Privacy policy

Controller

The controller responsible for processing personal data under the General Data Protection Regulation (GDPR) is:

There is no legal obligation to appoint a data protection officer.

Principles

tap and prac is built so that as little data as possible leaves your device. The app needs no user account, shows no advertising and contains no third-party analytics, tracking or advertising services. I do not sell data, create user profiles or make automated decisions about you. Statistics – including PDF exports – are created only on your device.

Data on your device

Everything you create in the app is stored on your device, for example:

• exercises and pieces with description, photo or handwritten note,
• your profile (optional, e.g. first name and instrument) and your settings,
• your practice sessions with practice times, notes and ratings (“How did it go?”).

I have no access to this data. If you delete the app, it is removed from the device.

Backup in your private iCloud

If you are signed in to iCloud with your Apple Account, the app backs up your data and your own photos and notes in your private iCloud storage (iCloud key-value storage and private CloudKit database), so they come back after reinstalling or on a new device.

This data is stored in your personal iCloud account – only you have access; I cannot see it. Storage is provided by Apple under your agreement with Apple; Apple’s privacy policy applies. You can turn off the backup for tap and prac in iOS Settings under “[your name] → iCloud”.

Legal basis: Art. 6(1)(b) GDPR (providing the feature you use).

Teacher access (optional)

If you turn on “Allow teacher access”, your teacher can add pieces for you in their own app using an access code and password (or QR code). For this, the following is stored in the app’s public database at Apple (CloudKit):

• the access code and check values derived from the password – the password itself is not stored,
• the label you choose (e.g. first name and instrument) and the teacher’s name,
• the shared practice programme: titles, descriptions and intensity of pieces, notes from teacher and student, and times of changes,
• photos and handwritten notes the teacher shares for a piece,
• the teacher’s name and the time they agreed to the rules for teacher access and – if photos or notes are shared – to the rules for photos and notes.

When turning it on, you confirm the terms of use for teacher access and that you are at least 16 or your parents agree. The time is stored only on your device.

Your practice times, sessions, ratings and statistics are not transferred – they stay private.

The entries can only be found with the access code and password. Changes made by the teacher are digitally signed so that the app only accepts genuine changes. Transmission is encrypted. In the teacher’s app, the accesses of their students (code and label) are stored on the teacher’s device.

You can end teacher access at any time in Settings. Your entry is then deleted, and your teacher’s entry can no longer be reached. On request I will delete any remaining entries completely – an email is enough.

Legal basis: Art. 6(1)(b) GDPR (the feature you requested for exchanging with your teacher).

Teacher photos and notes

• Before sharing a photo or handwritten note for the first time, a teacher agrees to rules: teaching material only, no photos of people, no inappropriate content.
• Photos are deleted automatically 3 weeks after they were added – on both devices and in the database (in the teacher’s entry at the latest when the teacher opens the app again).
• Handwritten notes remain until the teacher removes them or the access ends.
• Students can report and permanently hide a teacher’s photos and notes. They are not backed up to the student’s private iCloud.

Automatic on-device check

Teacher photos and notes are checked automatically before sharing and again before they are shown – using Apple’s “Sensitive Content Analysis” (nudity detection, if Sensitive Content Warning or Communication Safety is turned on in iOS Settings) and Apple’s image analysis “Vision” (e.g. detection of people, staff lines and text).

The check runs only on the device. Neither images nor results are sent to me or third parties. Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is protecting users – especially minors – from inappropriate content.

Permissions

The app only asks when a feature needs it. You can change all permissions at any time in iOS Settings.

• Camera: only to scan the QR code for teacher access. No images are stored.
• Photos: the app only receives the photos you select in the picker.
• Calendar: on request, the app adds finished practice sessions as events (write-only access). It does not read your calendar.
• Notifications: reminders, e.g. about pieces you haven’t practised for a while, are scheduled on the device.

PDF export

The app can create statistics as a PDF. This happens only on your device; the file is only passed on if you share it yourself – for example by email, AirDrop or to the Files app.

Contact and reports by email

If you write to me – with a question or via “Report” on a teacher’s photo, note or message – I process your email address and the content of your message to handle your request. The prepared report contains the title of the piece, the teacher’s name, the access code, the date and, for text notes and messages, the (shortened) text. You see it before sending and can change it. The report is sent via your own email app.

Legal basis: Art. 6(1)(b) or (f) GDPR (handling your request, protection against misuse). For the mailbox tapandprac@icloud.com I use iCloud Mail by Apple. I delete messages once they are dealt with, unless statutory retention obligations apply.

App Store and crash reports

The app is distributed via Apple’s App Store. Apple is responsible for downloads and any purchases; Apple’s privacy policy applies.

If you have turned on “Share with App Developers” in iOS Settings, Apple provides me with anonymised crash reports and usage statistics. They do not identify you and help fix errors.

This website

Hosting: this website runs on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data – IP address, date and time, page requested and browser information – to deliver the site and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). A data processing agreement is in place with Cloudflare.

No cookies, no analytics: the website sets no cookies, uses no analytics tools and loads no third-party content. The typeface is hosted locally.

Offline use: the website can be added to your home screen as an app. A so-called service worker stores the pages in your browser’s storage so they can be read without internet. This data stays on your device and can be deleted in your browser settings. The storage is strictly necessary for this feature you requested (Section 25(2) no. 2 TDDDG).

Recipients and third countries

• Apple – as processor for the public CloudKit database of teacher access (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland).
• Cloudflare – hosting of this website.

Data may be processed in the USA. Apple Inc. and Cloudflare, Inc. are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). I do not pass on data beyond this.

Retention

• Data on your device and in your private iCloud: until you delete it or remove the app.
• Teacher access: until you end the access; teacher photos for at most 3 weeks.
• Emails: until your request is dealt with, unless retention obligations apply.
• Website server logs: short-term, according to Cloudflare’s policies.

Children and young people

tap and prac can also be used by children and young people; most features store data only on the device. If you are under 16, please use teacher access only with your parents’ consent. Parents can contact me at any time to request information or deletion.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: where I process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An email to tapandprac@icloud.com is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.

Changes

If the app or the legal situation changes, I will update this policy. The version published here applies. In case of doubt, the German version prevails.