Privacy Notice — musiqen

Last updated: 2026-10-29

This notice explains what personal data the musiqen app and the website musiqen.com process, why, and what rights you have. The first section is a summary; the sections after it give the details the law asks for. We will update this notice before adding features that process new data.

In short

• Who: Michael Trapp, Hambrücken, Germany, is responsible. Write to privacy@musiqen.com.
• Without an account, everything you do in musiqen stays on your device. We receive nothing.
• With an account, we keep your account, your profile and settings, and your library — your pieces and their pages, your markings and your setlists — on our servers, so that every device you sign in to shows the same. Sync is a paid service.
• Why: to provide the app you signed up for. We use no analytics, tracking or advertising, and we do not build profiles of you.
• Where: stored in the European Union, with Supabase (servers in Frankfurt, Germany) as our processor. Some processing also takes place in the US and in Singapore.
• How long: until you delete your account, or 90 days after your subscription ends without being renewed. Things you delete or change stay in the history on our servers for a while first — see “How long we keep it”.
• Your rights: access, correction, deletion, restriction, objection and portability. You can download a copy of your data and delete your account in the app, and you can complain to a supervisory authority.

Who is responsible

Michael Trapp (Einzelunternehmer) Hauptstr. 117, 76707 Hambrücken, Germany Email: privacy@musiqen.com (data protection) Support: support@musiqen.com (questions about your account, or an email from us about a change you did not make) Notices about content, and authorities: abuse@musiqen.com (German or English; see “When you report content to us”)

We have not appointed a Data Protection Officer; the law does not require one for a service of this size. Michael Trapp handles all data-protection matters in person.

Using musiqen without an account

You can use musiqen without creating an account. Everything you create in the app is then kept on your device only: no account is created, and the app sends nothing about you to us. We therefore do not process any of this data.

When you start using an account on this device — by signing up on it, or by choosing to add what you made without an account to your account after signing in — that data becomes your account’s data, and the rest of this notice applies to it.

What we collect and why

We collect only what the app needs to work. We do not use analytics, tracking or advertising, the app contains no such tools, and we do not make automated decisions about you or build profiles of you. We do not record what you play, when or how often: a setlist records what you plan to play, not what you performed.

Data	Why we process it	Legal ground
Your email address and password (the password only as a secure hash); if you sign in with Google, the email address and name Google shares with us; if you sign in with Apple, the email address	To create your account and sign you in. When you choose a password or sign in with it, our backend provider checks whether it appears in a public list of passwords known from data leaks (Have I Been Pwned), so that we can warn you. Your password does not leave our backend for this: only the first five characters of a scrambled code made from it are used to look it up, and these say nothing about your password or about you.	Performance of our contract with you (Art. 6(1)(b) GDPR)
Your profile and settings: instrument and the key it is written in, display language, favourite notation symbols and instruments, your tuner setups (the names you give them and how they are set) and which is your default, and whether musiqen may use names from your library to correct reading errors	To set up your profile and give you the same app on every device you sign in to; to write our emails to you in your language	Performance of our contract with you (Art. 6(1)(b) GDPR)
Your library: the pages of your pieces, their details (title, credits, your own notes, the names of their parts), your tags and collections, the marks you draw, your setlists (their names, descriptions, pieces and tags, and for an imported setlist the name of its file and the date), and the history of changes to all of these, each change with its time and the device that made it	To keep your library the same on every device you sign in to	Performance of our contract with you (Art. 6(1)(b) GDPR)
A random identifier for each device you use with your account, and a key for each device, and the date the device last confirmed it	To combine changes made on several devices, and to let your other devices learn when your account has been deleted	Performance of our contract with you (Art. 6(1)(b) GDPR)
The date your sync subscription runs to and, once it has passed, the date your account will be deleted	So that sync runs while you have paid for it, and so that the app can show you these dates	Performance of our contract with you (Art. 6(1)(b) GDPR); deleting the account once the 90 days have passed: our legal obligation not to keep data we no longer need (Art. 6(1)(c) GDPR)
A record that your account was deleted, and a record that you requested a copy of your data — each only a code calculated from your email address from which the address cannot be recovered, and the date	To prove that we honoured your request	Our legitimate interest in proving compliance (Art. 6(1)(f) GDPR)

Some settings stay on your device only and never reach us — for example how you like your library sorted and your sheets shown, when you last opened a piece, and your page turner’s buttons.

