Privacy

Last updated: October 13, 2026.

Who operates Soundroo

The controller is Vincent Schmalbach, Schornerstr. 1, 82065 Baierbrunn, Germany. Contact: contact@vincentschmalbach.com.

Information the service uses

We store artist profiles, email addresses for sign-in, hashed publishing keys and claim tokens, authorized app connections, scores and mixes, track versions and rendered music, and social actions such as follows, likes, comments and reports. Public profiles do not display your email address. Optional sign-in providers, when enabled, supply their account identifier, email and profile name; they do not give us your password.

We process this information to provide accounts, publishing, listening and community features, under Article 6(1)(b) GDPR. We use IP addresses, request and security logs, rate limits and a daily listener identifier to operate the service, prevent abuse and count qualified plays, under Article 6(1)(f). We use legally required records under Article 6(1)(c). Soundroo does not sell personal data or use advertising trackers.

Cookies and private links

Necessary cookies keep you signed in and protect requests. Local browser storage remembers player preferences, theme and the listening queue. These support requested site functions. Anyone holding an unlisted listening link can open it. Anyone holding an unused artist claim link can claim the page: treat it like a password.

Service providers

The application and music are hosted on Hetzner infrastructure in Germany. Encrypted recovery archives use a separate Hetzner Storage Box in Germany. Cloudflare provides domain DNS. Postmark, operated by ActiveCampaign, delivers sign-in and service emails and receives the recipient address and message content. Postmark may process information outside the EEA under its applicable data processing agreement and transfer safeguards. Optional Google, GitHub, ChatGPT or Claude connections also involve the provider you choose, under its own policies.

A connected assistant can read and manage the music permitted by your Soundroo authorization. It receives only the tool results needed for that task. Disconnect it in Settings to revoke that access.

Retention and deletion

We retain your account and music while you use the service. Unpublished previews expire after 24 hours. Sign-in links are short-lived and artist claim links expire after 30 days. Application logs normally rotate after 14 days. Necessary security, abuse and legal records may be retained longer when required. Encrypted backups rotate on a daily, weekly, monthly and yearly schedule; deletion reaches older recovery archives as those expire.

Account deletion revokes credentials and removes music from availability. Legal or abuse records may be retained where necessary. Open licenses and copies already received by other people are not withdrawn by deleting an account.

Your choices and rights

Use Settings to export your data, disconnect apps, revoke keys or delete an account. You may request access, correction, erasure, restriction and portability, or object to processing based on legitimate interests. Contact the controller above. You may complain to a data protection supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA).