At a glance

This privacy policy covers the Drumbitious app (iOS and Android). For the website drumbitious.com, see the website privacy policy.

We do not sell your data and we do not show advertising.
Usage analytics, session recordings and crash reports only run if you agree. You can change this at any time in the app settings.
Analytics are not linked to your account.
Photos, audio, PDFs and videos you attach to exercises stay on your device. They are not uploaded to our servers.
Your practice data (plans, exercises, sessions, notes) is stored in Google Firebase with a storage location in the EU so that it is available across your devices.
You can delete your account and your practice data at any time in the app.

1. Controller and contact

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Verena Zaiser
Reichenbachstr. 17
70372 Stuttgart, Germany
Email: moc.suoitibmurd@troppus

For all questions about data protection and to exercise your rights, simply write to the email address above. We are not legally required to appoint a data protection officer and have not done so.

2. Legal bases

We process personal data only on the basis of the following legal bases:

Consent (Art. 6(1)(a) GDPR): e.g. usage analytics, session recordings and crash reports in the app. Where information is stored on or read from your device for this, § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. You can withdraw consent at any time with effect for the future.
Contract (Art. 6(1)(b) GDPR): everything needed to provide the app as described in our terms of use, e.g. your account, syncing your practice data and Premium subscriptions.
Legal obligation (Art. 6(1)(c) GDPR): e.g. statutory retention obligations.
Legitimate interests (Art. 6(1)(f) GDPR): e.g. the secure and stable operation of the app. Where we access your device for this, we rely on § 25(2) no. 2 TDDDG (strictly necessary for the service you requested).

You are not obliged to provide personal data. Without an account, however, we cannot sync your practice data, and without the store purchase data we cannot provide Premium.

3. The Drumbitious app

3.1 Account and sign-in (Firebase Authentication)

You can start using the app with an anonymous account, without providing an email address. In that case your data is stored under a random user ID. If you sign in or register, the anonymous account is converted into a regular account. Password reset emails are sent via Firebase.

Purpose: Creating and managing your account, signing in, resetting your password, assigning your practice data to you.
Data: User ID; depending on the sign-in method: email address and password (stored only as a hash by Firebase), or the email address, name and profile picture provided by Google (Sign in with Google), or a pseudonymous user ID from Apple (Sign in with Apple; we do not request your name or email address). Also technical data such as IP address, time of sign-in and device information.
Legal basis: Performance of the contract (terms of use), Art. 6(1)(b) GDPR
Recipient: Google Ireland Limited, Ireland; Google LLC, USA (processor). For Sign in with Google: Google; for Sign in with Apple: Apple Distribution International Ltd., Ireland.
Place of processing: EU and USA. Possible transfer to the USA; safeguards: see section 7.
Retention: Until you delete your account or the data, unless statutory retention obligations apply
Provider's privacy policy: firebase.google.com/support/privacy

3.2 Your practice data (Cloud Firestore)

Your practice data is stored in Google's Cloud Firestore database. A copy is kept on your device so that the app also works offline. Your practice notes are free text: please do not enter sensitive information (e.g. about your health) there.

Purpose: Storing your practice data and syncing it between your devices; providing the app's features (plans, sessions, statistics, reminders).
Data: Display name; your privacy choices in the app; practice reminder schedule (weekdays and time); practice plans (incl. the topic you enter), exercises (title, descriptions, BPM, duration, time signature, video links you add, names of attached files), practice sessions with date and time, practiced BPM and duration, your practice notes and how a session felt (e.g. “good”, “neutral”); creation and modification times.
Legal basis: Performance of the contract (terms of use), Art. 6(1)(b) GDPR
Recipient: Google Ireland Limited, Ireland (Firebase, processor).
Place of processing: Database location in the EU. Access by Google from third countries for support purposes cannot be ruled out; possible transfer to the usa; safeguards: see section 7.
Retention: Until you delete your account or the data, unless statutory retention obligations apply
Provider's privacy policy: firebase.google.com/support/privacy

3.3 Data stored only on your device

Images, audio files, PDFs and videos that you attach to exercises, as well as your PDF annotations and app settings, are stored only locally on your device. We do not upload them. Only the file names are saved with the exercise in your practice data. If you use the backup function, the app creates a ZIP file and opens your device's share menu; you decide where to save or send it.

