Last updated: January 18, 2026
1.1. This Privacy Policy (hereinafter - "Policy") defines the procedure for processing and protecting personal data of users of:
The Website and Application are collectively referred to as the "Service".
1.2. The personal data controller is an individual (hereinafter - "Operator"):
1.2.1. Data Protection Officer (DPO): Given the scale of our operations and the nature of data processing activities, we have not designated a separate Data Protection Officer. The Operator personally handles all data protection matters. For any data protection inquiries, please contact us at the email address above with the subject line "Data Protection Inquiry".
1.3. By using the Service, you acknowledge that you have read and understood this Policy. Your use of the Service constitutes your acceptance of this Policy. Where consent is required as a legal basis for specific processing activities (such as Firebase Analytics, Firebase Crashlytics, or personalized advertising), we will request your explicit consent separately through clear affirmative action. If you disagree with the terms of this Policy, you must stop using the Service.
1.4. This Policy has been developed in accordance with:
2.1. Personal data - any information relating to a directly or indirectly identified or identifiable natural person. This includes both direct identifiers (name, email) and indirect identifiers (unique device identifiers), which in combination with other data can be used to identify a natural person.
2.2. Processing of personal data - any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, clarification, use, transfer, anonymization, blocking, deletion, destruction.
2.3. Operator - a person who independently or jointly with other persons organizes and/or carries out the processing of personal data.
2.4. User - a natural person using the Service.
Registration is not required to view content on the Website. When authorizing via Google OAuth 2.0 to add or edit content, we receive:
Registration is not required to view content in the Application. When voluntarily authorizing to synchronize data between devices, we receive:
When authorizing via Firebase Authentication (email/password):
When authorizing via Google Sign-In:
When authorizing in the Application or on the Website, the following are automatically synchronized:
To ensure data synchronization and prevent fraud, we use two types of identifiers:
3.4.1. Client device identifier (userGuid):
3.4.2. Server user identifier (userDbGuid):
Important: These identifiers are separate and independent from Analytics and Crashlytics identifiers. They are not shared with Google or third-party services. They are used exclusively for the operation of our Service and fraud prevention.
You can voluntarily provide consent to use:
Important: These features are entirely optional. Declining them does not limit the functionality of the application.
The Website web server automatically collects:
Advertisements may be displayed when using the Application. To show personalized advertising, we use:
You can:
You can voluntarily submit diagnostic logs to help us troubleshoot issues. This can happen in two ways:
When you voluntarily submit logs, we may receive:
Important: Log submission is entirely voluntary. The Application will never send logs automatically without your explicit action. You always control when and whether to send logs.
We process your personal data for the following purposes:
Personal data processing is carried out on the following legal bases (in accordance with Article 6 GDPR):
Justification of legitimate interest for client identifier (userGuid): Creating this identifier on first launch of the Application is necessary to protect our legitimate interest in preventing fraud with in-app purchases and Service abuse. This interest is balanced with your rights because: (1) the identifier is completely anonymous and contains no personal information, (2) cannot be used to identify you as a natural person without additional data, (3) is technically necessary for the functioning of the billing system and protecting other users from dishonest actions, (4) the impact on your individual privacy rights is minimal given its anonymous nature, (5) the identifier protects our legitimate business interests and ensures fair access to the Service for all users.
Balancing test conducted: Our legitimate interest in fraud prevention (protecting revenue from in-app purchases, ensuring fair access for all users, detecting abuse patterns) outweighs the minimal impact on individual privacy rights because the identifier alone cannot identify natural persons without additional data that we do not collect or link to this identifier. The processing is necessary and proportionate to achieve our legitimate aims.
Justification of legitimate interest for server logs: Processing of IP addresses and technical data in server logs is necessary to ensure security of our systems, diagnose technical issues, detect and prevent attacks, and protect against abuse. This interest is balanced with your rights because: (1) IP addresses are retained for a limited period (12 months) and then automatically deleted, (2) data is used only for security, diagnostic, and fraud prevention purposes, (3) we do not link IP addresses to user accounts or other personal identifiers to create profiles, (4) the processing is a standard and expected practice for any web service, (5) without this processing, we would be unable to maintain the security and stability of the Service.
You have the right to object to processing based on legitimate interests under GDPR Art. 21, such as server log collection or the use of identifiers for fraud prevention. If you object, we will immediately cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. We will respond to your objection within 30 days.
We apply the following technical and organizational measures to protect your data:
While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but continuously work to protect your personal data using industry best practices.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
After the specified retention periods, personal data is either deleted or irreversibly anonymized.
We transfer your personal data to the following categories of recipients:
Data is transferred to Google when using:
Google processes data in accordance with their Privacy Policy.
International data transfers: Google may transfer and process your data outside the European Economic Area (EEA), including in the United States. These transfers are protected by appropriate safeguards, including:
For more information about Google's data transfer mechanisms, see Google's GDPR Compliance.
To host the Website, hosting provider services are used, which may have access to technical data (IP addresses, server logs).
The Application uses the following advertising networks and platforms to display advertisements:
Important: Because advertising mediation involves dynamic partner selection, we recommend reviewing the current list of CAS.AI partners periodically if you have concerns about specific ad networks. You can always opt out of personalized advertising in the Application settings, which will limit data sharing with advertising partners.
We may disclose personal data if required:
Important: We do not sell or transfer your personal data to third parties for commercial purposes.
When your personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place to protect your data:
Countries involved in data transfers: Your personal data may be transferred to and processed in the United States (Google services, advertising networks) and other countries where our service providers operate.
Cookies are small text files that are saved on your device when you visit the Website.
On the Website:
In the Application:
In accordance with EU ePrivacy Directive (2002/58/EC) and applicable national laws:
Your cookie consent choices:
You can manage your cookie preferences at any time:
Withdrawing cookie consent will not affect the lawfulness of processing based on consent before withdrawal, but may limit certain Website features.
In accordance with GDPR, you have the following rights regarding your personal data:
You have the right to obtain confirmation of whether your personal data is being processed, and if so, to obtain access to that data.
You have the right to request rectification of inaccurate personal data.
You have the right to request deletion of your personal data.
How to delete your account:
When deleting your account, the following will be permanently deleted:
Note: The client device identifier (userGuid) will remain locally on your device until the Application is uninstalled, as it is stored in the application's Preferences. You can completely delete it by uninstalling the Application from your device.
Important - Songs You Added: Songs that you added through the Website will remain available to other users, as they are part of the Service's publicly available database. However, to comply with your right to erasure, your username (authorship information) will be removed and replaced with "Deleted User" or similar anonymized designation. This ensures your personal data is deleted while maintaining the availability of publicly contributed content for other users.
If you want specific songs to be completely deleted (not just anonymized), you must delete them manually through the Website before deleting your account, or contact us at guitarsongs.club@gmail.com with specific song URLs prior to account deletion.
Voluntarily Submitted Logs: If you have previously sent diagnostic logs via email and wish to have them deleted, send a deletion request to guitarsongs.club@gmail.com with the subject line "Delete Submitted Logs". We will permanently delete all logs associated with your email address within 7 days.
You have the right to request restriction of processing of your personal data in certain cases.
You have the right to receive your personal data in a structured, commonly used machine-readable format and transfer it to another operator.
How to request data: send a request to guitarsongs.club@gmail.com. We will provide your data in JSON format within 30 days.
You have the right to object to the processing of your personal data based on the legitimate interests of the operator (Art. 6(1)(f) GDPR), including processing for server logs, fraud prevention identifiers, and similar processing activities.
How to exercise your right to object:
Note: If we cannot demonstrate compelling grounds to continue processing, your data subject to the objection will be immediately deleted or anonymized. In some cases, this may affect your ability to use certain Service features.
