Deutsche Fassung · English
This notice exists in German and in English. Both versions say the same; the German one is at paintmusic.app/legal.
This notice covers everything on paintmusic.app — this public page, the landing page, and the app behind it.
Angaben gemäß § 5 DDG
Diensteanbieter
Kontakt
E-Mail: privacy@paintmusic.app
Verantwortlich für den Inhalt (§ 18 Abs. 2 MStV)
Clemens Eckstein, Anschrift wie oben.
Markenhinweis. iReal Pro ist eine Marke der Technimo LLC, in den USA eingetragen. Paint Music ist ein unabhängiges Produkt und steht mit ihr in keiner Verbindung; sie wird hier ausschließlich beschreibend genannt, um das unterstützte Dateiformat zu bezeichnen.
Zur Teilnahme an einem Streitbeilegungsverfahren vor einer Verbraucherschlichtungsstelle sind wir nicht verpflichtet und nicht bereit.
The controller under the GDPR is the provider named above. For anything to do with your data, write to privacy@paintmusic.app.
Your settings (mix, comping, tempo, the piece you last opened, view profiles) live in your browser's localStorage, and everything you make — your practice log, your own exercises, your lick cards and the charts you import — in its IndexedDB. All of it is written to the device first, which is what lets the app work offline. Without an account, none of it leaves the device. With one, it is synchronised so it reaches your other devices — see Sync. The one exception without an account is a crash report — see Crash reports.
An exercise — and equally a written line you save — can carry a link to a YouTube video. What is stored is the video’s identifier — eleven characters — in the exercise or the card itself, so it travels wherever that travels: to your own other devices, and into a share link you hand to someone. Nothing is loaded from YouTube when the exercise, the card or a shared link opens. You see a plate drawn by this app, with a play button and a plain link; no preview image, no script, no cookie. Press play and the video is embedded from youtube-nocookie.com — at that moment, and only then, Google receives your IP address and browser details, also in the USA, may set cookies and, if you are signed in to Google, can link the request to your account; its own privacy notice applies to what happens there. Not pressing it costs you nothing, and the plain link opens the video on YouTube instead.
For a tune you imported yourself you can store a Spotify link, so the recording can play in the background while you analyse the piece. What is stored is the track’s identifier — twenty-two characters — in the tune itself, so it travels wherever that travels: to your own other devices. Nothing is loaded from Spotify when the exercise opens. You see a plate drawn by this app, with a play button and a plain link; no cover image, no script, no cookie. Press play and the track is embedded from open.spotify.com — at that moment, and only then, Spotify receives your IP address and browser details, may set cookies and, if you are signed in there, receives the link to your account; its own privacy notice applies to what happens there. Not pressing it costs you nothing, and the plain link opens the track on Spotify instead. Some tunes arrive with such an identifier already: it comes from a list shipped with the app, is not part of your data, and only becomes yours if you enter one yourself.
Besides what is named under “On your device”, the app puts four more things on your device or hands them to it. First, a cache (service-worker cache) so that it starts without a network: the app itself with its fonts and, once they have been loaded, the instrument sounds, the collection of standards shipped with the app and the texts on individual standards. Nothing you made is in it. Second, once you have signed in, in localStorage the time of your last confirmed sign-in and your account identifier at Clerk — so that the installed app opens without a network and shows your account's data; both are removed as soon as Clerk reports that you are signed out. Third, only after your consent, the identifier of the usage measurement — see Usage measurement. Fourth, while a piece is open the app hands its title and key, and the names of the running exercise and the chosen view, to your browser, so that your device can show them on the lock screen and in its playback controls; anyone looking at your locked device can read them there, and none of it reaches us. What is stored on the device stays there after you sign out and after you delete your account — the sign-in identifier excepted — until you clear the site data in your browser; the app has no button of its own for that.
This page, the landing page and the blog set no cookies and embed no third-party service. To find out whether they work, the bare name of an event — a word such as view or share_mail — is sent to our own server when a page opens or a link is clicked. No IP address, no browser fingerprint, no identifier of any kind is stored with it, and the names come from a fixed list; the timestamp is coarsened to the hour. There is nothing there to trace back to a person, which is why these pages have no consent banner.
Under each article there are links that hand the article on — by e-mail, or to WhatsApp or Reddit. Nothing is loaded from those services until you click; the links carry no tracking parameters, and they are marked so that the page you came from is not passed on to them. Clicking one takes you to that service, where its own terms apply. The “Share” button, where your device offers one, hands the address to your own operating system — it reaches us no more than the others do.
