Privacy policy

1. Controller

Rüdiger Ude
Breslauer Str. 2
30982 Pattensen
Germany

Email: ed [tod] kettu [ta] edu.regideur

No data protection officer has been appointed (not legally required).

2. Hosting and server log files

The website is hosted by Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Deutschland. The host processes data on my behalf (Art. 28 GDPR) on servers in Germany. Whenever a page is requested, the web server necessarily processes: IP address, date and time, requested address, status code, amount of data transferred, referrer and browser identifier (user agent). These server logs are used for delivery, security and troubleshooting and are deleted or anonymised by the host after a short period. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).

Emails (confirmation, password and contact emails) are sent via the host’s mail server or a mailbox configured there.

3. Cookies and local storage

Only technically necessary cookies are set (§ 25(2) no. 2 TDDDG); no consent is required for these:

• mp_sess – session cookie for login and form protection (CSRF); deleted when you close the browser.
• lang – the language you chose (12 months).
• tz – your browser’s time zone so that events are shown in your local time (12 months).

There are no advertising, tracking or analytics cookies and no social media plugins.

4. Visitor statistics without cookies

For simple, self-hosted reach statistics the following is stored per page view: day, page, domain of the referring page, device/browser/operating-system class, browser language, chosen language and a region estimated from the browser language. To count a day’s visitors, a hash is generated from IP address, browser identifier and a random key that changes daily, and then truncated. The IP address and browser identifier themselves are not stored; the key is overwritten daily, so hashes can neither be reversed nor linked across days. Raw data is deleted after 30 days; only daily totals remain. Bots and logged-in admins are not counted. Nothing is stored on or read from your device. Legal basis: Art. 6(1)(f) GDPR (interest in improving the service).

5. Registration and user account

For an account I process: display name, email address, password (only as a secure hash), country, instruments, chosen language and the time of registration and of acceptance of the terms. Optionally you can provide: city and date of birth (each visible to “public” or “friends only”), profile text, profile picture, header image and a stream channel. Display name, country, instruments, profile text and images are public – also to visitors who are not logged in and, once the site is indexed, to search engines. Your email address is never public.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Data is stored until you delete your account.

6. Emails: confirmation, password, address change

After registering, for “forgot password” and when changing your email address, you receive an email with a one-time link. Only a hash of that link with an expiry time is stored. To prevent abuse, requests are counted briefly; for this a hash of the IP address or email address is created and deleted after 24 hours at the latest. Legal basis: Art. 6(1)(b) and (f) GDPR.

7. Songs, tracks and audio uploads

When you create songs or upload tracks (audio files), I store the files together with title, description, genre, tempo, key, instrument and time. Songs and tracks can be played publicly and are linked to your profile. If you upload a track to someone else’s song, it becomes part of that song and is visible to its creator and all visitors. If a song is deleted – including by deletion of the creator’s account – all its tracks are deleted too. Legal basis: Art. 6(1)(b) GDPR.

8. Likes, plays and charts

Likes are stored with your account until you remove them or delete your account. Plays are counted without any link to an account or IP address: per song and day only a truncated hash with a daily changing key is stored (one play per person and day); raw data is deleted after 70 days. Weekly charts contain only totals. Legal basis: Art. 6(1)(f) GDPR.

9. Messages, friends and blocking

For the chat I store conversations, participants, messages, read status as well as friendships, friend requests and blocks. Messages are only visible to the participants of the conversation (in band chats to all band members). They are not end-to-end encrypted. I only see messages if they are reported – and then only the reported message. Legal basis: Art. 6(1)(b) GDPR; reports: Art. 6(1)(c) and (f) GDPR.

10. Bands, events, releases and videos

Bands (name, text, genre, location, logo, header image, members with role, invitations, join requests, “looking for”), events (title, description, time, place or online link, cover image, “I’m going”, “I’m live now”), releases and videos are public if you create them. “I’m going” is visible to others. Legal basis: Art. 6(1)(b) GDPR.

11. Notifications

You are notified on the website about activities (e.g. new tracks, friend requests, band invitations, events). You choose which notifications you receive in your profile settings. Notifications are deleted after 90 days. Legal basis: Art. 6(1)(b) GDPR.

12. YouTube and Vimeo videos (only after a click)

Videos are not loaded automatically. The preview image is stored and served by my server; opening the page creates no connection to YouTube or Vimeo. Only when you click “Play” is the player loaded from YouTube (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; via youtube-nocookie.com) or Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA; with “Do Not Track”). In doing so, your IP address and browser data, among other things, are transmitted to the provider; the provider may set cookies and transfer data to the USA. The basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG), valid only for that playback. For the USA an adequacy decision exists (EU-US Data Privacy Framework) insofar as the provider is certified. Privacy information: Google, Vimeo.

13. External links, streams and calendar

Links to streaming, music and shop platforms, live streams and “Add to Google Calendar” are ordinary links: only when you click them do you visit the provider’s site, which then processes data under its own responsibility (for Google Calendar also the event’s title, time and place). The calendar file (.ics) is downloaded directly from Uttek Jam.

14. Fonts

All fonts (Inter, Fraunces) are loaded from this server. There is no connection to Google Fonts or other font services.

15. Contact form and reports

If you use the contact form or report content, I process name, email address, category, message, where applicable the reported content and – if you are logged in – your account. The request is stored in the database and forwarded to me by email. Completed requests are deleted after 365 days unless retention is necessary for legal defence. Legal basis: Art. 6(1)(b), (c) (notice-and-action procedure under Art. 16 DSA) and (f) GDPR. The person reporting is not disclosed to the person concerned unless required by law.

16. Beta phase: invite codes and invite requests

During the closed beta, registration is only possible with an invite code. When a code is redeemed, I store which code was used by which account and when (legal basis: Art. 6(1)(b) and (f) GDPR – running and managing the beta). This link is deleted together with the account.

Without a code you can request an invite. For this I store your email address, the optional name, main instrument and message, the chosen language, and the time and status of the request. The sole purpose is to process the request and send you a personal invite link by email; you receive a confirmation of receipt, and I am notified of new requests by email. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by writing to ed [tod] kettu [ta] edu.regideur. Declined, unprocessed and completed requests are deleted automatically no later than 90 days after receipt or decision, immediately upon withdrawal. An unused invite link expires after 14 days. There is no newsletter and no disclosure to third parties.

17. Feedback feature (beta)

Signed-in users can send bugs, ideas or praise via the “Feedback” button. Stored are: your account, type and text of the message, the address of the current page, the browser identifier (user agent), screen and window size, the selected language and – if you upload one – a screenshot. Please make sure a screenshot does not contain other people’s data. Feedback is stored in the database, visible to admins only and forwarded to me by email. It is deleted once it has been dealt with and is no longer needed, at the latest when the beta ends or together with your account. Legal basis: Art. 6(1)(f) GDPR (interest in fixing bugs and improving the service).

18. Moderation and security

To enforce the terms of use, I log moderation actions (e.g. bans, hiding, deletion) with time and reason. Legal basis: Art. 6(1)(c) GDPR (obligations under the DSA) and (f) GDPR.

19. Recipients and third countries

Data is not sold and not passed on for advertising. Recipients are only the host (processor) and – where legally required – authorities. No transfer to third countries takes place, except when you start a YouTube or Vimeo video by clicking or open external links.

20. Retention and deleting your account

I store data only as long as necessary for the purposes stated. You can delete your account yourself at any time under Account & data. This deletes your profile, images, your own songs with all their tracks, your tracks on other people’s songs, messages, friendships, events, releases, videos and likes. Bands without other members are dissolved. The host’s server backups are overwritten on a regular cycle.

21. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Many rights you can exercise yourself: edit your profile, export your data (JSON) and delete your account. Otherwise, a message to ed [tod] kettu [ta] edu.regideur is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the authority competent for me: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover (www.lfd.niedersachsen.de).

22. Minimum age

Uttek Jam is intended for people aged 16 and over. Younger people may not register. If I learn that an account belongs to a younger person, it will be deleted.

23. Obligation to provide data, no automated decisions

The required fields are necessary for registration; without them no account can be created. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. Suggestions such as “Matches you” are based only on your instruments.

24. SSL/TLS encryption

Data is transmitted encrypted (HTTPS).

25. Changes

I will update this privacy policy when the website or the law changes. The version published here applies.