The app only accesses your camera, photos or files when you actively choose to add an image or file. Notification permission is only used for your practice reminders.

3.4 Protection against misuse (Firebase App Check)

Purpose: Ensuring that requests to our backend come from a genuine, unmodified copy of the app, to protect your data and our services from misuse.
Data: An attestation token generated by your device's operating system (Google Play Integrity on Android, Apple App Attest / DeviceCheck on iOS), app identifier, technical device information.
Legal basis: Legitimate interests, Art. 6(1)(f) GDPR (security); § 25(2) no. 2 TDDDG.
Recipient: Google Ireland Limited / Google LLC; on iOS additionally Apple.
Place of processing: EU and USA. Possible transfer to the USA; safeguards: see section 7.
Retention: The tokens are short-lived and are not stored by us.
Provider's privacy policy: firebase.google.com/support/privacy

3.5 Exercise library (Supabase)

Purpose: Delivering the public exercise library (e.g. Discover, welcome plan) including images, sheet music and audio files.
Data: Only technical connection data (IP address, time, requested content, app information). No account data is sent to Supabase.
Legal basis: Legitimate interests, Art. 6(1)(f) GDPR (delivering content); Art. 6(1)(b) GDPR.
Recipient: Supabase, Inc., USA (processor).
Place of processing: Frankfurt, Germany (EU). Possible transfer to the USA; safeguards: see section 7.
Retention: Connection logs are deleted automatically by the provider after a short period.
Provider's privacy policy: supabase.com/privacy

3.6 Update check (GitHub)

Purpose: When the app starts, it downloads a small configuration file to check whether an app update is required.
Data: Technical connection data (IP address, time, app/device information in the request).
Legal basis: Legitimate interests, Art. 6(1)(f) GDPR (making sure you use a working and secure app version).
Recipient: GitHub, Inc., USA (a Microsoft company).
Place of processing: USA. Possible transfer to the USA; safeguards: see section 7.
Retention: We do not receive or store this data. GitHub's retention is described in its privacy statement.
Provider's privacy policy: docs.github.com/site-policy/privacy-policies/github-general-privacy-statement

3.7 Purchases and subscriptions (App Store, Google Play, RevenueCat)

Payments are processed exclusively by Apple or Google under their own terms and privacy policies. We use RevenueCat to check which subscription is active. We do not pass your email address to RevenueCat.

Purpose: Selling and managing Premium subscriptions, restoring purchases, checking your subscription status.
Data: Purchased product, purchase and renewal date, subscription status, store transaction IDs, country/currency, app and device information, a RevenueCat customer ID (for signed-in users your user ID, otherwise a random ID). We do not receive any payment details such as credit card numbers.
Legal basis: Performance of the contract (terms of use), Art. 6(1)(b) GDPR; for statutory retention Art. 6(1)(c) GDPR.
Recipient: Apple Distribution International Ltd., Ireland (App Store) or Google Ireland Limited, Ireland (Google Play) as the respective seller and payment provider; RevenueCat, Inc., USA (processor for managing subscriptions).
Place of processing: EU and USA. Possible transfer to the USA; safeguards: see section 7.
Retention: As long as you use the app and for as long as required by statutory retention obligations.
Provider's privacy policy: www.revenuecat.com/privacy

3.8 Crash reports (Sentry) — only with your consent

Purpose: Detecting and fixing errors and crashes.
Data: Error message and stack trace, device model, operating system, app version, a random installation ID, technical events before the error (e.g. which screen was open). No screenshots and no names, email addresses or practice notes.
Legal basis: Your consent, Art. 6(1)(a) GDPR; for access to your device additionally § 25(1) TDDDG. You can withdraw consent at any time in the app under Settings.
Recipient: Functional Software, Inc. (Sentry), USA (processor).
Place of processing: EU (Frankfurt, Germany). Possible transfer to the USA; safeguards: see section 7.
Retention: Error reports are deleted automatically after a maximum of 90 days.
Provider's privacy policy: sentry.io/privacy/

3.9 Usage analytics (PostHog) — only with your consent

Purpose: Understanding how the app is used (e.g. which features are used, where users drop off, how the paywall performs) so we can improve it.
Data: A random pseudonymous device ID, screens viewed, interactions (e.g. session started/completed, metronome used, Premium screen opened, purchase completed), technical information (device model, operating system, app version, language, approximate location derived from the IP address). The analytics are not linked to your account, and no content you type (e.g. notes or titles) is sent.
Legal basis: Your consent, Art. 6(1)(a) GDPR; for access to your device additionally § 25(1) TDDDG. You can withdraw consent at any time in the app under Settings.
Recipient: PostHog, Inc., USA (processor).
Place of processing: EU (Frankfurt, Germany). Possible transfer to the USA; safeguards: see section 7.
Retention: Until you withdraw consent or the data is no longer needed for analysis, at the latest after 24 months.
Provider's privacy policy: posthog.com/privacy

3.10 Session recordings (Microsoft Clarity) — only with your consent

Purpose: Seeing where the app is confusing or does not work as intended, by looking at masked recordings of how screens are used and at heatmaps.
Data: Masked recordings of the app screens (text and input fields are masked, so their content is not visible), taps and scrolls, screens viewed, session duration, device model, operating system, app version, a random Clarity ID. The recordings are not linked to your account.
Legal basis: Your consent, Art. 6(1)(a) GDPR; for access to your device additionally § 25(1) TDDDG. Covered by the same switch as usage analytics; you can withdraw consent at any time in the app under Settings.
Recipient: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.
Place of processing: USA. Microsoft is certified under the EU-US Data Privacy Framework; see section 7.
Retention: Recordings are deleted after 30 days, aggregated data such as heatmaps after 13 months at the latest.
Provider's privacy policy: privacy.microsoft.com/privacystatement

3.11 Feedback (Wiredash)

Purpose: Receiving and processing your feedback and bug reports; with your consent also basic usage statistics about app versions.
Data: (a) With analytics consent, when the app starts: a random installation ID, app version and build number, operating system and version, language. (b) When you open the feedback form: your message, optionally your email address, optionally a screenshot of the app that you can annotate before sending, plus device and app information. Opening the feedback form also transmits the information listed under (a).
Legal basis: (a) Your consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG. (b) Legitimate interests, Art. 6(1)(f) GDPR (processing the feedback you actively send us), § 25(2) no. 2 TDDDG.
Recipient: Wiredash GmbH, Turmstr. 28, 40789 Monheim am Rhein, Germany (processor).
Place of processing: According to Wiredash, data is stored on Google Cloud servers and processed in the USA. Safeguards: see section 7.
Retention: Feedback is deleted once it has been processed and is no longer needed, or earlier on request.
Provider's privacy policy: docs.wiredash.com/company/privacy

3.12 Feature voting (UserOrient)

Purpose: Letting you suggest and vote on new features.
Data: Your user ID, whether you have Premium, the feature requests, votes and comments you submit, and device information (device model, operating system, app version).
Legal basis: Legitimate interests, Art. 6(1)(f) GDPR (involving users in product development); the board is only loaded when you open it yourself.
Recipient: UserOrient (processor).
Place of processing: The provider does not specify a processing location; a transfer to countries outside the EU, including the USA, is possible. Safeguards: see section 7.
Retention: Until you ask us to delete it, or until the feature board is discontinued.
Provider's privacy policy: www.userorient.com/pp

3.13 Videos in exercises (YouTube, Vimeo and other hosts)

Purpose: Playing videos linked in an exercise. Usually these are links that you added to an exercise yourself.
Data: When an exercise with a video is displayed, the app loads the player or the video directly from the respective host. In doing so, your IP address, device information and the video watched are transmitted to the host; the host may store information on your device.
Legal basis: Art. 6(1)(b) GDPR (playing the content you requested); § 25(2) no. 2 TDDDG.
Recipient: The respective video host, e.g. Google Ireland Limited (YouTube) or Vimeo.com, Inc., USA (Vimeo). These providers are responsible for their own processing.
Place of processing: EU and USA, depending on the host. Possible transfer to the USA; safeguards: see section 7.
Retention: We do not store any of this data. The hosts' retention is described in their privacy policies.
Provider's privacy policy: policies.google.com/privacy

3.14 Practice reminders

Practice reminders are scheduled as local notifications on your device. We do not use push notifications. The reminder schedule is saved with your practice data (section 3.2) so it is available on all your devices.

3.15 App ratings and sharing

If you rate the app, the rating dialog of Apple or Google is shown; we do not receive any personal data from it. If you share content (e.g. a practice summary), your device's share menu is used, and you decide where the content goes.

