Data Privacy

1. Controller and scope

The controller responsible for TuneSwiper is:

Gerd Hoeschen
Nerdbomb Promotion | otticmedia
Sole business / Einzelunternehmen
Westerwaldstrasse 35
53489 Sinzig-Westum
Germany
Email: info@tuneswiper.com

Privacy requests can be sent to privacy@tuneswiper.com or by post to the address above. Further provider details appear in the Imprint.

This notice covers the homepage, the contact form and its associated services: New Streams, Collection, Spotify Search, Hit or Miss, Vinyl Millionaire and Promotion, including their related pages and features.

2. Purposes and legal grounds

Information is used to deliver requested features, manage accounts and access, retrieve music information, play media, operate games, publish promotion pages, handle feedback and protect the service. Requested account/service functions generally rely on Article 6(1)(b) GDPR. Security and reliable operation may rely on Article 6(1)(f), subject to a necessity and interests assessment. Legal obligations rely on Article 6(1)(c). Optional processing requiring consent relies on Article 6(1)(a).

Using a feature is not blanket consent to unrelated tracking. Device storage/access requires consent under section 25 TDDDG unless a statutory exception applies. The implementation must allow refusal of optional processing.

3. Hosting and technical requests

The host is ALL-INKL.COM – Neue Medien Münnich, Inhaber René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Requests can include an IP address, time, requested resource, response status, browser/device information and referrer where supplied by the browser. They support delivery, troubleshooting and security.

The applicable hosting processing agreement, configured log fields and deletion periods must be verified. No unverified fixed log-retention period is claimed here. Incident records may require longer retention while necessary to resolve an incident. See ALL-INKL’s privacy information.

4. Information processed by each service

Homepage: artwork is locally hosted; fonts come from your device. There are ordinary links to the six services, no embedded Spotify, YouTube or Bandcamp player, account form, analytics tag or live AI request. Card cycling occurs in your browser. A selected colour theme is saved locally, as described below.

Contact form: your name, email address and message are sent to webform@tuneswiper.com to answer your enquiry. ALL-INKL hosts the form and processes mail for the operator. Processing to respond to contract-related enquiries relies on Article 6(1)(b) GDPR; other correspondence and abuse prevention rely on Article 6(1)(f), with the legitimate interests of answering messages and protecting the mailbox. The form uses a first-party session cookie for a temporary instrument-matching challenge and request protection. This cookie is necessary for the requested form function; it lasts for the browser session. Challenges expire after ten minutes. No external CAPTCHA provider receives form data. An IP-derived hash and submission-attempt timestamps are held outside the public web directory for rate limiting; records cease to count after one hour and are deleted on a subsequent submission once stale. Correspondence is retained until the enquiry is resolved and any applicable statutory retention or justified dispute period has ended. The operator must confirm mailbox deletion and backup settings before publishing this notice as final. Do not include unnecessary sensitive information in your message.

New Streams: genre choices, searches, swipes and release selections support music discovery. Connecting Spotify can enable account-linked playback and playlists. Spotify-hosted artwork is visible on the live landing page; loading it can disclose request information to Spotify before account connection. The local source also provides Google sign-in using OpenID Connect. If enabled, the sign-in flow exchanges authorization information and the profile fields requested on the Google permission screen (such as account identifier, name and email). Google’s separate privacy policy applies. Account/provider records and their deployed retention still require verification.

Collection: release/year/genre filters and search terms retrieve archive entries and reviews. The service offers previews, YouTube videos, swiping, Spotify connection and playlist actions. Where Bandcamp music or links are supplied, the provider information below also applies. Provider-hosted artwork and media can disclose request information to the provider. Reading a review does not itself require authorizing access to your Spotify account.

Spotify Search: search text, search type, year and filters are used to retrieve Spotify results. Queries may be sent to Spotify for the requested search. Connected account and playlist functions depend on granted permissions. Do not enter sensitive personal information into music searches.

Hit or Miss: guest/connected players can create or join rooms, select playlists, hear excerpts and answer questions. Display names, room identifiers, seats, answers, scores and game events support the session. Chat and visible game information are shared with participants and spectators in the room. Spotify connection can enable full-track playback and saving tracks. Avoid posting private information in room names or chat.

Vinyl Millionaire: record selections, bids/trading decisions, virtual balances and results support solo/multiplayer gameplay. Multiplayer names and actions may be visible to other players. Discogs can supply public catalogue and market information. The virtual game does not itself constitute a purchase in the Discogs marketplace. Local source uses PeerJS/WebRTC for multiplayer: room/game/chat data are exchanged with peers and connection/signalling services can process network identifiers and IP addresses. Peer-to-peer connections can reveal connection information to other participants. The deployed signalling/STUN/TURN providers must be identified. An optional private Discogs API token is stored on the device and can be passed through the multiplayer host flow for catalogue requests; treat it as a credential and reset it in the game settings when no longer needed.