Names from your library help read new sheets. When musiqen reads a new sheet, it compares the composer and arranger names it finds with names already in your library, to fix small reading errors. This happens on your device only. A name fixed this way is shown as corrected by AI, and you can undo it. You can switch this off in the app’s settings at any time.

The tuner listens through your device’s microphone, with your permission, while it is on your screen. The sound is analysed on your device only: it is never recorded, stored or sent to anyone. Legal ground: our contract with you (Art. 6(1)(b) GDPR); for other people’s voices the microphone may pick up, our legitimate interest in offering a tuner that works in an ordinary room (Art. 6(1)(f) GDPR).

When you use musiqen with your account, the app tells our server its version number, at most once a day. The server adds one to a count for that version, platform and day and keeps nothing that links the count to you or your device. We use these counts to know which app versions are still in use. Legal ground: our legitimate interest in keeping the service working and secure for every version still in use (Art. 6(1)(f) GDPR).

Our website musiqen.com

When you open a page of musiqen.com, or an account email loads the musiqen logo from it, your browser or email app sends us your IP address, the address requested, the date and time, the page you came from and which browser you use. We need this to deliver the page, and our hosting provider keeps a short access log to find errors and misuse. The IP addresses in that log are shortened so you cannot be identified from them, and the log is deleted after three days. Legal ground: our legitimate interest in running the website and keeping it secure (Art. 6(1)(f) GDPR).

When you open a link from one of our account emails in a browser, the page sends the code from the email back to our servers to confirm your address (Art. 6(1)(b) GDPR).

The website sets no cookies, stores nothing in your browser, uses no analytics, tracking or advertising, and loads nothing from other companies’ servers.

When you write to us

If you write to support@musiqen.com or privacy@musiqen.com, we receive your email address, your name if you give it, and whatever you write. We use it only to answer you, to protect your account if you report a change you did not make — for that we may look at your account’s details — and, for a request about your rights, to be able to show that we answered it. Legal ground: our contract with you where your message is about your account (Art. 6(1)(b) GDPR); our legal obligation to answer requests about your rights and to be able to prove it (Art. 6(1)(c) GDPR); otherwise our legitimate interest in answering messages and keeping accounts safe (Art. 6(1)(f) GDPR). We delete the conversation three years after the matter is settled.

When you report content to us

If you send us a notice about content stored on musiqen — or, as an authority, an order — at abuse@musiqen.com, we receive your name, your email address, what you write and anything you attach. We use it only to handle your notice: to confirm that we received it, to decide on it, to tell you what we decided, and to be able to show later how we handled it. Legal ground: our legal obligation as a hosting service (Art. 6(1)(c) GDPR, with Art. 16 of the Digital Services Act; for an authority’s order, Art. 9 and 10). We keep the record of the case for 3 years after it closes. Where a notice suggests a criminal offence that threatens someone’s life or safety, we must pass the information to the police (Art. 18 of the Digital Services Act). The rights under “Your rights” are yours too.

If something you stored is reported

If someone tells us that something you synced is illegal, or an authority orders it, a person reviews the reported item. If we remove it, we delete it from our servers, and its backup copy there within 30 days after that; your copy on your devices stays. You receive an email explaining why, the copy of your data you can download shows the removal, and we keep a record of the case for 3 years after it closes. We do this because the law requires it of us as a hosting service (Art. 6(1)(c) GDPR, with Art. 16 to 18 of the Digital Services Act). Questions about such a decision: abuse@musiqen.com.

