Privacy Policy

As of 23 October 2026. The German version is legally binding.

This policy describes which personal data Timbre processes – on timbremusic.app (including the sign-up and sign-in pages) and through timbremusic, the desktop and iOS app –, for what purpose, on which legal basis and for how long.

1. Controller

Dominik Steffan Music, Dominik Steffan, Georg-Schwarz-Str. 169, 04179 Leipzig, Germany. Privacy requests: hello@timbremusic.app.

2. What Timbre does

Timbre measures music tracks (e.g. energy, tempo, key, genres, mood) and shows the measurements in your library. Timbre never stores music permanently: an audio file sits on the server only briefly for measurement and is deleted afterwards. What is stored are measurements, acoustic fingerprints, track names (artist, title, album, year) and – if you connect online storage – the file list of that storage.

Music reaches Timbre in two ways:

timbremusic matches the files on your computer against the catalogue. The files stay on your device; only tracks the catalogue does not know yet are uploaded for measurement, after you confirm (section 4).
If you connect online storage, Timbre reads files there for matching, analyses what the catalogue does not know yet at your request, and passes tracks through to you for playback (section 9).

The iOS app timbremusic uses your Timbre account and the same data as the website, and adds a native player, widgets, Siri shortcuts and CarPlay. The app itself collects no additional data, uses no third-party tools and sends only what the website sends. The app passes title, artist and cover of the track that is playing to iOS so that iOS can show them on the lock screen, in widgets and in CarPlay. What Apple processes when you download the app from the App Store is governed by Apple’s privacy policy.

The Mac app timbremusic also uses your Timbre account. It reads only the music folders and the Rekordbox XML you choose yourself. To match your library it sends, for each track, an acoustic fingerprint (a sequence of numbers from which the sound cannot be recovered), the duration, a random track ID created by the app and the tags it reads (for example title, artist, album, genre and comment) to Timbre, never file names or paths. It uploads an audio file only after you confirm it in the preview – then for analysis, like an upload through the website (section 4), together with file size, file extension and a checksum of the file. File paths and the link between track and file stay on your Mac.

3. Hosting and recipients

Timbre runs on its own server at Hetzner Online GmbH in Germany. Website, sign-in service, authorisation service, analysis and database all run on this server. Measurements and account data are not sold, not used for advertising and not shared with third parties – except as described in sections 5 (e-mails from the sign-in service), 7 (message about activation), 15 (e-mail) and 16 (donations).

E-mails from Timbre are sent through our mailbox at Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. Infomaniak processes the recipient address and the content of the e-mail on our behalf; a data processing agreement under Art. 28 GDPR is in place with Infomaniak as part of Infomaniak's terms of use. For Switzerland there is an adequacy decision of the European Commission (Art. 45 GDPR).

4. Audio files from the app

When the app uploads a track for measurement, the server first checks that the file matches the fingerprint sent with it and then places the file under a random name in the server's working folder (on disk). If the catalogue already knows the track, the file is deleted at once. Otherwise the file is measured and deleted right afterwards – also if measurement fails or you delete your account in the meantime. In addition, an hourly check deletes every file in the working folder that is older than 24 hours. Deleted means: the file is removed from the folder; the freed space is not specifically overwritten. Audio is never stored permanently, listened to or shared.

Each upload creates a job record with times, file size, status, if applicable the error text of the measurement, the fingerprint and the duration. The tags sent by the app (artist, title, album, year) stay with the job until measurement ends and then move into your library. Job records stay with your account until you delete the account and are part of the data export. Legal basis: Art. 6(1)(b) GDPR (contract).

Sign-in service. For registration and sign-in we run our own sign-in service (Ory Kratos, open-source software) on our server in Germany; its pages live on timbremusic.app. The sign-in service stores in a separate database: your e-mail address and its confirmation status, the language for e-mails, a display name (only if you enter one), the sign-in methods of your account (below), the time of your agreement to the Terms and this policy together with the versions, where applicable the flag for a personal invitation, your sessions (time of sign-in, methods used, device and browser as reported by your browser's user agent, IP address) and the e-mails the service sends you (below, “E-mails from the sign-in service”).

Authorisation service. For signing in to Timbre itself and to timbremusic we also run our own authorisation service (Ory Hydra, open-source software) on the same server. The authorisation service stores when you signed in to which Timbre application, your account identifier, your e-mail address, whether the address is confirmed, your language, the time and type of your sign-in, and the access keys (tokens) an app uses for you. Access tokens are valid for at most 15 minutes, refresh tokens for at most 30 days; a daily job deletes expired entries after another 7 days. When you sign out, use “Sign out everywhere else”, switch on account protection or delete your account, we revoke these tokens right away. For Timbre's own applications the authorisation service does not ask for separate consent; there are no other applications.

Registration. An account is only created with a confirmed address: you enter your address and confirm it with a code we send to that address. You add a passkey or a password only afterwards. If the address already has an account, Timbre shows the same page as for a new address and sends the address an e-mail “You already have an account – sign in with this code”; this way registration does not reveal whether an address is registered at Timbre. A job deletes a new account whose address was never confirmed after 7 days.

Sign-in methods. You use one or more:

E-mail code: we send you a six-digit code valid for 15 minutes. The sign-in service checks the code against a hash; the e-mail itself (with the code) is also kept in the delivery log (below).
Passkey: your device creates a key pair. The private key stays on your device or in your password manager; we store the public key, a key identifier, the device-type identifier your device sends (AAGUID – this identifier may reveal which kind of device or password manager you use), a name (e.g. “MacBook · Safari”) and timestamps. We never receive your fingerprint, face or device PIN – that check happens on your device only.
Password (optional): we only store a hash of the password, never the password itself.

Same answers during sign-in. So that sign-in and registration look the same for known and unknown addresses, our server keeps during the code step for at most 1 hour: a keyed hash of the identifier of this sign-in attempt (HMAC with a secret key), the address entered and the number of tries. We delete the entry afterwards.

Second factor (optional). You can protect your account further:

Authenticator app (TOTP): we create a secret key that you transfer to your app via QR code, link or copying. The sign-in service stores the key while the app is connected. You choose the app yourself; the app sends us no data – you only enter the six-digit codes.
Recovery codes: twelve one-time codes in case your device is gone. We store the codes only as hashes and remember which were used. The codes are shown once during setup; the download file is created by your browser and does not pass through our server.
A passkey also counts as a second factor.

For this Timbre stores with your account: whether and since when the protection is switched on, and at which step you paused the setup. With the protection switched on, we ask for the second factor after a sign-in by e-mail code or password. For Timbre's administration the protection is mandatory.

Agreement at registration. With the required checkbox you agree to the Terms and this policy. Our server checks the checkbox when the account is created; the sign-in service stores the time (server time) and the versions of the Terms and this policy. When Timbre takes over this time is described in section 6.

E-mails from the sign-in service. Codes and notices (registration, sign-in, address confirmation, account recovery) are sent by the sign-in service through our mailbox at Infomaniak (section 3). Each e-mail is then kept in full in the sign-in service's delivery log: recipient, subject and text with the code in plain text, plus the data the e-mail was built from – a copy of your account at the sign-in service at the time of the e-mail (including address, confirmation status, language, internal identifier) – and the headers of the request that triggered the e-mail (including your browser's user agent). A code is valid for only 15 minutes and only once; the entry nevertheless stays readable until it is deleted. A separate job deletes these entries after 24 hours. If you delete your account, we delete the entries for your address right away.

Protection against too many e-mails. To prevent anyone from triggering masses of e-mails through Timbre, our server counts code requests: per address and per network the request comes from (IPv4 address, for IPv6 the network parts /64 and /48). For this it stores only a keyed hash (HMAC with a secret key) of the address or network and the time, for at most 24 hours. In addition we count how many e-mails go out in total per hour and per day – only time and type of e-mail, without reference to any person, for at most 24 hours.

