Privacy policy

1. Controller

IT-Secrets – Christian Gehring
Glockenstr. 12
66957 Vinningen
Germany

No data protection officer has been appointed, as the legal requirements for doing so are not met.

2. Overview

This policy covers the website www.midi-player.de and the GigBox app (iPad and iPhone). GigBox has no user accounts and shows no ads. The website sets no cookies and uses no analytics tools. The German version of this policy is binding.

3. Website: hosting and server logs

The website is hosted by Netlify, Inc. (San Francisco, USA). When you visit, the host processes technically necessary data: IP address, date and time, page requested, referrer and browser identifier. This is required to deliver the site and protect it from abuse (Art. 6(1)(f) GDPR). A data processing agreement is in place with the host (Art. 28 GDPR). Transfers to the USA are based on the European Commission's standard contractual clauses (Art. 46 GDPR). The host deletes the logs after a short period.

4. App: usage statistics (Firebase Analytics)

The app uses Google Analytics for Firebase by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand which areas of the app are used. Collected are: areas opened and time spent, sessions, a random app instance ID, device model, OS and app version, language and a coarse location (country/region) derived from the IP address. The full IP address is not stored. The advertising identifier (IDFA) is not collected and ad personalisation is off. No content is collected – no songs, lyrics, setlists or file names.

The legal basis is our legitimate interest in improving the app (Art. 6(1)(f) GDPR). You can switch the statistics off at any time in the app under Settings → Privacy; after that no data is sent. Google may transfer data to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses. Data is kept for no more than 14 months.

5. App: data held by Apple

Library, setlists, settings and backups are stored on your iPad or, if you use iCloud Drive, in your iCloud storage with Apple. We have no access to them.

Purchases go through the App Store. We do not receive payment data; the app only checks whether a purchase exists.

In the TestFlight beta, Apple passes on the data you share there: email address or name from the invitation, feedback, screenshots and crash reports. We use them only to fix bugs (Art. 6(1)(f) GDPR).

6. App: lyrics display

“Stream lyrics” sends the lyrics encrypted directly between your devices on the local network. There is no server and no data is sent to us.

7. Contact by email

If you write to us, including via “Feedback by mail” in the app, we process your message and the details it contains (app version, iPad model, instrument) to answer it (Art. 6(1)(b) and (f) GDPR). We delete the message once it is resolved and no retention obligation applies.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). Write to cg@it-secrets.de. You may also lodge a complaint with a data protection supervisory authority.

9. Changes

We update this policy when the app or the law changes. Last updated: 1 November 2026.