Privacy policy

Who is responsible

Email: kontakt@coffeeapps.eu

For questions about privacy, write to me at kontakt@coffeeapps.eu.

When you visit the site

With every request your browser sends what is technically needed, your IP address among it. The server logs every request with its method, address, status code and duration, without your IP address. Only when the site itself cannot be reached does the web server in front of it record the request with the IP address, so that I can find the error. The logs have no fixed period: they are overwritten continuously once they reach 50 MB.

To limit abuse of the forms and of sharing, the server counts for a short while how many requests come from an IP address. It does not store the address for that, but a check value made with a secret key. It is deleted as soon as the time window has passed.

I serve fonts, images and sounds myself. No content, fonts or scripts from third parties are embedded. The links to X, Bluesky and “Buy me a coffee” are plain links: data only goes to that provider when you click one, and then their terms apply.

Encryption

All pages and apps can only be reached encrypted over HTTPS (TLS); you can tell by “https://” and the padlock in the address bar. What you send to the site cannot be read by third parties on the way.

Forms, feedback and newsletter

There are three forms where you can enter your email address:

• Your problem on the start page: your description and your address. With it you also sign up for my newsletter “The Coffee Break”.
• The newsletter signup on the start page: only your address.
• Feedback in CoffeeDrums and CoffeeSound: your message and your address. You are only signed up for the newsletter if you tick “Also send me The Coffee Break”.

What is stored: the address, the language, the app you sent it from, your messages (at most 10,000 characters together), and when I sent you a confirmation mail and when you confirmed. This happens in my sign-in service at id.coffeeapps.eu, which serves all my apps. Only I read your messages.

For the newsletter you first get a mail with a confirmation link that is valid for seven days; you are only signed up once you confirm. I send at most three such mails to an address. Every newsletter contains a link to unsubscribe. When you unsubscribe, I delete your address and your messages. Only a check value (hash) of the address remains, so that nobody can have mails sent to you again during the following 30 days.

An address that was never confirmed, because you only sent a message or did not confirm the signup, is deleted with your messages 30 days after the last signup or mail. The check value of an unsubscribed address is deleted after 30 days.

All mails are sent through eusend (eusend.dev), operated by Bjørnerås Labs, org. no. 938 162 336, Norway, on my behalf according to Art. 28 GDPR. eusend stores and sends the mails only on servers in the EU. Two of its sub-processors are US companies that may process data to a limited extent: Cloudflare (network, reports about undeliverable mails) and Sentry (error reports, stored in the EU). These transfers rest on the EU-US Data Privacy Framework (Art. 45 GDPR), or else on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Your account

You sign in with an account that is not managed by the start page or an app itself but by my sign-in service. In CoffeeDrums an account is optional; the drum machine works without one. The same account works for all my apps. It holds your name, your email address, your password (as a hash only), a profile picture if you upload one, your language and your time zone.

When you sign in on the start page or in an app, that site receives a copy of it: name, email address, profile picture, language, time zone and your roles (such as whether you are an admin), along with the time of your first and your latest sign-in. For your session it stores the keys the sign-in service issues for it, and when they expire.

In the settings you can change your name, language, time zone and profile picture. A profile picture goes to the sign-in service, which makes it smaller and stores it.

Cookies and storage in the browser

• a cookie for your sign-in and, while signing in, one for that process
• a cookie for the chosen language, for one year
• in your browser's storage: who was signed in last, so that the installed app starts without a connection; it is deleted when you sign out
• the site itself, so that it starts quickly and without a connection
• CoffeeDrums: your current pattern and samples of your own that you load. They stay in your browser; a song is only uploaded when you share it. When you save a song, the file goes to your device. For songs you have shared, your browser keeps the keys you can delete them with.
• CoffeeSound: the audio files you open are edited in your browser only and are not uploaded.

All of this is needed for the site to work. There are no cookies for advertising or analysis. You can delete cookies and storage in your browser at any time.

Sharing songs in CoffeeDrums

When you share a song (File › Share…), I store a copy of it: the patterns, the title and the language, but no samples of your own. From it a preview image is made for links on social networks. Sharing works without an account, and the song is not linked to any account. Anyone with the link can listen to it and open it.

So that I can spot abuse and group songs from the same source, I store with every shared song a check value of your IP address made with a secret key, not the address itself. Shared songs do not expire: they stay until you delete them with the key in your browser or ask me to. If a song infringes the rights of others, I can block it.

Error reports

When an error occurs on the server or in your browser, a report goes to an error collection (GlitchTip) that I run myself. It contains the error message, the place in the program and the address that was requested; a report from the browser also the kind of browser and the steps just before the error, such as which pages you opened. Reports from the browser go through this site, and your IP address is not passed on with them. Nothing is sent without an error. Reports are deleted after 30 days.

Where the data is kept

The site, the sign-in service and their databases run on a server in Finland that I rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which processes the data on my behalf under a data processing agreement according to Art. 28 GDPR.

Every night the databases and stored files are backed up, encrypted, to Hetzner's object storage in Falkenstein, Germany. A backup is kept for at most six months: the daily ones for a week, the weekly ones for a month, the monthly ones for six months.

Servers and backups are thus in the EU; no data is sent to countries outside the EU for them.

Legal bases

• Account, sign-in and settings: Art. 6(1)(b) GDPR (contract of use).
• Newsletter: your consent, Art. 6(1)(a) GDPR.
• Shared songs: your request to share them, Art. 6(1)(b) GDPR.
• Messages and feedback without the newsletter: my legitimate interest in answering you and improving my apps, Art. 6(1)(f) GDPR.
• Server logs, limiting requests, the check value of shared songs and error reports: my legitimate interest in a secure and working service, Art. 6(1)(f) GDPR.
• Cookies and storage in the browser: strictly necessary, Section 25(2) no. 2 TDDDG.

Deletion

• Newsletter and messages: through the unsubscribe link in every mail, or write to me.
• Shared songs: in CoffeeDrums under File › Share…, as long as your browser still has the key, or write to me with the link.
• Account: your account stays until you have it deleted. To delete your account with all its data, write to kontakt@coffeeapps.eu. In backups the data remains until those expire.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just write to me at kontakt@coffeeapps.eu.

Objection (Art. 21 GDPR): where processing rests on my legitimate interest (Art. 6(1)(f)), you can object to it at any time on grounds relating to your particular situation. I then no longer process the data unless I can demonstrate compelling legitimate grounds.

Withdrawal (Art. 7(3) GDPR): you can withdraw a consent, such as for the newsletter, at any time for the future, through the link in every mail or by a simple mail. What happened until then remains lawful.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for me is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

No automated decisions

There are no automated decisions and no profiling within the meaning of Art. 22 GDPR.