Protection against too many attempts, and logs. If there are too many requests to the sign-in pages from the same network within a short time, our web server temporarily rejects them; for this the web server keeps the IP address (for IPv6 the network part) in memory. You can enter a code at most five times per sign-in attempt. Our web server logs requests to the sign-in pages with IP address, time, requested page, status code and amount of data (without parameters, form contents and sign-in attempt identifiers); we delete these logs after 7 days. The sign-in and authorisation services log too, but only warnings and errors (without form contents, codes or tokens; an IP address or user agent may appear); we clear these logs after 7 days at the latest.

Purpose and legal basis. We need registration, sign-in, sign-in methods, the second factor, sessions, app tokens and the sign-in service's e-mails to provide your account and keep the account secure: Art. 6(1)(b) GDPR (contract or steps prior to a contract at your request). We process IP addresses in sessions, logs and limits for too many attempts, the count of code requests, the same answers during sign-in, the delivery log and the block list after deletion (section 12) to prevent abuse and to investigate delivery problems: Art. 6(1)(f) GDPR (legitimate interest in a secure service).

Retention. Sign-in methods, second factor, address, display name and agreement are kept as long as your account exists; a removed passkey, a disconnected authenticator app or replaced recovery codes are deleted immediately. Sessions end at the latest 14 days after last use, at the latest 90 days after sign-in, or when you sign out; a daily job deletes expired sessions and expired sign-in attempts after another 7 days. App tokens: see “Authorisation service”. A separate job deletes the delivery log (e-mails including codes) after 24 hours, and immediately when the account is deleted.

Device names and sessions are shown in your account under “Account and security”; there you can remove passkeys, disconnect the authenticator app, regenerate recovery codes and sign out devices. We show no location there and do not determine one.

Moving existing accounts. With this version (date at the top) we moved from our previous sign-in service (Authentik, also on our server) to the new one. We transferred all existing accounts, including those with a still unconfirmed address, and for each: e-mail address, confirmation status, language, where applicable the invitation flag, and the previous identifier (so your Timbre account stays linked). We did not transfer passwords. Activation, agreement, quota and library stay unchanged. If your address was not confirmed yet, the first code you sign in with confirms the address. We informed all accounts about the move by e-mail beforehand. A timbremusic installation still signed in with the previous sign-in service keeps working until the previous identifier is removed. We delete the previous identifier 4 weeks after the move, in Timbre and at the sign-in service; we also delete the previous sign-in account 4 weeks after the move. Legal basis: Art. 6(1)(b) GDPR (contract).

6. Your Timbre account

On your first sign-in Timbre creates your account. For it we store: the identifier from the sign-in service, your e-mail address, whether the address is confirmed, when the account was created and when you last accessed it, your quota (analyses used and, if applicable, an individual limit), whether you share your analyses (section 10), your chosen appearance, the activation state (section 7), the state of account protection (section 5) and which version of the Terms and this policy you agreed to and when. Legal basis: Art. 6(1)(b) GDPR (contract).

Agreement from registration

Timbre takes over the time at which you agreed with the required checkbox at registration (section 5) only once your account is activated, and only if that time falls into the period in which the versions of the Terms and this policy then in force apply and lies no more than 25 hours before your Timbre account was created. Timbre then stores both versions and this time. Otherwise Timbre asks you once more, explicitly, after activation, and the time of your click applies. Timbre also asks again when there is a new version of the Terms, and tells you what changed.

When you delete your account, Timbre keeps a marker for 50 hours: a hash (SHA-256, not reversible) of your identifier from the sign-in service and the time of deletion – no e-mail address and no identifier in plain text. Purpose: agreement given in an earlier registration should not count for a newly created account. Since we also delete your account at the sign-in service when you delete your account, and a new account there gets a new identifier, the marker is only an additional safeguard. After 50 hours the marker no longer has any effect and is deleted at the next clean-up. Legal basis: Art. 6(1)(b) and (f) GDPR (proof of which terms you agreed to).

7. New accounts

Timbre activates a new account automatically as soon as your e-mail address is confirmed, and gives the account a quota of analyses. We review an account by hand in two cases only: when the daily limit for new accounts has been reached (the account then waits until Timbre activates it automatically later or we do so by hand), and when we block an account afterwards. While an account is waiting or blocked you can sign in, read the help and legal pages, use the live demo, download your data, disconnect online storage you already connected and delete your account; everything else is locked. A new account waiting for activation holds only the data listed in section 6 – without agreement yet – and the language in which you saw the waiting page.

For the decision we store the state (waiting, activated, not activated), the time of the decision and, where applicable, a short internal note (at most 500 characters). Each decision is also recorded in a log: when which admin account activated, did not activate or put back which account, with the e-mail addresses of both accounts, the note and the status of the message about it (below). A changed analysis limit is recorded there as well, and so are the steps Timbre takes by itself (below).

Purpose: the quota, the daily limit and the option to block an account protect the service against abuse and limit the computing time spent on analyses. Timbre only ever activates automatically; whether an account is not activated or is blocked is decided by a human. There is no automated decision-making within the meaning of Art. 22 GDPR. Timbre applies three rules by itself: a new account with a confirmed e-mail address is activated as long as the daily limit has not been reached. An account created through a personal invitation is activated immediately. And an account created again under an address or identifier that was already rejected takes over that decision (next paragraph). Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract at your request) and Art. 6(1)(f) GDPR (legitimate interest in an orderly, secure launch and in traceable decisions).

Record after a rejection. If we did not activate an account, or withdrew an activation, and you then delete the account, we keep a record: a keyed hash (HMAC-SHA-256 with a secret key that is not stored in the database) of your e-mail address (in lower case) with the time of the decision, and in addition a hash (SHA-256, not reversible) of the identifier from the sign-in service with the time of the decision and the internal note – no e-mail address and no identifier in plain text. If you create a new account with the same address, the new account starts as not activated. Purpose: a decision should not be avoidable by deleting the account and registering again. We delete the record at the latest 12 months after the decision. Legal basis: Art. 6(1)(f) GDPR. You can object to this storage (Art. 21 GDPR); write to hello@timbremusic.app.

Online storage and uploads. Timbre does not use the online storage credentials of an account that is not (or no longer) activated; matching rests, and queued analyses from the storage are cancelled. Uploads of such an account are not measured and are deleted after 24 hours (section 4).

Notification. When we activate your account by hand or decide not to, Timbre sends you an e-mail about it – only to a confirmed address, in the language in which you saw the waiting page (otherwise in German and English). The internal note is never part of the e-mail. About new accounts waiting for activation, Timbre's administration receives a summary e-mail with the e-mail address, time of creation and confirmation status of each account. Both e-mails are sent through our mailbox at Infomaniak (section 3). You also see the state of your account after signing in. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract at your request).

Deletion. If you delete your account, we delete state, time and note along with the account – except for the record after a rejection. The log keeps the time, the type of decision, the account number and the note so that decisions remain traceable; we remove the e-mail addresses from it. There is currently no fixed period after which these log lines are deleted. An account that was not activated remains with the data listed above until you delete the account. The internal note is not part of the data export; we disclose it on request (Art. 15 GDPR).

8. Your library

For each track in your library we store: an identifier assigned by the app or the online storage, the link to the track in the catalogue (with acoustic fingerprint, duration and measurements), the names from the tags (artist, title, album, year) and when the track was added. For matching, the app sends fingerprint, duration and tags for each track. We do not store file paths from your computer. For online storage you connect yourself we store the paths, because Timbre could not find the files there otherwise (section 9). You can remove tracks from your library at any time. Legal basis: Art. 6(1)(b) GDPR (contract).

Rekordbox import

When you take over data from Rekordbox, your browser reads your Rekordbox XML file on your device. The file is not transmitted to us. Only values for the tracks we could match to your library are transmitted to us and stored in your account: the track’s identifier in Rekordbox, cue points (kind, number, time, colour, name), beatgrid start, tempo and key from Rekordbox, plus counters of the import without names (for example how many tracks were matched). Only if you expressly select it do we additionally store play count, rating, colour and comment. We do not store file paths, folder, device or user names, or tracks without a counterpart in your library. The purpose is showing these values in Timbre (cues on the track page, the “Disagreements” list, filters). Legal basis is Art. 6(1)(b) GDPR (contract); for the expressly selected details Art. 6(1)(a) GDPR (consent), which you can withdraw at any time with effect for the future by deleting them under “Import → Rekordbox”. A new import replaces all Rekordbox data taken over before; your verdicts in the “Disagreements” list stay. The data stays stored until you delete it or your account. Only if you expressly agree in the “Disagreements” list (Art. 6(1)(a) GDPR) do we use your verdicts on differing tempo and key values without track names and without reference to your account to improve our measurement; if you untick the box, they are no longer used.

