Privacy policy

1. Controller

The controller under the GDPR for this website and for data processing in connection with sales, license management and the app's online services is the distributor:

Pondstack Software
Owner: Jürgen Frosch
Segeberger Chaussee 162
22851 Norderstedt
Germany
Email: info[at]pondstack.com

The app is developed by Mathias Fiedler – Maui Media ART. The developer does not receive any personal data of users; the distributor forwards support requests only as far as necessary to solve a technical problem, and where possible without name and email address.

2. In short

• The website uses no cookies and no third-party tracking, and loads no external fonts or maps. We count visits with our own self-hosted analytics, without cookies and without storing your IP address. Videos on the news page are only loaded from YouTube after you click.
• The app processes music locally only. Audio, song titles, file names and libraries never leave your computer.
• The app only goes online for licensing, update checks, news and – if you switch them on – the community feature and AI.

3. Visiting this website

Hosting. The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in the EU. Hetzner processes the data on our behalf (Art. 28 GDPR).

Server logs. For every request the web server stores technically necessary data: IP address, date and time, requested address, amount of data, status code, referrer and browser identifier. The purpose is secure and stable operation (e.g. defending against attacks, troubleshooting). Legal basis: Art. 6 (1) (f) GDPR. Logs are deleted automatically after 14 days.

Language setting. If you choose German or English, your browser remembers this in local storage. The value stays on your device and is not sent to us (§ 25 (2) no. 2 TDDDG). You can delete it in your browser settings at any time.

Version display. When loading, the page requests the current version number from this server. No data about you is transmitted.

Visitor analytics. To understand which pages are read, where visitors come from (e.g. a search or an ad) and how often download or purchase links are clicked, we use the open-source software Umami. It runs on our own server at Hetzner Online GmbH in the EU; there is no third-party provider. The analytics sets no cookies and does not access your device. We record the page visited, the referring page, browser, operating system, device type, screen size, language and the country derived from the IP address. The IP address itself is not stored; an anonymous identifier is derived from it and the browser identifier and changes daily, so you cannot be recognised across several days. If “Do Not Track” is enabled in your browser, no counting takes place. The legal basis is our legitimate interest in designing the website according to demand (Art. 6 (1) (f) GDPR). You can object at any time: Switch off analytics in this browser. Your choice is stored in your browser's local storage for this.

News and YouTube videos. The news page loads its posts from this server. If a post contains a YouTube video, we first show only a preview area; only when you click it is the video loaded via youtube-nocookie.com from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In particular your IP address and device information are transmitted to Google, including to third countries such as the USA. The legal basis is your consent by clicking (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without a click no connection to YouTube is made. Google's privacy notice: policies.google.com/privacy.

Download and purchase. Downloads are served from this server; purchases run through FastSpring's checkout on this site. Their privacy notices apply there (pondstack.com/datenschutz, fastspring.com/privacy).

Contact form. You can write to us at musaik.info/kontakt. We process your first and last name, email address, topic, subject and message in order to answer your request (Art. 6 (1) (b) or (f) GDPR). The message is delivered to our mailbox via Cloudflare's email service (see section 5, “Service provider”); depending on the topic to support, to the distributor (Pondstack) or to the developer. Like the license management, the form is protected against bots by Cloudflare Turnstile. We delete the data as soon as it is no longer needed and no retention obligation applies.

Email. If you write to us, we use your details only to handle your request (Art. 6 (1) (b) or (f) GDPR) and delete them once they are no longer needed and no retention obligation applies.

4. The app: local processing

The app processes the following data only on your device: selected audio files and their metadata, analysis results, separated stems, projects and settings, playlists read from rekordbox or Serato, and your license key. Neither the distributor nor the developer has access to them. No user account is needed.

5. Purchase and license

Purchase. The seller is FastSpring (Bright Market, LLC dba FastSpring, Bright Market LLC dba FastSpring Limited and/or FastSpring B.V., 801 Garden St. #201, Santa Barbara, CA 93101, USA) acting as merchant of record. Which of these companies becomes the contracting party depends on the payment method. FastSpring processes payment and billing data under its own responsibility. The distributor receives the data needed to create the license and for accounting (in particular email address and purchase information). Legal basis: Art. 6 (1) (b) and (c) GDPR. This data is kept for the statutory retention periods (up to 10 years).

Trial. When the 14-day trial starts, the app sends an anonymous device hash (SHA-256 of a device identifier and an app-internal salt, not reversible) to the license service. Only the date of the trial start is stored with it. The purpose is to limit the trial per device; legal basis Art. 6 (1) (f) GDPR. The check runs at most once a day and stops once a purchased license is active.

Activation and device management. On activation and renewal the app sends an identifier derived from the license key (a hash; the key itself is not transmitted), an anonymous device hash and the device name, so you can tell your devices apart in the app. The dates of first and last activation are also stored. The purpose is to limit use to three devices and to prevent key sharing; legal basis Art. 6 (1) (b) and (f) GDPR. When you release a device, its data is deleted.