Who else sees your data

• Supabase hosts the app’s backend (database, sign-in, storage) as our processor, on servers in Frankfurt, Germany.
• Bunny.net (BunnyWay d.o.o., Slovenia) hosts the website as our processor, in the EU.
• netcup (netcup GmbH, Germany) rents us the server our email runs on, as our processor, in Nuremberg: the messages you send us and the account emails we send you.
• Google (Google Ireland Ltd.) and Apple (Apple Distribution International), if you sign in with them, act as independent controllers for your Google or Apple account under their own privacy policies.
• Authorities receive data about a reported case only when they order it from us (Art. 9 and 10 of the Digital Services Act), and the police only where we must report a threat to someone’s life or safety (Art. 18 of the Digital Services Act).

Your data is stored in the EU (servers in Frankfurt). Our provider Supabase and some of its service providers are, however, based in the US or in Singapore and may also process data there, for example for operation, error logs and support. The basis is the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR; publicly available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914), and for certified US companies also the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR). A copy of the version that applies to us is available from privacy@musiqen.com. What you sync is stored encrypted, and no other user of musiqen can see it. We do not sell your data or share it for anyone else’s marketing.

How long we keep it

• Your account and everything stored with it: until you delete your account. If your subscription ends and is not renewed, we keep everything for 90 days so that renewing brings it back, and then delete your account in the same way as if you had deleted it yourself. If you signed in with Apple, we cannot remove musiqen from your Apple ID in that case; you can do so in your Apple ID settings.
• Things you delete or change do not disappear from our servers at once. We keep every change for at least 12 months. After that we delete it as soon as one of your devices has saved a newer complete state of it on our servers; if that never happens, it stays until you delete your account. The earlier version of a piece’s pages is deleted 30 days after you replace it. A piece you delete — with its pages, its history and your marks on it — is deleted 30 days after the deletion reached our servers, unless one of your devices keeps it; only a note without content that it was deleted remains until you delete your account.
• When you delete your account, everything stored with it on our servers is deleted, and the deletion is completed even if your connection drops; the backup copy of your pieces’ pages is deleted within 30 days after the pages are deleted from our servers. Before you confirm, you choose whether your data stays on this device without an account; your other devices ask you the same when they learn of the deletion. A short work record of the deletion is kept for at least a day, until our servers have checked that nothing is left. For 30 days after the deletion we keep your devices’ keys with a date, so that your devices can learn that the account is gone.
• Signals between your devices that something changed hold only identifiers, no content, and are deleted after about 3 days.
• The records of an account deletion or of a request for a copy of your data: 5 years.
• The website’s access log: three days.
• Emails to support@, privacy@ and abuse@: three years after the matter is settled.
• A reported case: 3 years after it closes; a block on a piece of yours that still stands is kept while it stands, and deleted with your account.

Our mail server’s delivery logs (whom an email went to or came from, and when) are deleted after 7 days. Backups of the mail server are kept for 30 days, so what we delete is gone from them 30 days later at the latest. We also keep a backup copy of your pieces’ pages on our servers; pages deleted for any of the reasons above are deleted from it within 30 days after they are deleted from our servers.

Your rights

Under the GDPR you have the right to:

• Access the data we hold about you (Art. 15) — you can request and download a copy in the app under Profile → Privacy → Request my data. It includes what your devices have synced, with its history of changes, but not the PDF files themselves;
• Correct it if it is wrong (Art. 16) — you can edit your profile and everything recorded for a piece in the app;
• Delete your account and data (Art. 17) — you can do this in the app;
• Restrict or object to our processing (Art. 18, 21);
• Receive your data in a portable format (Art. 20).

To exercise any right, email privacy@musiqen.com. We will respond within one month.

You also have the right to complain to a supervisory authority. The one responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 20, 70173 Stuttgart, Germany https://www.baden-wuerttemberg.datenschutz.de

Age limit

You must be at least 16 to create an account. The app is not intended for children under 16. If you believe a younger child has created an account, email us and we will delete it.

Providing your data

Giving us your email and password is necessary to create an account. Without them we cannot provide the parts of the service that need one. You do not need an account to use musiqen on one device (see “Using musiqen without an account” above). With an account, your instrument and your display language are part of using the app.

Changes to this notice

If we add a feature that processes new data — for example AI tools, or buying sync through the app stores — we will update this notice first and tell you what changes.