9. Online storage

You can connect your own online storage (WebDAV, e.g. a NAS or a cloud). This is optional. Whoever operates your storage processes the data there under their own responsibility. Timbre only reads your storage; nothing there is written, moved or deleted. Paths, file names and credentials stay with your account and go neither into the shared catalogue nor to other accounts. Legal basis for everything in this section: Art. 6(1)(b) GDPR (contract); for the counters against abuse Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Connecting and credentials

We store the address of the storage, the username, the password, the start folder and the type of listing. The password is kept in the database only in encrypted form (AES-256-GCM); the key is kept separate from the database. The password appears in no response, no data export and no log. Before connecting, Timbre tests the connection; the test result (without the password) is kept in the server's memory for up to five minutes.

Matching

Timbre regularly matches your storage against the catalogue and adds recognised tracks to your library. For this we store the file list of the audio files with path, size, modification date and file version identifier (ETag), per file the matching result, the number of attempts and the time of the last check, plus the state of matching (status, counters, times, if applicable a note about an error, and the position where the next run continues). Timbre fetches the beginning of each file, in individual cases the whole file, computes the acoustic fingerprint from it and discards the data immediately. The fetched data is held only in the server's memory, not on disk. Timbre takes the names of a recognised track from the file's tags; if the title is missing, the file name is used.

Analysing unknown files

Timbre analyses files the catalogue does not know yet only if you start this: with the button “Analyse unknown files” or by switching on “Analyse new files automatically from now on” (default: off). Without that click Timbre fetches only the beginning of such files for matching.

The click only queues the files at first. After that the server fetches the queued files one by one, each in full, from your storage – a file only shortly before its measurement is due. The copy sits in the server's working folder (on disk) for the duration of the measurement, under a random name unrelated to your file name, and is deleted right after the measurement – also if the measurement fails, if you cancel, disconnect the storage or delete your account. Large WAV and AIFF files are first converted losslessly to FLAC by the server; that version is deleted in the same way. If an attempt fails, the server fetches the file again, three times at most. Across all accounts at most two fetched files wait for measurement, one per account. If a fetched file waits longer than two hours, the copy is deleted and the file is fetched again later; if a measurement hangs for more than 90 minutes, the measurement is cancelled and the copy deleted. When the service starts and continuously during operation, the server removes every copy that does not belong to a running measurement.

What is stored is the same as for an upload from the app: fingerprint, duration and measurements of the track, plus artist, title, album and year from the file's tags in your library. If artist and title are missing from the tags, Timbre takes both from the file name – but only if the file name clearly has the form “Artist - Title”. Per file, Timbre also keeps whether and since when the file is queued, how often fetching was attempted and, if applicable, why the analysis failed (for example “too large”). Each analysis has a job record as for an upload (section 4), with an identifier derived from the path instead of the path itself. The analysis counts against your quota; if the measurement fails or you cancel, it is not counted. “Cancel analysis” withdraws everything queued and switches automatic analysis off.

Playback

When you play a track from your online storage, the server fetches the file from there and passes the data on to your browser or your app in the same moment. The file is neither stored nor cached on the server: none of it is written to a disk, and once the transfer ends, none of it remains. Formats your browser cannot play (AIFF, for example) and the data saver version for mobile use are converted by the server while passing them through – again without storing the file. The credentials of your storage never leave the server; your browser only talks to Timbre.

Timbre does not record which tracks you listen to, when, or how often. There is no log and no statistic about it; the web server does not write these requests to its logs either (section 13).