During the private beta the app is opened with an account, and accounts are created by invitation. Clerk processes what is needed to sign you in (e-mail address, sign-in identifier) so that you can use the app across devices. Clerk is loaded when the app is opened, before you press anything. The exception is someone without an account who only opens a shared link or the credits page: then Clerk loads only once you want to sign in or join the waitlist. In doing so Clerk, and Cloudflare, through whose network Clerk is reached (see section 4), receive your IP address and your browser's headers. Five cookies are set even before you sign in (measured on 23 October 2026): from Clerk, __client on the address under which Clerk works for this site, which recognises your browser to Clerk, and __client_uat in two variants on this address, which only say whether a sign-in exists — Clerk asks for ten years for all three, and common browsers cut that to about 400 days; from Cloudflare, __cf_bm (30 minutes) and _cfuvid (until you close the browser) to detect bots. Signing in adds __session (one year; its content is renewed every minute), which identifies you to our server as signed in. Clerk keeps a record of your sign-ins with IP address, the approximate location derived from it, and the device; it keeps its logs of them for seven days. Clerk's own usage statistics (telemetry) are switched off.
If you ask for early access, the e-mail address you enter is stored at Clerk — the same processor as for accounts — so that an invitation can be sent to it. Nothing else is asked for and nothing else is stored with it.
If you enter your e-mail address in a sign-up box on this site, we send you one message asking you to confirm it. Nothing else is sent until you follow the link in it and press the confirm button on the page it opens (double opt-in). Once confirmed, the address is stored so we can send you the newsletter, together with: the time you asked, the time you confirmed, where on the site you signed up, and a short fingerprint of the exact wording of the consent text you were shown and of the confirmation e-mail you received — that fingerprint is how we can later show which wording you agreed to. Your IP address is not stored; it is used only to limit how often the form can be submitted, and is never written down. Delivery runs through Resend (see section 4). There is no tracking in the mail: no opening pixel, no rewritten links, so we do not know whether or when you read it. Every message carries a one-click unsubscribe link that works without signing in, and unsubscribing takes effect immediately. Legal basis: Art. 6(1)(a) GDPR (your consent), which you may withdraw at any time with effect for the future.
Signed in, the material you make is synchronised with our server so it reaches your other devices: your practice log (which exercise, when, how long, in which key, your own rating, and which piece it was on), your own exercises, your lick cards, your session plans, your settings, your self-check (for each skill, “not yet”, “with effort” or “fluently”) — and the charts you import. What you made before signing in stays where it is until you decide: the app asks once, naming what it found, and takes it over only if you say so. Melodies and lyrics are never part of any of this, and not because we drop them — the app never reads them. An imported file is reduced to its chord chart at the door, and the chord chart is the only thing that is stored.
PostHog (EU cloud, Frankfurt) records eleven events from a fixed list — which screens are opened, which exercises are begun and finished and which sessions are planned, whether the app is installed, whether an import succeeded and in which format, which piano sound you choose, and when you sign in — plus page views, whose addresses are stripped of a piece's title before they are sent, and browser family and screen size. PostHog does not store your IP address. Only if you agree: without consent the software is not even downloaded. It stores a random identifier on your device (§ 25 TDDDG) so sessions from the same device can be joined; if you are signed in, your account identifier is added — never your e-mail address. Your imported pieces, their titles, individual chords and free text are never transmitted. You can withdraw at any time under “Account”, and the stored identifier is deleted when you do. Legal basis: Art. 6(1)(a) GDPR together with § 25(1) TDDDG.
The server and database run at Railway. Delivering a page necessarily produces connection data. Railway keeps an access log of it: per request the IP address, time, requested address, browser identifier (user agent), status code, amount of data transferred and response time. The requested address can contain the title of a piece you have imported. Our server also writes an operations log (start-up, errors, the sending of an e-mail); your IP address is not in it, and since 11 October 2026 no e-mail address is either — until then the recipient address was written when an e-mail was sent. Railway keeps both logs for 90 days and then deletes them; the last 30 days of them can be read in its dashboard. Unlike the server and database, the logs are stored in the United States (Railway's "US West" region).
