Privacy Policy

📅 Last updated: September 2026 🔒 100% Privacy • Zero Tracking • No Cookies

1. Privacy at a Glance

The protection of your personal data is a top priority for SongFlip. This Privacy Policy informs you about what data is processed when using our website (songflip.link) and the mobile applications SongFlip for Android and iOS.

2. Data Controller

Responsible for data processing on this website and in the app:

Daniel Notthoff
Rudolf-Virchow-Str. 20
58300 Wetter
Germany
Email: hey@goork.de

3. Data Processing in the SongFlip Mobile Apps (Android & iOS)

a) Zero Data Collection Policy & No User Account

SongFlip operates strictly on the principle of data minimization (Zero Data Collection). The app operates 100% without user accounts or registration. No personal data, user names, contact information, precise location data, or advertising identifiers (Advertising IDs) are collected, stored, shared, or sold to third parties.

b) Third-Party Services & Interfaces (Song URL Resolution & Fallbacks)

When you tap or share a music link (e.g. from Spotify, Apple Music, YouTube Music, TIDAL, Deezer, Amazon Music, SoundCloud, Bandcamp, or Shazam) on your Android or iOS device, SongFlip intercepts the URL locally. To resolve the matching track in your preferred music player, SongFlip connects to the following interfaces:

• Odesli / Songlink (api.song.link / song.link):
  Purpose: Resolving and mapping music URLs across supported streaming services.
  Data: Exclusively the transmitted song URL. For technical reasons, when connecting to the APIs, the IP address of your device is transmitted to the servers of the respective interface providers in order to deliver the response. No combining with user profiles or storage by SongFlip takes place.
• Public Metadata Endpoints (Fallback Interfaces):
  If additional track or album details are needed for accurate matching or redundancy, SongFlip queries standardized public metadata endpoints:
  • Apple iTunes Search & Podcast Lookup API (itunes.apple.com): Public Apple API for track and album titles.
  • Spotify OEmbed (open.spotify.com/oembed): Public Spotify standard for track information.
  • Deezer API (api.deezer.com): Metadata for Deezer tracks and playlists.
  • YouTube OEmbed (youtube.com/oembed): Track and channel metadata.

During these API requests, only standard technical song identifiers (such as the track ID or song URL) are transmitted over an encrypted HTTPS connection. No listening history is tracked or tied to your identity. Legal basis is Art. 6 (1) (b) GDPR (provision of the requested application functionality).

c) Anonymous High-Speed Server Cache (L2) & Universal Smart Links (songflip.link/s/... & songflip.link/p/...)

To accelerate song queries (L2 Cache) and host universal web links (songflip.link/s/... & songflip.link/p/...), only non-personal, publicly available song metadata (title, artist, cover art URL, streaming identifiers) is cached under an anonymous hash on our servers. No IP addresses are permanently stored, and no user profiles, device IDs, or listening habits are tracked or collected. Shared web links remain active for at least 90 days after their last visit. Each access automatically extends availability by another 90 days, while inactive links without visits for over 90 days are automatically purged.

d) iOS Integrations: Share Extension, App Intents, Auto-Clipboard & Local History

e) In-App Purchases (Google Play & Apple App Store)

If you purchase optional SongFlip PRO features, payment and transaction processing are handled via the in-app purchase systems of Google (Google Commerce Limited) or Apple (Apple Inc.). SongFlip itself does not collect or store any payment details (such as credit card or bank information). The app merely receives an anonymized transaction confirmation (purchase receipt / receipt token) to unlock the PRO features locally on your device. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

f) System Permissions (Android & iOS)

SongFlip operates strictly as a zero-permission utility: it requests no sensitive permissions on iOS (no access to Contacts, Photos, Camera, Location, or Microphone) and no Accessibility Services on Android. Redirection is handled exclusively via native Android Intent-Filters and encrypted HTTPS metadata queries.

4. Data Processing on this Website

a) Hosting & Server Infrastructure

This website is hosted on servers of Contabo GmbH (Hans-Pinsel-Str. 9b, 85540 Haar, Germany). When visiting our website, technical log data and IP addresses of your device are processed by the hosting provider.

Processing is based on our legitimate interest in providing a secure, stable, and efficient online service (Art. 6 (1) (f) GDPR). We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with Contabo GmbH.

b) Server Log Files

Our web server automatically collects and stores standard technical information that your browser transmits (e.g. browser type, operating system, referrer URL, time of server request). This data is processed exclusively to ensure system stability and security (Art. 6 para. 1 lit. f GDPR).

c) Privacy-Friendly Analytics (Umami)

We use a self-hosted instance of Umami Analytics to anonymously measure visitor numbers and interactions (such as button clicks). Umami does not use tracking cookies, does not collect personal identifiers, and does not track users across websites. Your IP address is immediately anonymized.

5. Your Rights

Under the GDPR, you have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority.