Privacy policy

This English version is for your information. Only the German version is legally binding.

In short: this website sets no cookies and uses no tracking or analytics tools. Fonts, images and the audio sample are served from the same server as the page. Only when you scroll to the beta sign-up form does the page load Cloudflare Turnstile for the spam check (see below).

Controller

Hosting

The website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data such as your IP address, the time, the page requested and your browser identifier, in order to deliver the page and protect it from attacks. The legal basis is my legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework, and the standard contractual clauses in Cloudflare’s data processing agreement also apply. Cloudflare also delivers the app downloads and the list of new versions (dl.riffwerk.com via Cloudflare R2, riffwerk.com/appcast.xml), which involves the same technical data. I only count how often each file is downloaded per day, without IP addresses or any other identifier. Cloudflare Web Analytics is not enabled. More in Cloudflare’s privacy policy.

Beta sign-up form

When you sign up for the beta on the home page, I store your name, email address, the devices you selected, your optional note, the language of the page (so the emails come in your language) and the time. The data sits in a database at Cloudflare (Cloudflare D1, same provider as the hosting). You get a confirmation by email, and I get an email with your details and decide by hand whether to let you in. When I do, I issue your personal key and send you the email with the download; for the iPad I add you in TestFlight (see below). I send the emails through the email service Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) from [email protected]; Brevo processes your address and the content of the email on my behalf, on servers in the EU. I don’t track opens or clicks. More in Brevo’s privacy policy. The legal basis is setting up and running the beta participation you ask for (Art. 6(1)(b) GDPR).

I keep your sign-up for as long as you take part in the beta and delete it whenever you like: a short email to me is enough. I delete declined requests after three months at the latest.

Cloudflare Turnstile protects the form against automated spam. Turnstile only loads when the form comes into view and uses technical characteristics of your browser (such as IP address and browser identifier) to check whether a human is submitting the form. It doesn’t set any cookies for advertising or tracking. The legal basis is my legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR). More in the Turnstile privacy policy.

Contact by email

If you write to me, for example to join the beta, I only use your details to reply and to send you Riffwerk (Art. 6(1)(b) GDPR). I delete the email once it has been dealt with and there is no obligation to keep it.

The Riffwerk app

Riffwerk analyzes your music only on your own device (Mac, iPad or Windows PC). Audio files, stems and analyses are never sent to me or anyone else.

Once a day, and when you choose “Check for Updates”, the app fetches the list of new versions from riffwerk.com. Only the technically necessary data is transmitted (IP address and app version); there is no identifier and no user profile. We only count how often each app version checks in per day, without IP addresses (Art. 6(1)(f) GDPR, legitimate interest in secure, up-to-date versions).

For the beta you get a personal key that contains your name and email address. The app checks it offline and doesn’t send it anywhere. I store your name, address and the date the key was issued for as long as you use the beta, to match keys and reach you if needed (Art. 6(1)(b) GDPR).

Crash reports and feedback from the app

If Riffwerk crashes on the Mac or iPad, the app asks on the next launch whether it may send me a report. You can look at the report first; nothing is sent without your consent. It contains technical details about the crash (which part of the program was affected, app version, system version, device model), your optional comment and, on the Mac, the ID of your license key along with the name and email address it contains, so I can follow up. Audio files and songs are never included. “Help → Send Feedback …” sends the same details with your text and, if you tick the box, a screenshot of the Riffwerk window. The reports are stored in the database at Cloudflare (see above), and I also receive them by email via Brevo. I don’t store your IP address, only a non-reversible short hash of it to limit abuse. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing me; I then delete your reports. Otherwise I delete them after one year.

Apple also collects crashes of the iPad beta and the feedback you send in TestFlight. I fetch these reports through App Store Connect and store them in the same database, so everything is in one place. The legal basis is running the beta (Art. 6(1)(b) GDPR).

iPad beta via TestFlight

Apple distributes the iPad beta through the TestFlight app. For this I enter the name and email address you sent me or gave in the form at Apple, and Apple sends you the invitation. Through TestFlight I learn whether and on which device you installed the beta, and I receive crash reports and feedback you send there (Art. 6(1)(b) GDPR). TestFlight itself is covered by Apple’s privacy policy. If you no longer want to test, I remove you there.

Your rights

You can ask for information about your data and for correction, deletion, restriction of processing and data portability. You can object to processing based on legitimate interests. You can also complain to a data protection supervisory authority; in Bavaria that is the Bavarian State Office for Data Protection Supervision (Landesamt für Datenschutzaufsicht) in Ansbach.

As of October 2026