The app has two ways to tell us something: the “Looks wrong?” flag on a single chord, and a general feedback form reachable from every screen. When you press Send, we store your words together with what is needed to place the report: the screen's name, the piece's title as a short identifier (never the chart), on a chord flag the one flagged chord symbol and the app's own analysis of that bar, your rough view settings (which elements were hidden, which voicing style), and the app version. A report also says what was running when you sent it: the exercise by its identifier and type (never the title or notes of an exercise you wrote), your place in a practice session, playback (playing or not, tempo, groove), a transposed key, your instrument setting, the app's build, and your device in coarse terms — browser family and operating system, window size and orientation, whether the app is installed and online. Your full browser identifier is never sent. Chart text, melodies and lyrics are never part of a report. Reports are tied to your account; we delete them 24 months after receipt, or earlier with your account. Every report also reaches us as an e-mail with your account identifier and your words: it travels through Resend, which stores it for 30 days, and lies in our mailbox at Google Workspace; there we delete it 24 months after receipt at the latest, even if you delete your account before then.
If the app breaks with an error in your browser, it sends a report to our own server of its own accord — without asking, and even if you have no account. What is stored: the time, the kind of error, the error message, the call chain in the program (stack), the address of the page, your browser's user agent and the app version. The parts of the address that come from you, such as a piece's title, are removed beforehand. The error message is not cleaned: it can contain an excerpt of a chart the app failed on. A report carries no account, no session and no identifier; your IP address is not stored with it and serves only to limit the number of reports per sender. The purpose is to notice and fix errors that would otherwise be visible only on your device. We delete these reports after 90 days (see section 5).
The account, sync, feedback and what is stored on your device for them are processed to provide the service you use (Art. 6(1)(b); storage on the device is strictly necessary for it, § 25(2) no. 2 TDDDG). The waitlist rests on your request before a contract (Art. 6(1)(b)). Usage measurement and the newsletter rest on your consent (Art. 6(1)(a); for the identifier on the device § 25(1) TDDDG), as does loading a video from YouTube or a recording from Spotify, which you consent to with the play button. We keep the record of a newsletter consent because we must be able to produce it (Art. 6(1)(c) with Art. 7(1) and Art. 5(2)). Server logs, rate limiting, crash reports and loading Clerk before you sign in rest on our legitimate interest (Art. 6(1)(f)) in secure and error-free operation; your interests do not outweigh it because we store no identifier for these, keep IP addresses only transiently or for short periods, and use none of it for any other purpose. We keep database backups because Art. 32 GDPR obliges us to (Art. 6(1)(c)).
You may object at any time to processing based on legitimate interest (Art. 21 GDPR), by e-mail to the address in section 1. Providing your data is required neither by law nor by contract; without an e-mail address, however, we can run no account and send no invitation. No automated decision-making within the meaning of Art. 22 GDPR takes place.
Clerk (sign-in, accounts, waitlist), Railway (hosting, database, logs, backups), PostHog (usage measurement, only with consent) and Resend (sending the confirmation e-mail, the newsletter, and forwarding your feedback to our mailbox) process data on our behalf. Our mailbox itself is hosted at Google Workspace. Feedback from testers that we keep for development is held in our private project repository at GitHub. Only when you press play do Google Ireland Limited (YouTube) or Spotify AB receive your IP address and browser data and process them under their own responsibility; there is no agreement with them about this transfer, because neither offers one.
Cloudflare is a recipient of a different kind, and it is named separately because of it. Clerk's services run behind Cloudflare's network, so Cloudflare receives your IP address and browser headers every time the app opens and sets the two cookies named under (c). Its Turnstile check runs when you register — Clerk loads it, not us — and also evaluates a TLS fingerprint. Cloudflare uses those signals to protect the services and to improve its own bot detection; for that second purpose it acts on its own behalf, not on ours.
Where processing happens. Railway keeps server, database and backups in Amsterdam, the backups encrypted, but its logs in the United States (see 2g); PostHog the measurement data in Frankfurt; Spotify AB is in Sweden. Clerk, Resend, Cloudflare, GitHub and Google process in the United States — Clerk exclusively there, Resend including the logs and contents of sent mails. These transfers rest on the European Commission's adequacy decision for the EU-US Data Privacy Framework: Clerk, Inc., Plus Five Five, Inc. (Resend), PostHog, Inc., Cloudflare, Inc., GitHub, Inc., Google LLC and Railway Corporation are certified under it. With Railway the EU Standard Contractual Clauses are agreed in addition, as part of its data processing agreement. If we ask Railway for help, its staff may access our service for it from wherever they work — including outside the EU and the United States; Railway does not name those countries and does not commit to processing in the EU only. Such access is covered by the Standard Contractual Clauses. A contract under Art. 28 GDPR is in place with every processor: with Clerk and Resend it is part of the terms of service, with Railway, PostHog and Google Workspace it was concluded separately, with GitHub it is part of the agreement for our team account; Cloudflare works as Clerk's sub-processor.
