Privacy policy

The German version of this document is legally binding. This translation is provided for convenience only.

As of: 5 October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Yannick Stein
Auf’m Bruch 6
59929 Brilon
Email: [email protected]

2. Overview of processing operations

This privacy policy provides information about the processing of personal data when using the website notenarchiv.com as well as the web-based platform and mobile app “Notenarchiv” (hereinafter jointly referred to as the “Service”).

3. Data collected

3.1 Visiting the website (notenarchiv.com)

This website is a static information page. No forms are used for data collection. When visiting the website, technically necessary server log files are recorded (see section 4).

In addition, we use Google Ads on this website to measure how effective our advertisements are (see section 6.5). This sets cookies and transmits data to Google. This only happens after your explicit consent, which we obtain via a consent banner. If you do not give consent, no advertising cookies are set and no identifiers are transmitted to Google.

To measure reach we use Umami, analytics software that we host ourselves on a server at Hetzner inside the EU (see section 6.2). It records the page visited, the referring page, the approximate origin (country, region and city, derived from the IP address), device type, screen size and browser language. Umami sets no cookies and stores nothing permanently on your device. Your IP address is not stored; it is used only transiently, together with your browser signature and a random value that changes daily, to derive a counting value — once that random value rotates, you can no longer be recognised. No data is transmitted to third parties; the analysis never leaves our own server. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in the needs-based design of our offering). You may object to this processing under Art. 21 GDPR (see section 10).

Neither advertising nor audience measurement takes place in the mobile app. In the web app we use the cookieless audience measurement described in section 3.7; there is no advertising measurement there.

3.2 Registration and account management (app)

• Club name (organisation customers)
• First name, surname and email address of the contact person or – for a personal archive – of the user
• IP address and user agent at registration (proof of agreement to the terms)
• Role within the club (admin, librarian, section leader, member)
• Assigned instruments

3.3 Use of the Service (app)

• Uploaded files (sheet music as PDF)
• Metadata of the sheet music (title, composer, category, etc.)
• Events with replies (accept, decline, maybe) and – only if the club switches the feature on – attendance recorded at rehearsals and performances
• Personal markings and jump links in the sheet music
• Access logs (timestamps, pages visited)
• Usage trail per member and club: on which days someone was active with which client (web, iOS app, Android app). We evaluate it for operations and to verify the contractual scope of use (§ 3a GTC – e.g. the number of a club’s active members in the last 90 days)
• Change log of the club: who created, changed, deleted or shared which sheet music, parts, books, master data, memberships, permissions or club settings and when (acting person, affected person, time, device used – web, iOS app, Android app or API). IP addresses, content, read access and downloads are not recorded. Club admins can view it in full, librarians for the sheet music area

3.4 Authentication (app)

• WebAuthn/passkey credentials (public key, credential ID)
• Magic link tokens (temporary, valid for max. 15 minutes)
• JWT tokens (in the user’s browser storage)

3.5 Subscription and billing (app)

• Selected plan and subscription status
• Billing address (if provided)
• Payment information (invoice number, payment status)
• For card payment, SEPA direct debit, Apple Pay or Google Pay: the payment data is collected and processed by the payment provider Stripe (section 6.9). We store no card or account numbers, only a Stripe customer identifier and the payment status
• For in-app purchases via the App Store or Google Play: Apple or Google handles the payment (section 6.11). We only receive the purchase confirmation with plan, term and status, no payment data

3.6 Referral programme “club refers club” (if activated)

If a club registers using another club’s referral code, we additionally process:

• the assignment to the referring club and the status of the referral,
• the IP address at registration and – for matching – the billing address, billing email, tax number and the email domains of the club admins of both clubs,
• the credit entries (credit, offsetting, expiry).

The matching serves exclusively to prevent abuse (e.g. “self-referral” with a sham club). The referring club only sees the name of the referred club, the registration date and the status of the referral – no people, no amounts and no review results.

3.7 Audience measurement in the web app

In the web app (app.notenarchiv.com) we also use the self-hosted software Umami described in section 3.1 – to see which features are used and to find errors. Umami sets no cookies and stores nothing on your device.

The following is recorded per page view or event:

• the page visited as a page type without identifiers – for example /scores/:id instead of the number of a score; share, event and login links are reduced to :token, query parameters are dropped,
• browser, operating system, device type, screen size and language,
• the approximate origin (country, region, city), derived from the IP address; the IP address itself is not stored,
• technical events: the HTTP status code of failed requests and the error class for rendering errors – without content.

Umami derives a non-reversible counting value from the IP address, browser signature and a random value that changes daily, to group visits of the same day into a session. No profile across several days and no link to an account, club or person is created. If “Do Not Track” is enabled in your browser, the counting script is not loaded at all.

The legal basis is our legitimate interest in a stable service that is developed according to actual needs (Art. 6 (1) lit. f GDPR). As nothing is stored on or read from the device, no consent under sec. 25 TDDDG is required. You may object to this processing under Art. 21 GDPR (section 10) or exclude yourself as described in section 9.1.

