Privacy Policy

Non-binding courtesy translation. This English text is provided for your convenience only. The legally binding version is the German one: Datenschutzerklärung. In the event of any discrepancy, the German wording prevails. See also the terms and conditions in English.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Timothy Schulz
Düsseldorfer Straße 131
51063 Cologne
Germany

Email: support@squaresmile.de

2. Overview

Protecting your data matters to me. This website (squaresmile.de) is deliberately built to collect as little as possible: the public pages load no content from third-party servers. Fonts, icons, images and all program libraries are served directly from my own server (first-party). No tracking cookies and no third-party analytics scripts are embedded. For that reason, no cookie consent banner is required on the marketing pages.

Some features do call third-party services — but only if you actively use them (e.g. weather, notifications, embedded Spotify content) or for order processing when you make a purchase. Below I explain which data is processed in which case.

3. Hosting

This website is hosted by an external service provider (the host):

ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68, 02742 Friedersdorf, Germany

The host processes, on my behalf, the data generated when you visit the website (in particular server log files, see below). The servers are located in Germany. The legal basis is my legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR has been concluded with the host.

4. Server log files

When the website is accessed, the server automatically collects information transmitted by your browser and stores it in what are known as server log files. These are:

  • the address (URL) requested and the date/time of access
  • the volume of data transferred and confirmation of successful retrieval
  • browser type and version, operating system used
  • referrer URL (the page visited previously)
  • the IP address in truncated or anonymised form

This data is not merged with other data sources. Processing is based on Art. 6(1)(f) GDPR for the technical provision, security and stability of the website. Log files are stored for a limited period and then deleted.

4a. Tool usage counters (aggregated, anonymous)

In order to understand which tools are used and how often, the platform collects purely aggregated usage counters: for each tool, a daily count is kept of how often it was opened and which actions were performed in it (e.g. “opened”, “exported”). These counters deliberately use the same technique as the click counters already used for support links (see the section on server log files / internal statistics) and are subject to the same data-minimisation requirement.

No personal data is stored in the process — in particular no IP address, no user identifier, no cookie and no timestamp more precise than the calendar day. The counters are pure daily totals per tool and allow no conclusions about individual persons. They are not linked with other data sources. The legal basis is my legitimate interest in the basic statistical improvement of the service (Art. 6(1)(f) GDPR); consent is not required because no personal reference exists.

5. Contact by email

If you write to me by email (e.g. to support@squaresmile.de), I process the details you provide (email address, content of the message) in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR (for contract-related enquiries) or Art. 6(1)(f) GDPR (for other enquiries, legitimate interest in responding). The data is deleted as soon as it is no longer required and no statutory retention obligations conflict with deletion.

6. Registration and user account

You can create a user account to use the platform. On registration I process:

  • Name (a display name of your choosing, used among other things for the salutation in emails)
  • Email address
  • Password (stored exclusively in encrypted/“hashed” form)

I process this data in order to provide you with the account and its associated features. The legal basis is Art. 6(1)(b) GDPR (establishment and performance of the user relationship).

In addition, I store the time at which you accepted the terms and conditions and the privacy policy and — if you ticked the optional box — the time of your newsletter consent (see section 14). These timestamps serve as proof of the consent given and of the conclusion of the contract (Art. 7(1) GDPR, accountability under Art. 5(2) GDPR).

The account gives you limited storage (up to 50 MB) with which you can link content from the apps (e.g. saved projects) to your profile and back it up server-side. This content is stored on the host’s server (see section 3) in Germany, is assigned to your account and is removed when the account is deleted. For details, see section 13.

Your account also stores the licence keys of the premium products you have purchased, so that the corresponding features remain unlocked. The validity of these licence keys is checked with Gumroad (see section 8). The legal basis for storage is Art. 6(1)(b) GDPR (performance of a contract).

The data is stored for as long as your account exists. You can delete your account at any time or request deletion by email to support@squaresmile.de; the associated data is then deleted, unless statutory retention obligations conflict with deletion.

A technically necessary session cookie is used for signing in and maintaining your session. It is strictly necessary for login and requires no consent (Section 25(2) no. 2 of the German Digital Services Data Protection Act, TDDG).

7. Sending transactional emails

Functional emails (e.g. confirmations, system-related notifications) are sent via the SMTP server of my host ALL-INKL.COM – Neue Medien Münnich (address see section 3). The recipient’s email address and the content of the message are processed in doing so. Processing takes place in Germany; no transfer to a third country occurs. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in reliable delivery). Sending is covered by the existing data processing agreement with the host pursuant to Art. 28 GDPR.

8. Sale of tools and plugins via Gumroad

The sale of the paid tools and plugins (e.g. SoundSense, SetlistForge, SubPress) is handled via the platform Gumroad:

Gumroad, Inc., 548 Market St, San Francisco, CA 94104, USA

Gumroad acts as seller/reseller (merchant of record) and independently handles ordering, payment and invoicing. When you buy something, you enter your payment and billing details directly with Gumroad; from Gumroad I receive only the information necessary for order processing (e.g. email address and the product purchased).

In addition, the validity of licence keys is verified server-side with Gumroad (“licence validation”). The licence key you enter is transmitted to Gumroad and the result (valid/invalid) is returned. Purchase links also point to the product pages on Gumroad.

Processing takes place for the performance of a contract (Art. 6(1)(b) GDPR). As Gumroad is based in the USA, data may be transferred to the USA. Such transfers are based on the EU standard contractual clauses or — where applicable — on the EU-US Data Privacy Framework. Details: gumroad.com/privacy

9. Show Clock – weather data via Open-Meteo

The Show Clock feature can display weather data. This data is retrieved only if you use the weather display. To do so, a request is made to the weather service Open-Meteo (open-meteo.com); your IP address and the location/coordinates requested are transmitted to Open-Meteo in order to return the matching weather data.

The legal basis is my legitimate interest, respectively your active use of the feature (Art. 6(1)(f) GDPR). Further information: open-meteo.com/en/terms

10. Show Clock – notifications (web push)

The Show Clock can send you notifications (web push) if you enable them. This feature is opt-in: it only becomes active once you expressly allow it and confirm your browser’s notification request.

If you enable push notifications, your browser registers a push subscription with the push service of the respective browser/device manufacturer (e.g. Google for Chrome, Mozilla for Firefox, Apple for Safari). A technical subscription address (endpoint) is generated and stored, through which notifications are delivered. This is not intended to identify you personally.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can disable notifications again at any time in your browser settings. Delivery runs via the infrastructure of the respective browser/device manufacturer; their privacy policy applies in addition.

11. Embedded Spotify content (click to load)

In individual places, content from Spotify may be referenced. It is not loaded automatically. Instead, you initially see only a button (“Play on Spotify” with the note “Loads content from open.spotify.com”). Only when you actively click that button is a connection to Spotify established and the player loaded. No data is transmitted to Spotify before that.

By clicking, you consent to the content being loaded (Art. 6(1)(a) GDPR). From that moment, Spotify’s privacy policy applies: spotify.com/de/legal/privacy-policy. The provider is Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden.

12. Google Search Console

I use Google Search Console to monitor how the website can be found in Google Search. Search Console evaluates aggregated, anonymised data on how the website appears in search results (e.g. search terms, click and impression figures). No analytics script is embedded in the website and no cookies are set on your device; the data comes from Google Search itself. It does not enable me to identify individual visitors. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

13. Local storage in the tools (browser storage)

Many of the tools on squaresmile.de run entirely in your browser. Input and settings (e.g. setlists, stage plots, training progress) are — unless you expressly save them to your account — stored exclusively locally in your browser (e.g. via localStorage) and are not transmitted to my server. You can delete this local data yourself at any time by clearing your browser’s storage for this website. Local storage serves solely the function of the respective tool (Section 25(2) no. 2 TDDG, as it is strictly necessary for the service you have expressly requested).

When you are signed in to your user account, you can additionally save content server-side to your profile (limited storage of up to 50 MB, see section 6). This content is stored with the host (section 3) in Germany, is assigned to your account and serves to keep your work available and usable across devices. The legal basis is Art. 6(1)(b) GDPR (performance of the user relationship). When your account is deleted, this content is deleted as well.

Note on confidentiality: Content saved server-side is stored unencrypted in the database; there is no end-to-end encryption. It is therefore visible to me as the operator and technically to the host (see section 3). Access only takes place where it is necessary for operating the service — for example to investigate a fault at your request, to restore data after an incident, or to comply with legal obligations. The administration interface does not display the contents of your tool data. Content that stays exclusively in your browser (see above) is not affected. Please do not save information server-side that you consider particularly confidential.

Certain particularly sensitive data is deliberately refused by the server: the hearing profile (audiogram) from SoundSense constitutes health data within the meaning of Art. 9 GDPR and is rejected server-side — it remains exclusively local to your browser.

14. Newsletter and product updates

During registration you can voluntarily tick the box “Send me occasional updates about new tools by email”. The box is not pre-selected, and consent is not a condition of registering or of using the platform. You can also give or withdraw it at any time later in your account under email preferences.

Data processed: your email address and the time of your consent; the name stored in your account may be used for the salutation. No separate mailing list is kept — the recipients follow from the consent timestamp on your user account. The legal basis is your consent under Art. 6(1)(a) GDPR.

Sending: Emails are sent from my own platform via the mail server of my host ALL-INKL.COM in Germany (see sections 3 and 7). I use no external newsletter service (e.g. Mailchimp, Brevo, CleverReach); your address is therefore not passed on to any further recipient for this purpose. The emails contain no tracking pixels and no open or click tracking.

Confirming your address: Consent is given inside your password-protected user account, and your email address is verified via a confirmation link during registration anyway (see section 7). I therefore do not send an additional confirmation email for the newsletter alone (a separate double opt-in).

Withdrawal: You can withdraw your consent at any time with effect for the future — using the checkbox in your account’s email preferences, using the “manage your email preferences” link at the end of every such email, or informally by email to support@squaresmile.de. On withdrawal, the stored consent timestamp is deleted and you receive no further updates. The lawfulness of processing carried out up to the withdrawal remains unaffected.

Transactional emails (e.g. email address confirmation, password resets, licence and account information) are independent of the newsletter. They are necessary for the performance of the user relationship and are sent regardless of this consent (see section 7).

15. Recipients of the data / processors

Your data is passed on only to the extent necessary for the performance of the contract, for the functioning of the features you use, or for the operation of the website, to the following recipients:

  • ALL-INKL.COM – Neue Medien Münnich (hosting and the sending of transactional and newsletter emails, Germany)
  • Gumroad, Inc. (order processing and licence validation for the paid products, USA)
  • Open-Meteo (weather data in the Show Clock, only when used)
  • The push service of the respective browser/device manufacturer (web push notifications, only if opted in)

16. Your rights

Under the GDPR you have the following rights regarding your personal data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

An informal email to support@squaresmile.de is enough to exercise them.

17. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

18. Currency of this policy

This privacy policy is adapted whenever something changes in the data processing (e.g. when new services or new features are integrated).

Last updated: August 2026 — non-binding translation of the German Datenschutzerklärung.