You have the right to withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
How to withdraw consent:
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates GDPR.
Lead supervisory authority (operator is based in Germany):
Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Str. 153
53117 Bonn, Germany
Phone: +49 (0)228-997799-0
Email: poststelle@bfdi.bund.de
Website: www.bfdi.bund.de
Alternative: You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. You can find your local data protection authority at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
To exercise any of the specified rights, contact us:
We will respond to your request within 30 days of receipt. In complex cases, the period may be extended to 60 days with notification of the reasons for the delay.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
Your California Rights:
Categories of Personal Information We Collect:
We do NOT sell personal information. We disclose the following categories to service providers for business purposes: Identifiers and Internet Activity (to Google for authentication, optional analytics, and advertising services).
Exercising Your California Rights:
We will verify your identity and respond to your request within 45 days. In complex cases, the period may be extended by an additional 45 days with notification. You may designate an authorized agent to make requests on your behalf by providing written authorization.
California "Shine the Light" Law: California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.
10.1. We implement robust technical and organizational measures to protect your personal data from unauthorized access, loss, destruction, or alteration. However, no security system is completely infallible.
10.2. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with GDPR Art. 34. The notification will include:
10.3. Notification methods:
Important: Due to our privacy-by-design approach (email addresses are stored only as SHA-256 hashes), we cannot send direct email notifications to registered users. Instead, we will notify you through the following channels:
This limitation is a direct consequence of our strong privacy protection measures. While we cannot proactively email you, the hashing of email addresses ensures that even in the event of a data breach, your actual email address remains protected and cannot be recovered by unauthorized parties.
10.4. We will also notify the relevant supervisory authority (BfDI in Germany) of any data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms.
10.5. We maintain documentation of all data breaches, including their effects and the remedial action taken, as required by GDPR Art. 33(5).
11.1. The Service is not intended for persons under 16 years of age.
11.2. We do not knowingly collect personal data from persons under 16 years of age. If we become aware that we have collected personal data from a minor without parental consent, we will take steps to delete such data.
11.3. If you are a parent or guardian and have learned that your child has provided us with personal data, please contact us at guitarsongs.club@gmail.com.
12.1. We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you, as defined in Art. 22 GDPR.
12.2. Analytics (optional): Firebase Analytics and Firebase Crashlytics use automated analysis to create statistics. This analysis does not result in decisions that affect you individually. For details, see separate consent documents.
12.3. Advertising Personalization: When you consent to personalized advertising, advertising networks (AdMob, CAS.AI partners) use automated processing to select ads based on:
This automated ad selection does not produce legal effects and does not significantly affect you in a way that requires human intervention under GDPR Art. 22. You retain full control and can:
12.4. No Profiling for Service Access: We do not create profiles that determine your access to features, pricing, or core functionality of the Service. All users have equal access to content and features regardless of their usage patterns or personal characteristics.
13.1. We reserve the right to change this Policy at any time to reflect changes in our practices, legal requirements, or Service features.
13.2. We will notify you of changes by one of the following methods:
13.3. For material changes that affect your rights or how we process your personal data (such as new purposes, new categories of recipients, or changes to legal bases), we will:
13.4. Continued use of the Service after non-material changes take effect constitutes your acceptance of the updated Policy.
13.5. The date of the last update is indicated at the beginning of this document.
14.1. For all questions related to the processing of personal data and this Policy, you can contact us:
Email: guitarsongs.club@gmail.com
14.2. We undertake to respond to your requests within 30 days of receipt.
15.1. This Policy is an integral part of the User Agreement.
15.2. In case of contradictions between this Policy and other documents, this Policy takes precedence in matters relating to personal data processing.
15.3. If any provision of this Policy is found to be invalid, the remaining provisions remain in force.
By using our Service, you confirm that you have read, understood, and agree to the terms of this Privacy Policy.