Privacy policy

This privacy policy explains how the Android app HarmonicFlow ("the app") and its sync server at harmonicflow.mrjsa.com handle your data. In short: the app works without an account, keeps your songs on your device, and contains no advertising, analytics or tracking.

#1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Joshua Schulz-Andres — MrJSA Technologies
Lessingstraße 2 D, 42499 Hückeswagen, Germany
E-mail: admin@mrjsa.com

Further details are in the imprint. We are not required to appoint a data protection officer.

#2. Data that stays on your device

Without a cloud sync account, everything you do in the app stays on your device: songs, setlists, notes and settings. We receive none of it.

• Importing files. When you import song files, the app only reads the files you picked in Android's file picker and stores a copy on your device. Files picked from a cloud service (e.g. Google Drive) are provided by that service under its own privacy policy; the app doesn't send them to us.
• Microphone. The tuner and the sound analyser use the microphone to detect notes. The sound is analysed in real time on your device and is never recorded, stored or transmitted. Android asks for the permission when you first open one of these tools, and you can withdraw it at any time in the system settings.
• No advertising, analytics or tracking. The app contains no advertising, analytics or crash-reporting SDKs and creates no advertising profile.

#3. Cloud sync account (optional)

To sync songs and setlists between devices or to share setlists, you can create an account on our sync server. We then process:

Data	Purpose
E-mail address and display name	Signing in, identifying your account, showing your name to people you share setlists with
Password	Only stored as a salted Argon2id hash; we can't read your password
Songs, setlists and band notes you sync	Storing them on the server and delivering them to your other devices
Session tokens	Keeping you signed in; stored only as a hash and valid for at most one year
Subscription status	Unlocking Premium (see section 6)

A guest account works without an e-mail address; the server only creates a random account ID for it.

Legal basis: Art. 6 (1) (b) GDPR (providing the service you requested).

Storage period and deletion: We keep the data as long as your account exists. You can delete your account at any time in the app under Settings → Cloud Sync → Delete account. This immediately deletes your account, your synced songs and setlists, your sessions and your subscription records from the server. Songs on your device are not affected.

Backups: Once a day we store a copy of the server database in a private repository at GitHub (see section 9), so that no data is lost if the server fails. Only we have access to it. Each backup is deleted after 30 days, so a deleted account is gone from all backups 30 days later at the latest.

#4. Sign in with Google (optional)

If you choose Continue with Google, Android's sign-in dialog (Google Credential Manager) asks you to pick a Google account. Google then sends the app a signed token with your name, e-mail address and Google account ID. Our server checks the token's signature with Google's public keys and uses the data to create your account or to sign you in. We never receive your Google password and have no access to other data in your Google account.

The sign-in itself is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under Google's privacy policy.

Legal basis: Art. 6 (1) (b) GDPR.

#5. Shared setlists

When you share a setlist, the people who join with your link or QR code see the setlist, the songs in it, your display name (or your e-mail address if you haven't set a name) and the band notes. As the owner, you see the names of the members. Anyone who opens a share link in a browser sees the setlist's name and your display name, so only send the link to people you want to invite. You can stop sharing or remove members at any time.

Legal basis: Art. 6 (1) (b) GDPR.

#6. Premium subscriptions

• Google Play: Subscriptions bought in the app are processed by Google Play (Google Ireland Limited). Google handles the payment; we don't receive your payment details. Our server receives the purchase token, the product and the subscription status from Google, checks them with the Google Play Developer API, and links them to your account.
• Stripe: If you subscribe outside Google Play (e.g. on a website), the payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, under Stripe's privacy policy. We only store Stripe's customer and subscription IDs and the subscription status.

Legal basis: Art. 6 (1) (b) GDPR; for records we must keep for tax purposes, Art. 6 (1) (c) GDPR in conjunction with § 147 AO and § 257 HGB.

#7. SongSelect and ChurchTools import

If you import songs from CCLI SongSelect or setlists from ChurchTools, the app connects directly from your device to these services with the login details you enter there. Your login details and the session are stored only on your device; we receive neither them nor the imported content (unless you later sync the songs, see section 3). The privacy policies of CCLI and of your church's ChurchTools provider apply.

#8. Hosting and server log files

The sync server is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The server is located in Austria (EU). We have concluded a data processing agreement with netcup in accordance with Art. 28 GDPR. All connections between the app and the server are encrypted with TLS (HTTPS).

When the app or your browser connects to the server, it necessarily transmits your IP address. The sync server doesn't write IP addresses to its database or its logs. To limit repeated sign-in attempts, it counts sign-in and registration requests per IP address in working memory only; these counters are lost at the latest when the server restarts. Requests pass through a reverse proxy (Caddy) on the same server, which writes no access logs and only logs technical errors, which may contain the IP address. Server logs are automatically deleted after 7 days.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and stable operation of the service.

The ChordPro editor on the website (/editor/) runs entirely in your browser. The song you write and your display settings are kept only in your browser's local storage, so they are still there next time; they are never sent to the server. PDF and .chordpro files are created in your browser as well. You can delete the stored draft at any time by clearing this site's data in your browser. The website sets no cookies and uses no analytics.

#9. Recipients and transfers to third countries

We pass on personal data only to the providers named above and, for the daily backups (section 3), to GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, which stores them for us as a processor (Art. 28 GDPR; legal basis for the backups: Art. 6 (1) (f) GDPR, our legitimate interest in not losing your data). Google, Stripe and GitHub may process data in the USA. They are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). We use no automated decision-making or profiling (Art. 22 GDPR).

#10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation.

To exercise your rights, an informal message to the contact details above is sufficient. You can also delete your account yourself in the app (section 3).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany — www.ldi.nrw.de.

#11. Changes to this policy

We update this privacy policy when the app, the server or the legal requirements change. The current version is always available on this page.