Privacy Policy

For the “Music Pairs” app (iOS, iPadOS, Android) and this website · Last updated: 8 October 2026

This is a translation. If the two versions differ, the German version prevails.

1. Controller

No data protection officer has been appointed; none is required by law.

2. Data that stays on your device

The app stores the following data locally on your device only. The provider has no access to it, and it is not sent to the provider or to anyone else:

• player names and player colours,
• game history (date, player names, points, number of cards and game rules),
• settings, the most recent game settings and your song selection,
• a list of songs that could not be played on your device (so they are not drawn again).

This data may be part of your device backup (iCloud Backup or Android backup), which you control through the operating system. Apple or Google process such backups under their own privacy policies.

You can delete the game history in the app under “Game History” (trash icon). Uninstalling the app removes all of its data from the device.

Player photos (camera and photo library)

You can take a photo for each player or pick one from your photo library. The app asks for access to the camera or your photos for this – only when you use the feature. A photo is cropped and scaled down on the device and, by default, kept in memory only; it is gone once the app is closed.

If you turn on “Store photos permanently”, the photos are saved in the app’s private storage on the device – explicitly excluded from iCloud and Android backups and from transfers to a new device. Turning the option off deletes all stored photos immediately. Photos are never uploaded.

3. Music sources

Music on this device

With your permission, the app reads your device’s music collection (title, artist, duration, artwork) and plays songs from it. This happens entirely on the device; nothing is transmitted.

Apple Music (iOS/iPadOS only)

With your permission, the app accesses your library through iOS interfaces and plays songs through the system music player. It also checks whether an Apple Music subscription is active, to leave out songs that cannot be played. Any communication with Apple is handled by the operating system; Apple’s privacy policy applies. Nothing is sent to the provider.

Audius

If you choose Audius as your music source, the app loads song lists, artwork and song excerpts from Audius over the internet. Audius is a decentralised network; requests go to servers run by various operators within the Audius network. At your request, the app connects to these servers directly from your device; the provider receives none of it.

This transmits your IP address (technically unavoidable), the content requested (e.g. charts, genre or playlist) and an identifier of the app (not of you). Loaded excerpts are cached for the current game only and deleted afterwards.

The legal basis is Art. 6(1)(b) GDPR – the transfer is needed to provide the music source you chose. Servers of the network may also be located outside the EU, in countries without an adequacy decision of the EU Commission. Transfers there are based on Art. 49(1)(b) GDPR, as they are necessary for the music source you chose. There is a risk that such countries do not offer a level of data protection comparable to EU law and that authorities may access the data.

Processing by Audius is governed by the Audius privacy policy. Tapping an Audius link on the game result opens the Audius website in your browser.

4. Feedback from the app

Under Settings → “Give feedback” you can choose to send a message to the provider. The following is transmitted:

• your message and the chosen category (bug, idea, other),
• technical details: app version, platform (iOS/Android), operating system version, device model (e.g. “iPhone14,2”) and the app language.

No name, no email address and no device identifier are transmitted. Your IP address is not stored in plain text. To fend off implausible mass submissions, only a non-reversible hash of the IP address is kept briefly – separately from your feedback. Please also do not put any personal data in your message.

The transfer is encrypted (HTTPS) to the provider’s feedback server, hosted by ALL-INKL.COM in Germany (see section 6). Feedback is deleted within 12 months, the hash within 48 hours; backups are overwritten within 70 days.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is fixing bugs and improving the app. As feedback is anonymous, it usually cannot be linked to you – so access to or deletion of a single submission is mostly not possible (Art. 11 GDPR). If you state roughly when you sent it and what it said, an attempt will still be made.

Sending feedback is voluntary; the app can be used without restriction without it.

5. Contact by email or phone

If you write to musicpairs@dithikai.de or call the phone number given in the legal notice, your email address or phone number, your name (if given) and the content of your request are processed to answer it. The legal basis is Art. 6(1)(b) GDPR where your request concerns the purchased app, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests).

The emails are kept in the provider’s mailbox at ALL-INKL.COM (see section 6). They, and any notes on calls, are deleted once your request has been dealt with, after 12 months at the latest, unless statutory retention obligations apply (see section 8).

Please note: emails may be transmitted unencrypted. Complete protection against access by third parties is not possible.

6. Hosting of this website, the feedback server and the mailbox

This website, the feedback server and the email mailbox are hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A data processing agreement under Art. 28 GDPR is in place with ALL-INKL.COM. Details: ALL-INKL.COM privacy information (German).

When you open this website, the server processes your IP address as technically required to deliver the page or the app’s request. In the access logs (server log files) it is stored only fully anonymised – together with date and time, page requested, amount of data transferred, browser and operating system, and the referring page. The logs serve secure operation and are deleted after 7 days. The legal basis is Art. 6(1)(f) GDPR. The same applies to requests the app sends to the feedback server.

The website is served encrypted (HTTPS) only. It uses no cookies, no JavaScript and no analytics, and loads nothing from third-party servers (the font is served from this server too).

7. Sharing with third parties and app stores

No data is sold or shared. The only recipients are those named above: ALL-INKL.COM as processor and – only if you use Audius – the servers of the Audius network. No third-party advertising, analytics or crash-reporting services are built into the app.

When you download and buy the app, Apple (App Store) or Google (Google Play) process data as independent controllers under their own terms. Apple and Google provide the app’s provider with aggregated sales and usage statistics, as well as crash reports from users who have allowed this in their device settings. No individual person can be identified from them. Buyers’ names or payment details are not passed on.

Tips in the app

The app may offer a voluntary tip in the settings under “Support the developer”; it unlocks nothing. When you open that page, the app asks the App Store or Google Play for the current prices through the operating system. If you leave a tip, Apple or Google handle the purchase and the payment entirely – as independent controllers under their own terms (Apple, Google).

The app only learns which tier was bought, whether the purchase is complete, and a purchase identifier it uses to confirm the purchase to the store. It stores none of this and sends nothing to the provider. The provider only receives aggregated sales reports from Apple or Google – no names and no payment details. The legal basis is Art. 6(1)(b) GDPR (carrying out the purchase you asked for).

8. Storage period

Unless a more specific period is stated in this policy, personal data is deleted as soon as the purpose of its processing ceases. Where statutory retention obligations apply (e.g. tax or commercial law periods), the data is kept restricted until they expire and deleted afterwards; the legal basis for this is Art. 6(1)(c) GDPR.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To exercise them, email musicpairs@dithikai.de.

You may also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where the alleged infringement took place.

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

10. Children

Music Pairs does not knowingly collect personal data from anyone – children included. Player names and photos stay on the device. Children should only use the feedback form with their parents’ permission.

11. Changes

If the app changes in a way that involves processing other data, this policy will be updated. The version published here applies.