3.16 Contact by email

Purpose: Answering your request (e.g. support, deleting your account, privacy requests).
Data: Your email address, your name if provided, and the content of your message.
Legal basis: Art. 6(1)(b) GDPR if your request relates to the use of the app; otherwise legitimate interests, Art. 6(1)(f) GDPR (answering inquiries); for privacy requests Art. 6(1)(c) GDPR.
Recipient: Our email provider, as a processor.
Place of processing: EU
Retention: Deleted once your request has been fully dealt with, unless statutory retention obligations apply.

4. Your privacy choices in the app

When you sign in for the first time, the app asks you to accept the privacy policy and terms and lets you choose separately whether you want to allow:

error reports (Sentry, section 3.8), and
usage statistics (PostHog, Microsoft Clarity and the Wiredash usage ping, sections 3.9 to 3.11).

Without your consent, none of these services is started. You can change your choices at any time in the app under Settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Your choices are stored on your device and with your account.

5. No sale, no advertising, no automated decisions

We do not sell personal data, we do not share it for advertising purposes, and we do not show ads. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

6. Retention and deleting your account

We store personal data only as long as necessary for the purposes described above, unless statutory retention obligations require us to keep it longer. The specific retention periods are listed with each service.

You can delete your account at any time in the app under Settings → Delete My Account. This deletes your account and the practice data stored with it. Data stored only on your device is removed when you uninstall the app. If you also want data held by our service providers (e.g. RevenueCat, PostHog, Sentry, Wiredash, UserOrient) to be deleted, or if you can no longer access the app, just send us an email.

Please note: deleting your account does not cancel a subscription. Subscriptions are managed in your App Store or Google Play account.

7. Transfers to countries outside the EU

Some of our service providers are based in the USA or may access data from there. We only transfer data to these countries if the requirements of Art. 44 et seq. GDPR are met:

For providers certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 applies (Art. 45 GDPR).
Otherwise, we use the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

You can request a copy of the safeguards used from us.

8. Your rights

Under the GDPR you have the right to:

access the data we hold about you (Art. 15),
have incorrect data corrected (Art. 16),
have your data deleted (Art. 17),
restrict processing (Art. 18),
receive your data in a common, machine-readable format (data portability, Art. 20),
withdraw consent at any time with effect for the future (Art. 7(3)),
lodge a complaint with a supervisory authority (Art. 77).

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal email to moc.suoitibmurd@troppus is enough. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

You can also contact the supervisory authority in the EU member state where you live or work.

9. Children

Drumbitious is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe that your child has given us personal data, please contact us and we will delete it. In some countries, young people need the consent of a parent or guardian to agree to optional processing (e.g. analytics); in the EU this can apply up to the age of 16.

10. Users outside the EU

We apply the standards of this privacy policy to all users worldwide, and we honour the rights described in section 8 regardless of where you live.

United Kingdom and Switzerland

You have essentially the same rights as described in section 8 under the UK GDPR and the Swiss Federal Act on Data Protection (FADP). You can lodge a complaint with the UK Information Commissioner's Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

United States

We collect the categories of data described in section 3 (identifiers, account information, app usage information, device information, purchase information and the content you create) for the purposes described there.
We do not sell personal information and do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.
Depending on the state you live in, you may have the right to know, access, correct, delete and obtain a copy of your personal information, and the right not to be discriminated against for exercising these rights. Just email us; we will verify your request using your account email address.
The app is not directed at children under 13 (Children's Online Privacy Protection Act, COPPA); see section 9.

Other countries (e.g. Brazil, Canada)

If local laws such as the Brazilian LGPD or the Canadian PIPEDA give you rights to access, correct, delete or port your data or to withdraw consent, you can exercise them in the same way by emailing us.

11. Security

We use technical and organisational measures to protect your data, in particular encrypted transmission (TLS/HTTPS) for all connections of the app, access restrictions in our database and the selection of reliable service providers with whom we have concluded data processing agreements.

12. Changes to this privacy policy

We update this privacy policy when the app or the legal situation changes. The current version is always available on this page; the date at the top shows when it was last changed. If changes require your consent, we will ask for it.

In case of doubt, the German version of this privacy policy (Datenschutzerklärung) shall prevail.