Privacy
Controller for website and app
Mike BildGrottkauer Str. 8
12621 Berlin
Germany
Contact: mike.bild@gmail.com
This notice covers the public Harmoniqs website and the native Harmoniqs app on Mac, iPhone and iPad, including BRAIN. Website enquiries, app sign-in and optional online guidance through BRAIN are described separately below. Outstanding checks for the controller are explicitly identified; legal review is not complete.
Website and images
The website is delivered through Lovable. Native app images are served through Lovable Assets, which uses Cloudflare storage and delivery infrastructure. Requests may involve processing your IP address, request time and address, and browser and connection information. This supports delivery and security of the website, based on Article 6(1)(f) GDPR. Provider agreements, specific retention periods and potential international transfers must be reviewed before public release.
Language, fonts and analytics
The initial language follows the language preferences sent by your browser. Fonts are served by this website, not an external font service. The website sets no operator-configured analytics or advertising cookies and includes no visitor analytics configured by the operator. Technical processing by hosting and delivery services is separate from this.
Trying chords
Chord selection, notation and sounds are processed in your browser. Sounds start only following your interaction. The website does not access your microphone, record sound or upload musical input to a server. Your selection is not stored persistently.
Beta requests
When public beta registration is open, the beta buttons open the contact form with the platform preselected. No public beta form is available while registration is closed. For a beta request, we privately store your name, email address, language, platform, submission time and a unique request identifier in Lovable Cloud. No free message text is collected for beta requests. For your beta request, we forward your unique request identifier, the beta request type, your name, email address, language and selected platform to SubKit. SubKit retrieves the appropriate Apple TestFlight link and sends it via Gmail to the email address you provided. The data is used to provide your beta access, not for advertising. The confirmation on this website confirms only receipt of your request, not email sending or delivery.
Contact form and email
When you use the contact form, your name, email address, message, language, submission time and a unique request identifier are stored in Lovable Cloud. To prevent abuse, a one-way hash of the email address and time-based request counters are stored across server calls. A hidden website field acts as a spam trap and is not stored with an accepted request. Normal contact requests never trigger beta handoff. These details are used only to handle your enquiry and are not publicly accessible. Email enquiries also involve processing your message and contact details. Depending on the enquiry, this is based on Article 6(1)(b) or (f) GDPR. The data is deleted when no longer needed for that purpose, unless statutory retention obligations apply. Provider agreements and processing by Lovable Cloud must be reviewed before public release.
App account and Apple sign-in
When you sign in with Apple, the app sends the Apple identity or user identifier, your email address (possibly an Apple private relay address) and an optional name to Supabase GoTrue at supabase.mikebild.dev. These data create your account and maintain authentication. Sign-in takes place in the app, not on this website.
BRAIN: optional online guidance
BRAIN is optional and requires sign-in and your consent. For musical suggestions and explanations, the app sends structured songwriting and session data, the current question and the history needed for the response through SubKit at subkit-api.mikebild.dev to OpenAI. Data can include song parts, repeats, chords, key, tempo, meter, part and layer names, mixer state, take metadata, recognized symbols and settings. SubKit and OpenAI receive these data to process your BRAIN request. Audio recordings, song titles and file names are not sent to BRAIN.
Local audio and projects
Audio, projects and recordings stay locally on your device. BRAIN requests do not transfer audio recordings, song titles or file names. The native app uses no tracking or advertising SDKs and no crash analytics.
OpenAI retention
OpenAI requests use store:false. This does not mean that default abuse-monitoring retention is disabled. Official OpenAI documentation says API abuse-monitoring logs may be retained for up to 30 days by default; longer retention may be legally required or necessary to protect against harm (https://developers.openai.com/api/docs/guides/your-data). The controller still needs to verify the provider terms and retention rules that actually apply to this integration.
Retention and account deletion
Account deletion is available through the app. It deletes SubKit user data and the authentication account and revokes Apple authorization. An exact deletion time has not been confirmed. Specific retention and deletion periods, backup handling and any remaining processing by the services involved still need verification. Account deletion is distinct from locally stored audio and projects; the controller must also confirm their deletion behaviour. The purpose-based deletion of contact enquiries described above remains separate.
Unverified: providers and retention
The controller must confirm the contracting providers and their roles, data-processing agreements, subprocessors and specific retention and deletion periods for Lovable, Lovable Cloud, Cloudflare, Apple sign-in, Supabase GoTrue, SubKit, Gmail and OpenAI. Actual processing of hosting and diagnostic logs also needs review. These details are not yet fully verified.
Unverified: legal bases and transfers
The controller must review and specify the applicable legal bases for app authentication, BRAIN and beta handoff, and any statutory retention obligations. The consent required for BRAIN does not replace that review. Processing locations, possible international transfers and any required transfer grounds and safeguards for the services involved have not been conclusively confirmed. Provider and legal review remain open.
Your rights
Subject to the legal requirements, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. These rights apply to website and app data. You may withdraw consent for future processing without affecting the lawfulness of earlier processing. For data-rights requests and account-deletion questions, contact Mike Bild at mike.bild@gmail.com or the postal address above. You may also complain to a data protection supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information.