To prevent the pass-through from being abused as a download service, the server counts how many transfers an account and an IP address have open at the same time and how much data was passed through in the last hour and the last day. These counters contain no titles, file names or paths, live only in the server's memory, reach back 24 hours at most and are gone after a restart. For AIFF and WAV files the server also remembers the layout of the file for up to 24 hours (sample rate, channels, position of the audio data – numbers only, no audio, no file name), again only in memory. If an account exceeds a limit, the server writes one line with the account number and the kind of limit to the operations log.

Disconnecting

With “Disconnect” we immediately delete credentials, file list, matches, the tracks from the storage in your library, queued items and job records of analyses from the storage, as well as fetched files. The same happens when you delete your account.

10. Shared catalogue

Measurements of a track are stored in a shared catalogue so that others need not analyse the same track again. Only audio measurements and the acoustic fingerprint are shared – never audio, never your tags, file names or paths, never who owns the track. You can turn sharing off in your account at any time; new analyses are then visible only to you and are deleted along with your account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an efficient service).

11. Sound search and export

When you search the sound search with a text, the text goes to a service on the same server that computes the search from it. The search text is not stored; the web server does not write sound search requests to its access log.

Exports of your library (Rekordbox XML, M3U8, JSON, CSV) are generated by Timbre on request from your library data and sent straight to your browser. Timbre does not store the export file. For tracks from online storage an M3U8 contains the path of the file relative to the start folder; paths and playlist names do not end up in the log. Legal basis: Art. 6(1)(b) GDPR (contract).

12. Deletion and data export

You can delete your account under “Account” at any time, also while the account is waiting for activation. We then delete your Timbre account with its library, job records, unshared analyses and all online storage data; files still in the working folder are deleted.

We also delete everything at the sign-in service: address, display name, sign-in methods (public keys of your passkeys, password hash), second factor (authenticator app key, recovery codes), agreement, sessions and the entries for your address in the delivery log (e-mails including codes) – and at the authorisation service all sign-ins and tokens of your apps. To do so we first lock the account at the sign-in service, then delete the data in Timbre and then the account at the sign-in service and the sign-ins at the authorisation service. If one of these steps fails technically, we retry the step for up to 7 days, keeping only the internal identifier of the account at the sign-in service (and, while e-mails remain to be deleted, the address). You remove the passkey on your device and the entry in your authenticator app yourself; we have no access to them.

Only the following remains:

measurements already shared in the catalogue, without any link to you, as they are no longer personal data (section 10);
the agreement marker for 50 hours (section 6);
where applicable, the record after a rejection and the activation log lines without e-mail addresses (section 7);
for 31 days (the longest token lifetime plus one day) a keyed hash (HMAC) of the internal identifier on a block list, so that an app with an old token cannot recreate the deleted account – without address or any other data.

You can download all data about your account as a JSON file at any time, also while your account is waiting or was not activated. The export contains the account details (including activation state and time, the remembered language and the time of your agreement), your library, your job records and the online storage data (address, username, start folder and file list – without the password). The sign-in methods are not part of the export; you see them in your account under “Account and security”.

13. Logs

Web server. To prevent abuse, the web server logs for each request the IP address, time, requested URL, status code, amount of data transferred, the referring page and your browser's user agent; errors are logged with IP address, time and requested URL in an error log. Sound search requests do not appear in the access log, playback requests appear in neither the access nor the error log. Logs are deleted after 14 days. Requests to the sign-in pages are logged without parameters in a separate log that we delete after 7 days (section 5). The front server that accepts the connections keeps no access log for timbremusic.app; warnings there contain neither IP address nor requested URL and are likewise deleted after 14 days.

Operations log. Timbre's services write errors and operating events to an operations log – without file names, paths, credentials or search texts and without recording who listens to what. An entry may name an account number and the kind of an error, and for an unexpected error also the requested URL without parameters. The central log analysis deletes these entries after 14 days.

Uploads. For uploads (Timbre storage and analysis) the server writes one line per request to the operations log: time, kind of request without parameters, status code, error code, duration, amount of data transferred, a shortened pseudonym of the account and a shortened upload identifier – no IP address, browser identifier, file names, paths or checksums. For other requests this applies to errors only. Playback and sound search requests are not included here either. These lines help us find upload errors and are deleted after 14 days.

