1)(b) and/or (f) GDPR.
9. Payment and store providers
Purchases may be processed by Apple, Google, and/or PayPal. Those providers process payment data under their own policies; we receive entitlement and limited transaction metadata (and, for some PayPal flows, payer email for recovery).
10. Cookies and local storage
We do not use advertising or third-party analytics cookies. Where needed for the beta portal, the browser may store a session in local storage (not a marketing cookie). Hosting may set technically necessary cookies or use HTTP authentication for protected staging/production paths. Legal basis: Art. 6(1)(f) GDPR.
11. Your rights
You have the right at any time to: access your stored data; rectification of inaccurate data; erasure of your data; restriction of processing; data portability. You also have the right to lodge a complaint with a data protection supervisory authority.
12. Retention period
Personal data is stored only for as long as necessary for the respective purpose (for example account and entitlement data while your account is active; support reports while needed for triage; download-event counters for aggregate statistics; opt-in usage statistics until you withdraw consent).
13. SSL / TLS encryption
This site uses SSL or TLS encryption for security reasons.
14. Changes to this privacy policy
We reserve the right to adapt this privacy policy to reflect current legal requirements or changes to our services.
Last updated: 19 July 2026