Promotion: accounts involve email addresses, authentication data and verification/reset communications. Owners supply artist/label profiles, biographies, release metadata, artwork, audio, press assets, links and download files. Public pages disclose the information deliberately published there. Private links and protected downloads limit access, but recipients can copy material they receive. Ratings, comments and supplied recipient identifiers support feedback and owner reports. Page owners can receive responses and exported PDF reports. These requested functions generally serve the account/service relationship; optional mailing or tracking requires a separate lawful basis. Promotion also supports YouTube video and Bandcamp music embeds in release descriptions. The inspected source uses youtube-nocookie.com for YouTube embeds and bandcamp.com/EmbeddedPlayer for Bandcamp. Artist/label media settings can enable these embeds; these owner settings are not a visitor’s consent. Authentication, mail delivery, access controls, visitor consent and feedback retention must be verified before final publication.

Music submission form: your real name, artist or company name, sending country, music genre, email address, optional website and up to ten social profile links, release details and physical-products preference are emailed to promos@tuneswiper.com for editorial consideration and replies. These details are not automatically published. ALL-INKL hosts the form and processes mail for the operator. Editorial correspondence and abuse prevention rely on Article 6(1)(f) GDPR, with the legitimate interests of reviewing voluntarily submitted music, replying and protecting the mailbox; contract-related enquiries rely on Article 6(1)(b). A necessary first-party session holds the temporary instrument challenge and, after submission, the sending country and physical-products preference for the confirmation instructions. The latter are removed from the session when shown. The form uses a honeypot and short-lived IP-derived rate-limit records. Details sent by email follow the correspondence retention described below. Social icons are hosted locally, so entering a profile link does not itself contact that network.

5. Spotify

Spotify supplies catalogue metadata, artwork, previews and permission-dependent account, playback and playlist features. Spotify AB provides the Spotify service; its separate processing is described in Spotify’s privacy policy.

Account connection uses an authorization flow whose permission screen identifies requested access. Depending on approved permissions, information may include an account identifier, profile, subscription/country, playlists, devices, playback state and playlist/library actions. Access and refresh tokens authorize requests and are sensitive authentication information. TuneSwiper does not need your Spotify password for this flow. The inspected local sources request streaming, user-read-email, user-read-private, user-read-playback-state, user-modify-playback-state, playlist-read-private and playlist-modify-private. New Streams, Hit or Miss and Promotion also request playlist-modify-public. These permissions cover the corresponding profile, private-playlist, playback and playlist-update functions; the authorization screen and deployed configuration determine actual access. Token storage and deletion must match production.

Revoke access through Spotify’s app settings. Revocation stops future authorized access but does not automatically erase information previously held by TuneSwiper. Request deletion separately where applicable. Public catalogue requests and direct media loading are distinct from account connection.

6. YouTube, Bandcamp and Discogs

YouTube: video search, thumbnails or players involve Google/YouTube, including Google Ireland Limited for users in the EEA. Embeds are used to show music videos and related release content. Direct connections can disclose IP address, browser/device details, referrer and media identifiers; playback can disclose viewing activity. A signed-in Google account can allow activity association. Privacy-enhanced embedding does not eliminate every transfer. Loading behaviour must be verified; where consent is required, provider connections must stay blocked until consent is given. See Google’s privacy policy and YouTube’s API developer policies. This notice does not imply access to your YouTube account.

Bandcamp: Bandcamp Ventures LLC provides embedded music players and release content, particularly on Promotion pages. Loading a player or remote artwork creates a direct browser connection to Bandcamp and may disclose your IP address, browser/device information, requested release/player identifier, time and referrer where supplied. Playback and interactions can disclose listening activity; account association may be possible when you are signed in to Bandcamp. Bandcamp describes cookies, service logs, analytics and consent-dependent advertising technologies in its privacy policy. This does not mean every technology is used in every embed. Following a purchase or account link transfers you to Bandcamp; TuneSwiper does not receive payment-card details merely by embedding a player. Bandcamp reports that information may be processed in the United States and other countries. The applicable transfer safeguards and actual embed loading behaviour must be verified. Where consent is required under Article 6(1)(a) GDPR or section 25 TDDDG, the player and other non-essential provider connections must remain blocked until prior consent; refusal must leave ordinary browsing available and consent must be withdrawable for future loading. This notice itself does not implement those controls. For server-side resolution of a Bandcamp release URL, Bandcamp receives the server’s request information; it does not automatically receive the visitor’s IP from that server request. Direct browser embedding is a separate transfer.

Discogs: its API supplies release, artist, catalogue and market information. Server-to-server requests disclose the server’s connection information and request content, not automatically the visitor’s IP address. Direct browser requests or remote images can disclose visitor request information. Any account-specific connection requires its own permission and disclosure. Actual API routing and cached fields must be checked. See Discogs’ privacy policy. Following a link to Discogs brings you under that service’s practices.