License management on this website. At musaik.info/lizenz you can request your license key again and release devices. To do so you enter your email address; the license service checks whether there are purchases for this address and, if so, sends you a sign-in link (valid for 30 minutes, usable once). The form is protected against automated requests by Cloudflare Turnstile: when the page loads, your browser loads a check script from Cloudflare that evaluates technical characteristics of the browser and the IP address to tell humans from bots; the legal basis is our legitimate interest in preventing abuse (Art. 6 (1) (f) GDPR). Only the link (as a hash) and your sign-in (for at most 60 minutes) are stored temporarily, plus the date and time of each device release in order to limit releases to three per key within 30 days; these entries are no longer taken into account after 30 days. After signing in, your key is shown on the page; no key is sent by email. Apart from the link, the sign-in email contains no license or purchase data; it is sent via Cloudflare's email service (see “Service provider”), which processes your email address as the recipient for this purpose. Legal basis Art. 6 (1) (b) and (f) GDPR.

Service provider. The license service, the sending of license emails and the bot check (Turnstile) run on Cloudflare, Inc. (USA; database in the Western Europe region). Cloudflare technically processes the IP address of the request. A data processing agreement is in place; transfers to the USA are covered by the EU-US Data Privacy Framework and EU standard contractual clauses.

6. Update check and news

The app can fetch a version file and a news file from musaik.info (older versions ask pondstack.com and are redirected from there). This involves technical connection data (IP address, time, requested file) and the installed version, no other identifiers. The app sends neither licence nor usage data: which news apply to you (for example an offer for a mode you do not have yet) is decided by the app solely on your device. Legal basis: Art. 6 (1) (f) GDPR. Update check and news can be switched off in the settings.

7. Community feature (optional, consent only)

If you correct the structure detection of a track, you can share the correction and receive verified corrections from others. The feature is off by default and only becomes active after your explicit consent (Art. 6 (1) (a) GDPR); you can withdraw consent at any time in the settings.

Only analysis values are transmitted: an acoustic fingerprint (a sequence of numbers from which no audio can be reconstructed), section boundaries and labels, a vocal indicator per section, tempo, first downbeat, key, loudness and the app's previous estimate. Not transmitted: audio, file or song names, artists, paths or playlists.

Only with additional consent (“Also share measurements”, since October 2026): the per-bar measurements the detection decides from (strength of drums, kick, hi-hats, bass, vocals and pads, brightness and energy – numbers, no audio), and a confirmation when the automatically detected sections are used unchanged for arranging or exporting. This data is used to improve the structure detection for all users. The legal basis is again consent (Art. 6 (1) (a) GDPR); it can be withdrawn separately in the settings.

When first switched on, a pseudonymous ID is calculated from the license key using a secret server key (HMAC). The email address is not stored; afterwards the app only uses a random access token. “Delete submissions” in the settings removes all your submissions and the token.

Independently of this, the app can fetch highly aggregated structure statistics without any reference to tracks or persons (Art. 6 (1) (f) GDPR); this can also be switched off.

8. AI feature (optional)

The AI feature is off by default. In the settings you decide which route is used:

• On the Mac / local model (Apple, Ollama, LM Studio): no data is transmitted.
• Your own access to an external service (e.g. OpenAI, Anthropic, Google Gemini, OpenRouter or a custom address): the app sends your instruction and musical song data – such as key, tempo, chord progression, sections and notes. Audio, song titles and file names are never sent. The data goes directly from your computer to the service you chose; neither the distributor nor the developer receives it. The service processes it under its own privacy terms, possibly outside the EU. Your API key is stored in the macOS keychain.

“What is sent?” shows you the exact data of a request in advance. The legal basis is your consent by switching the feature on (Art. 6 (1) (a) GDPR), which you can withdraw at any time by switching it off.

9. Demo tracks and sample packs

If you download demo tracks or sample packs, they are fetched from musaik.info. Only technical connection data is involved (Art. 6 (1) (f) GDPR).

10. No third-party tracking

Neither the website nor the app contains third-party analytics or tracking libraries, ad networks or profiling. The website only uses our own cookie-free visitor analytics described in section 3. The app does not collect crash reports; anything you send to Apple via macOS is governed by Apple.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent at any time with effect for the future. A message to info[at]pondstack.com is enough.

You may also lodge a complaint with a supervisory authority, for example the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

12. Security

All connections to the website and services are encrypted (HTTPS/TLS). Data stored locally is protected by your Mac's security features; we recommend FileVault and regular backups.

13. Children

The website and app are not directed at children under 16.

14. Changes

This policy will be updated when the website, the app or the law changes. The current version is available at musaik.info/datenschutz.