Counters against abuse. To limit requests, the server counts requests per IP address and per account in short time windows. These counters live only in memory and are gone after a restart. Sign-in has its own counters (section 5).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

14. Cookies and browser storage

Timbre sets only one strictly necessary session cookie (“timbre”), and only once you start signing in or registering. The cookie holds your sign-in (identifier, e-mail address, whether the address is confirmed, chosen language, time of agreement from registration, where applicable the invitation flag, when the sign-in was last checked and whether you signed in with a passkey or second factor), lasts at most 14 days and is cleared when you sign out. The sign-in and authorisation services (section 5) set their own, likewise strictly necessary cookies on timbremusic.app: the session at the sign-in service, the sign-in at the authorisation service (both for as long as the session, section 5) and cookies to protect the forms during sign-in. If you pick a language at the top of the page, Timbre remembers that choice even without signing in, in a cookie (“timbre_sprache”, only the language code such as “it”, 12 months). It is only set when you actively pick a language and is not passed on to anyone. After you sign in, Timbre also remembers in a further cookie (“timbre_geraet”, a random value and checksum, no address and no identifier in plain text, at most five accounts per browser, 400 days) that your account has signed in in this browser before – so Timbre can send a security email when you sign in on a new device (section 15). Legal basis: § 25(2) no. 2 TDDDG. There are no analytics, tracking or advertising cookies and no embedded third-party content.

Your browser remembers some settings on your device. This information is not sent to the server:

in the browser's persistent storage (localStorage): the chosen appearance (timbre.erscheinungsbild), the player's “Data saver” choice (timbre.player.sparsam), the player's volume (timbre.player.laut, only the value in dB), the player's gain choice (timbre.player.gain: Auto Gain on or off, target loudness, trim in dB), which meter you chose in the big player (timbre.player.pegelart: LED or VU), whether the gain panel in the big player is open (timbre.player.gainoffen) and the threshold of the genre view (timbre.genres.schwelle);
in the browser's session storage (sessionStorage), which disappears with the tab: the player's current track, position, queue, mute and tempo (timbre.player), the state of the status display (timbre.status), reference values of your library for the sound profile (timbre.stuetz) and a note of the genre view (timbre.genres.neu). When you sign out, Timbre clears the player and status display entries.

Live demo. At timbremusic.app/demo you can try Timbre without an account: a library of freely licensed example tracks (CC0 or CC BY, attribution at /demo/credits). The live demo sets no cookies and creates no session; only if you pick a language does the language cookie above apply. In the live demo, your Tag List stays in your browser only (localStorage, timbre.demo.taglisten) and is not sent to the server. Playback follows the same rules as playback from online storage (section 9): the server only passes the tracks through, does not record who listens to what, and, to prevent abuse, counts per IP address and in total how many transfers are open at once and how much data was passed through in the last hour – in memory only, without titles, gone after a restart. The live demo's read requests also have a counter per IP address and minute, likewise in memory only. Playback requests appear in neither the access log nor the error log (section 13). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting Timbre without an account and operating it securely).

15. E-mail

E-mails to addresses at timbremusic.app are forwarded to our mailbox via Cloudflare Email Routing (Cloudflare Inc., USA). The transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR). We use your message only to answer your request (Art. 6(1)(b) or (f) GDPR).

Timbre sends e-mails itself, only through our mailbox at Infomaniak (section 3), from hello@timbremusic.app, as plain text and, for notifications, additionally as simple HTML without images or tracking pixels:

codes and notices from the sign-in service (section 5);
the message about the activation decision and the summary e-mail to the administration (section 7);
one-off notices to all accounts about significant changes, such as the move of the sign-in service (section 5);
warnings to the administration when unusually many e-mails go out – without data about individual accounts.

Timbre only sends advertising with your explicit consent (the “News” notification, below). To prevent anyone from triggering masses of e-mails through Timbre, there is a limit per hour and per day (section 5). Legal basis: Art. 6(1)(b) GDPR (contract), for the warnings Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Notifications

Under Account → Notifications you choose what Timbre tells you about by email. The emails only go to your confirmed address and come in the language you use Timbre in.

Analysis done (on by default): one email when an analysis of your tracks is through – with the number of measured and unreadable files. One email per run, never one per track.
New tracks in your storage (off): after a sync of your online storage that found new files; at most one email a day.
Weekly recap (off): Mondays, at most once a week – how many tracks were newly measured, how many are new in your library and how many Tag Lists you edited.
Security (always on): when your account signs in on a device Timbre doesn’t know yet, and when your sign-in methods change (passkey, authenticator app, recovery codes, password, connected service, strict protection). These emails can’t be switched off because they warn you about a takeover of your account.
News from Timbre (off): new features – only if you tick the box yourself.

For these emails we process your email address, your choice per kind, your account language and the numbers in the email. Per email we only log kind, time and result (sent, error, held back by the sending limit) – without address and without content – and delete these entries after 90 days. For “News” we also store when you gave consent so we can prove it (Art. 7(1) GDPR).

Legal bases: analysis done, new tracks in your storage and weekly recap are part of the service you use (Art. 6(1)(b) GDPR); you can switch them off at any time. Security emails protect your account and our service (Art. 6(1)(f) GDPR, Art. 32 GDPR). News is only sent with your consent (Art. 6(1)(a) GDPR, Sec. 7(2) no. 2 German UWG). You can withdraw consent at any time – with the tick in your account or the “unsubscribe” link at the bottom of every email; withdrawal applies to the future.

Unsubscribing: every email except security emails has a link that unsubscribes you from exactly that kind – without signing in. Mail apps that support it also show their own button (one-click unsubscribe per RFC 8058). Your choice and the log are deleted with your account; the data export in your account contains both.

16. Donations

The donation link leads to PayPal. Timbre loads no content from PayPal; PayPal's terms apply only on PayPal's site.

17. Retention at a glance

Audio from the app: deleted after measurement; an hourly check deletes anything older than 24 hours.
Audio from online storage during matching: held in memory only while the fingerprint is computed.
Audio from online storage during analysis: deleted after measurement; waiting time at most two hours, measurement at most 90 minutes.
Playback: nothing stored; counters and file layout in memory for at most 24 hours.
Account, library, job records, agreement: until you delete your account.
Account at the sign-in service (address, sign-in methods, second factor, agreement): until you delete your account; a new account whose address was never confirmed: 7 days.
E-mail code: valid for 15 minutes.
Delivery log of the sign-in service (e-mails including codes): 24 hours, immediately when the account is deleted.
Count of code requests and of e-mails sent: 24 hours.
Entry for the same answers during sign-in: 1 hour.
Sessions at the sign-in service: at the latest 14 days after last use, at the latest 90 days after sign-in; then deleted after another 7 days, as are expired sign-in attempts.
App tokens: access tokens 15 minutes, refresh tokens 30 days; then deleted after another 7 days.
Retry when deleting (internal identifier, where applicable the address): at most 7 days.
Block list after deletion (hash of the internal identifier): 31 days.
Agreement marker after deletion: 50 hours.
Record after a rejection: at most 12 months after the decision.
Activation log: without e-mail addresses after the account is deleted; no fixed period at present.
Previous identifier and previous sign-in account from before the move: 4 weeks after the move.
Web server logs of the sign-in pages and logs of the sign-in and authorisation services: 7 days.
Other web server logs and central analysis of the operations log: 14 days.
Session cookie: at most 14 days.
Language cookie: 12 months after your last choice; you can delete it in your browser at any time.
Shared measurements in the catalogue: indefinitely, without any link to you.

Deleted data may still be contained in the server's backups until those backups are overwritten in the regular cycle.

18. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). Contact hello@timbremusic.app. You may also lodge a complaint with a supervisory authority; the competent one is the Saxon Data Protection and Transparency Commissioner, Devrientstraße 5, 01067 Dresden, Germany.

19. Changes to this policy

We update this policy when Timbre changes. The current version is always available at timbremusic.app/datenschutz; the date at the top shows when it was last updated.