Privacy Policy

As of 27 September 2026. The German version is legally binding.

1. Controller

Dominik Steffan Music, Dominik Steffan, Georg-Schwarz-Str. 169, 04179 Leipzig, Germany. Privacy requests: datenschutz@timbremusic.app.

2. What Timbre does

Timbre measures music tracks (e.g. energy, tempo, genres, mood). Your music files stay on your device. Only tracks Timbre does not know yet are uploaded for measurement.

3. Hosting

Timbre runs on its own server at Hetzner Online GmbH in Germany. Measurements and account data are neither shared with third parties nor sold.

4. Audio files

Uploaded audio is processed solely for measurement and deleted immediately afterwards, at the latest 24 hours after upload – even if measurement fails. Audio is never stored, listened to or shared. Legal basis: Art. 6(1)(b) GDPR (contract).

5. Account

For your account we process an identifier, your e-mail address, whether it is verified, your quota and when you accepted the Terms and this policy (Art. 6(1)(b) GDPR). Sign-in is handled by our own identity service (Authentik) on the same server.

If you sign in with GitHub (GitHub Inc., USA) or Google (Google Ireland Ltd./Google LLC, USA), we receive your name, e-mail address and its verification status. Transfers to the USA are based on the EU-US Data Privacy Framework (Art. 45 GDPR). Their own processing is governed by their privacy policies.

6. Your library

For each track we store an acoustic fingerprint, the duration, the tags your app sends (artist, title, album, year) and the measurements. We do not store file paths.

7. Shared catalogue

Measurements are stored in a shared catalogue so other users need not upload the same track again. Only anonymous audio measurements are shared – never audio, never your tags, never who owns the track. You can turn sharing off in your account at any time; new analyses are then visible only to you. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an efficient service).

8. Deletion and export

You can delete your account at any time under "Account". All personal data is deleted. Measurements already shared remain in the catalogue without any link to you, as they are no longer personal data. You can also download all data about your account as a JSON file.

9. Server logs

To prevent abuse the server logs IP address, time and requested URL. Logs are deleted after 14 days (Art. 6(1)(f) GDPR).

10. Cookies

Timbre sets only one strictly necessary session cookie, and only once you sign in (§ 25(2) no. 2 TDDDG). There are no analytics, tracking or advertising cookies and no embedded third-party content.

11. E-mail

E-mails to addresses at timbremusic.app are forwarded via Cloudflare Email Routing (Cloudflare Inc., USA; EU-US Data Privacy Framework).

12. Donations

The donation link leads to PayPal. Timbre loads no content from PayPal; PayPal's terms apply only on PayPal's site.

13. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). Contact datenschutz@timbremusic.app. You may also lodge a complaint with a supervisory authority; the competent one is the Saxon Data Protection and Transparency Commissioner, Devrientstraße 5, 01067 Dresden, Germany.