3.8 Error reports (web app, mobile app and servers)

If a technical error occurs in the web app, in the mobile app or on our servers, an error report is transmitted to the Sentry service (section 6.8). It contains the error message and the program flow (stack trace), the affected page without identifiers, the app version, browser or device type and operating system, and the time. Personal details are removed before sending: no email addresses, no login, share or reply tokens, no request content. Sentry is configured not to store user identifiers or IP addresses. In addition, a small share of requests (around 10 %) is recorded to measure response times – endpoint name and duration, without content. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in a stable and secure service).

4. Server log files

The hosting provider (Cloudflare) automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• IP address
• Time of the server request

This data is not merged with other data sources. The collection of this data is based on Art. 6 (1) lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and provision of its website.

The analytics instance stats.notenarchiv.com runs on our own server at Hetzner inside the EU (see section 6.2). Server log files containing the same details, in particular your IP address, are also created there when the counting script is retrieved and when measurements are transmitted. These logs serve solely for secure operation and troubleshooting. They are not merged with the analytics data described in section 3.1 and are deleted after the period stated for access logs in section 8. The legal basis is Art. 6 (1) lit. f GDPR.

5. Legal bases of processing

6. Processors and integrated third-party providers

We use the following service providers:

6.1 Cloudflare, Inc.

• Purpose: Hosting the website, bot protection during registration and on the platform’s contact form (Cloudflare Turnstile)
• Data: IP address, browser information (anonymised)
• Storage: No permanent storage of personal data
• Location: Worldwide, standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR
• Info: https://www.cloudflare.com/privacypolicy

6.2 Hetzner Online GmbH

• Purpose: Hosting the application and storing the data (servers and S3 object storage), and running our self-hosted analytics instance (stats.notenarchiv.com)
• Location: European Union – data centres in Germany and Finland
• Data protection: Data processing agreement concluded pursuant to Art. 28 GDPR
• Info: https://www.hetzner.com/legal/privacy-policy

6.3 Resend Inc. (where activated)

• Purpose: Sending emails (login links, notifications)
• Data: Email address, first name
• Location: USA, standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR
• Info: https://resend.com/legal/privacy-policy

6.4 OpenAI, LLC (only when AI recognition is activated)

• Purpose: AI-powered instrument recognition on PDF pages
• Data: Individual PDF page images are temporarily transmitted to the OpenAI API
• Storage: OpenAI does not permanently store data transmitted via the API for training purposes in accordance with its own Data Usage Policy (for API usage)
• Location: USA, standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR
• Note: AI recognition is deactivated by default and is only activated at the customer’s request. The customer can deactivate its use at any time in the settings.
• Info: https://openai.com/policies/privacy-policy

6.5 Google Ireland Limited (only after consent, website only)

• Purpose: Measuring the effectiveness of our advertisements (Google Ads conversion tracking and remarketing) on notenarchiv.com
• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Data: IP address, browser and device information, pages visited, referrer URL, advertising click identifiers (e.g. gclid), cookie identifiers
• Legal basis: Art. 6 (1) lit. a GDPR (consent) in conjunction with sec. 25 (1) TDDDG
• Role: Google processes part of this data not as a processor but as an independent controller. Details are governed by the Google Ads Data Processing Terms.
• Third-country transfer: Transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR apply in addition.
• Consent Mode: We use Google Consent Mode v2. As long as you have not consented, all consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to “denied”. Google then receives no identifiers, at most anonymous, cookieless signals.
• Withdrawal: at any time via “Cookie settings” in the footer of every page
• Info: https://policies.google.com/privacy and https://policies.google.com/technologies/ads

6.6 YouTube (Google Ireland Limited) – in the app only, only on click

• Purpose: Playing listening examples that a club has attached to a piece as a YouTube link
• Data: Only when you start a listening example does the browser load the player from youtube-nocookie.com (privacy-enhanced mode). Google then receives your IP address and device information; no connection to Google is made before that. In the mobile app, tapping opens the video in the YouTube app or in the browser.
• Legal basis: Art. 6 (1) lit. a GDPR (consent by starting the video) in conjunction with sec. 25 (1) TDDDG
• Third-country transfer: as described in 6.5
• Info: https://policies.google.com/privacy

6.7 Push notifications (Expo, Apple, Google) – mobile app only, only after you allow them

• Purpose: Delivering push notifications (events, reminders, notices) to your device
• Services: Delivery runs via the push service of Expo (650 Industries, Inc., USA) and from there via your operating system’s push service – Apple Push Notification service (Apple Inc.) or Firebase Cloud Messaging (Google LLC)
• Data: Device token (Expo push token), platform, title and text of the notification (for example the title and time of an event) and technical delivery data
• Location: USA; the transfer is based on standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR. Apple Inc. and Google LLC are additionally certified under the EU-US Data Privacy Framework
• Note: You only receive push notifications if you allow them in the app or in your device’s system settings. You can switch them off there at any time.
• Info: https://expo.dev/privacy, https://www.apple.com/legal/privacy and https://firebase.google.com/support/privacy

6.8 Functional Software, Inc. (Sentry) – error reports

• Purpose: Recording technical errors and response times in the web app, mobile app and backend (section 3.8)
• Data: Error reports without personal details, see section 3.8
• Location: USA; data processing agreement with standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR
• Info: https://sentry.io/privacy/

6.9 Stripe Payments Europe, Ltd. (only for card payment, SEPA direct debit, Apple Pay or Google Pay)

• Purpose: Payment processing, management of recurring payments and customer portal
• Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland
• Data: Name, email address, billing address, amount and time of payment and the payment data; card details and IBAN are entered directly with Stripe and are not stored on our servers
• Role: Stripe processes payment data partly as an independent controller, for example for fraud prevention
• Third-country transfer: Transfer to Stripe, Inc. (USA) takes place on the basis of standard contractual clauses; Stripe, Inc. is certified under the EU-US Data Privacy Framework
• Info: https://stripe.com/privacy

6.10 sevdesk GmbH – invoicing

• Purpose: Creating and sending invoices for payment by bank transfer, bookkeeping
• Provider: sevdesk GmbH, Offenburg, Germany
• Data: Club name or name, billing address, billing email, contact person, invoice amounts and payment status
• Location: Germany; data processing agreement pursuant to Art. 28 GDPR
• Info: https://sevdesk.de/datenschutz/

6.11 Apple Inc. and Google LLC – in-app purchases (only when subscribing in the app)

• Purpose: Processing subscriptions taken out in the iOS or Android app
• Data: Apple or Google process the payment data as independent controllers under their own privacy policies. We receive a purchase confirmation with transaction identifier, plan, term and status, no payment data
• Info: https://www.apple.com/legal/privacy and https://policies.google.com/privacy

7. Data transfer

Personal data is only passed on to third parties:

• to the service providers named in section 6
• to Google as part of the advertising measurement described in section 6.5, provided you have consented
• where we are legally obliged to do so (e.g. by order of a court)

No transfer for advertising purposes beyond this takes place. In particular, the contents of your sheet music archive as well as account and usage data from the app are never transmitted to advertising networks.

8. Storage period

9. Cookies and local storage

9.1 Technically necessary storage (no consent required)

• Local storage (localStorage): JWT authentication tokens and the selected organisation are stored in the browser. This data is technically necessary for the functionality of the Service.
• Consent cookie na_consent: Stores your decision on the consent banner (value granted or denied, lifetime 6 months). Without this cookie we would have to ask you again on every page view. It is therefore necessary under sec. 25 (2) TDDDG and does not itself require consent. It contains no identifier that makes you recognisable.
• Audience measurement (Umami): sets no cookie and creates no entry in browser storage on its own. The only value read is umami.disabled. If your browser has “Do Not Track” enabled, we do not count you at all. Independently of that, you can exclude yourself permanently by running localStorage.setItem('umami.disabled', 1) in this page’s developer console — that entry stays in your browser and is never read out or transmitted by us. This applies equally on this website and in the web app; because browsers keep storage separate per domain, the umami.disabled entry has to be set separately on notenarchiv.com and on app.notenarchiv.com.

9.2 Cookies after consent (Google Ads, website only)

If you consent, Google Ads sets cookies to measure advertising performance:

These cookies are not set before you consent.

9.3 Withdrawal

You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. You can also delete cookies that have already been set in your browser settings. The lawfulness of processing carried out up to the withdrawal remains unaffected (Art. 7 (3) GDPR).

10. Rights of data subjects

Every data subject has the following rights:

• Access (Art. 15 GDPR): You can request information about the data we have stored about you.
• Rectification (Art. 16 GDPR): You can request the rectification of inaccurate data.
• Erasure (Art. 17 GDPR): You can request the erasure of your data, provided there are no statutory retention obligations. When your account is deleted, your club’s change log is pseudonymised: entries in which you acted or were affected then only show “Deleted account”.
• Restriction (Art. 18 GDPR): You can request the restriction of processing.
• Data portability (Art. 20 GDPR): You can receive your data in a common, machine-readable format.
• Objection (Art. 21 GDPR): You can object to the processing of your data.

To exercise your rights, please contact the email address named in section 1.

11. Right to lodge a complaint

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
https://www.ldi.nrw.de

12. Security measures

We take appropriate technical and organisational measures to protect your data:

• Encrypted data transmission (HTTPS/TLS)
• Passwordless login via WebAuthn/passkeys (phishing-resistant)
• Tenant separation (multi-tenant architecture with strict data isolation)
• Regular security updates
• Access controls and role-based permissions

13. Contacting us by email or contact form

If you contact us by email or via the platform’s contact form (name, email address, subject, message), your enquiry including all personal data resulting from it (name, email address, content of the enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

The processing of this data is based on Art. 6 (1) lit. b GDPR, provided your enquiry is connected with the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6 (1) lit. f GDPR).

14. Changes to this privacy policy

We reserve the right to adapt this privacy policy in order to bring it into line with changed legal situations or changes to the Service. The respective current version can be viewed on this page and in the app.