Local data stays until you clear it in your browser. Account data is deleted when you delete your account. If, with an account, you delete a single piece, an exercise or a lick card, the entry disappears from the app; a deletion marker remains on our server so that the deletion also reaches your other devices. The deletion marker holds only its identifier, its type and the time of deletion, not its content; the identifier of a piece is formed from its title. The rule for this is 90 days: after that the deletion marker is removed from the server, by a run that starts on its own once a week. On the device on which you deleted, the deletion marker, likewise without content, stays in your browser's storage like all local data. Whatever we delete from the server — an account, the content of a deleted entry as much as an expired deletion marker — remains for up to 27 days in the database backups that our host makes daily and weekly; the period is the host's own figure. A waitlist entry is deleted once the invitation has been accepted, at the latest when the private beta ends — and at any time on request. A newsletter sign-up that is never confirmed is deleted after 14 days, and no reminder is sent in the meantime (a reminder would itself be advertising). When you unsubscribe, the address leaves the mailing list at once; the record that you once consented — the timestamps, the wording fingerprints, and your address not in plain text but only as a fingerprint by which a known address can be recognised: it finds the record when you tell us your address, and anyone who already knows an address can likewise check whether a record belongs to it — is kept for three years, because we may have to show it if the consent is ever disputed (§ 7 UWG; Art. 5(2), 7(1) GDPR).
In detail: crash reports are deleted after 90 days, feedback reports 24 months after receipt, both by the same run as the deletion markers. A newsletter subscription is tied to your address, not to your account: it does not end when you delete the account, only through the unsubscribe link. Clerk keeps its sign-in logs for seven days, Resend mails and delivery logs for 30 days, and Railway deletes its logs after 90 days (see g). Measurement data at PostHog remains for one year from the event; if you withdraw your consent, the events captured until then remain there until that period ends, and we delete them earlier on request.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Consent once given can be withdrawn at any time with effect for the future. Write to privacy@paintmusic.app.
You may complain to a data protection supervisory authority, in particular in the Member State where you live or where you believe the infringement occurred. Competent authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (post: Postfach 1349, 91504 Ansbach), phone +49 981 180093-0, poststelle@lda.bayern.de, online complaint at lda.bayern.de/de/beschwerde.html.
With an account, the app stores what you keep: your own exercises, your lick cards, and the charts you import. That makes this service a hosting provider under the Digital Services Act. If something stored here infringes your rights or is otherwise unlawful, you can report it — also if you have no account yourself, for instance because you opened a shared exercise from a link.
How to report (Art. 16(1) and (2) DSA): an informal email to privacy@paintmusic.app, in German or English. Because the contents of an account are not public, there is usually no address you could point to; anything that makes the item findable helps — the title of the tune or the line, the name or email address of the person who keeps it, a share link if you have one. Plus an explanation of why the content is unlawful, your name and email address, and a statement that your information is accurate and complete to the best of your knowledge. If something is missing we will not reject the notice for that reason; we will ask.
What happens next (Art. 16(4) to (6) DSA): you get a confirmation of receipt, and afterwards the decision. You can object to the decision at the same address, complain to the Digital Services Coordinator (in Germany the Bundesnetzagentur, Art. 53 DSA), or go to court. Notices are handled diligently and non-arbitrarily — and by hand: there is no automated content screening and no automated decision-making. One person runs this service.
If something is removed or an account is suspended (Art. 17 DSA), the person affected is told what happened and why, on what ground, whether a notice prompted it, that no automated means were used, and what they can do about it. Anyone who repeatedly stores content that had to be removed after a justified notice should expect their account to be suspended.
Point of contact (Art. 11 and 12 DSA): for authorities and for users alike, the same email address as in the Impressum, privacy@paintmusic.app. Languages: German and English. Account holders can also reach us through the feedback button in the app; a human reads both.
Articles on this site's blog and the newsletter are written by Clemens Eckstein, who is responsible for their content. AI tools assist with drafting and editing; everything is reviewed by the author before it is published, and the harmonic analysis the app itself shows is computed, not generated. The companion texts on the jazz standards, by contrast, are machine-written (the “Appreciate & Listen” panel: the history of the piece, its character, playing tips, recordings). An AI system researched and wrote them from cited sources; they have not been checked sentence by sentence by a person and may contain errors. The panel says so itself, lists its sources (Wikipedia articles with their licence, CC BY-SA 4.0, modified) and offers a way to report a mistake.
As of 2 November 2026. This notice is updated when the processing changes.
← Back to paintmusic.app Deutsche Fassung (maßgeblich) · Terms of use · Blog · Credits / attributions · Sound credits · Third-party notices