7. AI and generated content

The operator uses AI to create the website and content, including artwork. According to the operator, no visitor information is sent to AI providers. Viewing finished files does not contact an AI service. Generated content does not itself mean visitors are profiled by AI. Any future feature sending messages, feedback, uploaded files or other personal data to AI would require a separate provider, purpose, legal-ground, retention and transfer disclosure before use.

8. Cookies, storage and consent

The homepage and this page save your selected theme in local storage as tuneswiper-theme, with value dark or light. This code does not send it to a server. It contains no account identifier, remembers the appearance you explicitly choose and remains until you clear site storage or replace the preference. Card order is held only in the current page session.

Source inspection identifies additional local preferences: New Streams uses new-streams-theme; Collection uses tsc-theme, tsc-volume and swiper playback/resume settings; Search stores its theme, playlist selections and playback settings; Hit or Miss stores theme and chat-display preference; Promotion uses tsp-theme, tsp-volume and playback-mode settings; Vinyl Millionaire stores a player name, up to 250 recently used record identifiers and an optional private API token. These saved values persist until cleared or replaced unless the application implements a separate expiry. The applications also use authentication/session information for requested functions. Their precise keys, purposes and lifetimes must be inventoried. This declaration does not classify all application cookies as necessary. Optional analytics/media storage requires a separate assessment and, where required, prior consent. Clearing browser site data can remove preferences and end sessions; it does not delete server records.

9. Google Analytics — planned, currently inactive

The operator intends to use Google Analytics, but reports that analytics is not yet active. No Google Analytics tag has been added to this homepage or privacy page. This section describes the planned feature, not current collection.

If activated, GA4 would be provided through Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google group processing under its terms. It can process page views, interaction events, timestamps, browser/device information, approximate location and cookie/device identifiers. Google states GA4 does not log/store individual IP addresses; that does not make all analytics data anonymous. See Google’s EU data information.

Before activation, configure and disclose retention, sharing, recipients and transfer safeguards, and implement prior voluntary consent with equally accessible refusal and later withdrawal. The intended approach is to load no analytics request before consent. This notice does not enable tracking or implement consent controls. Google Signals, advertising linkage, User-ID and enhanced conversions are not represented as active features. Future activation requires an updated notice. Google’s opt-out add-on is an additional control, not a substitute for prior consent.

10. Recipients and transfers

Depending on the feature and your choices, recipients include the host, music/media providers, other game participants, promotion-page owners and viewers of published material. Separate account/email delivery providers, if any, must be named before final publication. Internal access should be limited to people who need information to operate, support or secure the service.

Spotify, Google/YouTube, Bandcamp and Discogs may involve processing outside the EEA. Transfers require an applicable safeguard, such as an adequacy decision or contractual safeguards and any required supplementary measures. A framework cannot be assumed to cover a recipient without verification. The operator must identify the mechanism for its actual arrangements and provide safeguard information on request. Linked provider notices describe their separate processing.

11. Retention and security

Retention must follow the identified purpose and legal obligations: technical logs for the configured troubleshooting/security period; sessions and tokens for the authorized connection; account/upload information for the service relationship; game/chat data for session operation and any justified moderation period; feedback/reports for the promotion activity and necessary follow-up; correspondence until a request is resolved and any applicable requirement ends. Specific incident/dispute records may remain while necessary. Backups may remain until the verified rotation expires.

The Hit or Miss local configuration defines chat-message expiry after 24 hours, room expiry after 24 hours and guest expiry after 7 days. Its cleanup runs during application activity; expiry does not necessarily mean immediate physical deletion, and room closure does not establish deletion of every related record. Verify that these settings and cleanup routines match production. Other numerical settings and deletion workflows must be confirmed with the host and applications. Disconnecting a provider does not automatically erase account records or recipients’ exports. Deletion requests should identify justified exceptions and backup expiry. Encrypted transport, access restrictions, password protection and token/upload security must be verified in the deployed services. Absolute security is not promised.

12. Your rights and choices

Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction and portability; object to legitimate-interest processing and direct marketing; and withdraw consent for the future without invalidating earlier lawful processing. Identify the service and enough information to locate your records. Do not send unnecessary identity documents.

Contact the controller by email or post. Requests are normally answered within one month; a permitted extension requires notice. You can complain to a supervisory authority at your residence, workplace or the place of an alleged infringement. The operator’s regional authority is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

Refusing optional data may prevent the associated account, playback, feedback or game feature, but should not prevent browsing where unnecessary. Game scoring and release filtering are functional calculations. No visitor AI processing is reported. Any legally significant automated decision-making introduced later would require separate information.

13. External links and updates

External services have their own notices and controls. This declaration must change when providers, purposes or integrations change. Updating a notice alone does not authorize new processing; necessary information and consent must precede it.

Legal references: GDPR and section 25 TDDDG.