Privacy Policy
This is an English translation for your convenience. Only the German version (Datenschutzerklärung) is legally binding.
Last updated: 9 November 2026
1. Controller
Andreas Froese
Ollenhauerstraße 7B
64354 Reinheim
Deutschland
Email: froese.andreas@gmail.com
2. The essentials at a glance
This website sets no cookies for advertising or analytics purposes and uses no analytics or tracking tools and no social media plugins. The public pages load no content from third-party servers. Only the members area uses Google services for sign-in (section 5). Personal data is processed only in the cases described below.
3. Hosting and server logs
The website is hosted on Google Firebase Hosting (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the website is accessed, the hosting provider processes technically necessary data, in particular the IP address, date and time of access, the file requested, the amount of data transferred, the referrer URL, and the browser and operating system. This is necessary to deliver the website and to ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in providing the website securely and reliably.
A data processing agreement pursuant to Art. 28 GDPR (Data Processing and Security Terms) is in place with Google. Processing in third countries, in particular in the USA, cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, the EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).
4. Contact by email and launch notification
If you send me an email – for example, to be notified when Notavela launches – I process your email address, your name (if provided) and the content of your message in order to answer your enquiry or to notify you of the launch. The legal basis is Art. 6(1)(b) GDPR (enquiry) or Art. 6(1)(a) GDPR (your consent to be notified), which you can withdraw at any time by email. The data is deleted once the enquiry has been dealt with, the launch notification has been sent or you withdraw your consent, unless statutory retention obligations apply. I use Google’s Gmail for email; messages are stored there.
5. Members area and sign-in
To use the members area, you sign in with your Google or Microsoft account. For this we use Firebase Authentication from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you sign in, the provider you choose (Google or Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) transmits your name, your email address, your profile picture if applicable, and an identifier for your account to Firebase. Firebase stores this information together with sign-in times and technical data (including your IP address) in order to grant you access. The content of the members area is held in Firebase Cloud Storage (data centre in Frankfurt am Main) and is delivered only to signed-in users.
When you open the members area, your browser loads the program libraries it needs from Google servers (www.gstatic.com, apis.google.com); in doing so, your IP address is transmitted to Google. For as long as you are signed in, a sign-in status is kept in your browser’s storage (IndexedDB/Local Storage); it is technically necessary for the access you have requested (Section 25(2) no. 2 TDDDG) and is removed when you sign out.
The Notavela app is likewise available only to activated accounts. To sign in, the app opens this website in your browser (the “Sign-in for the app” page); after you sign in, the page passes your email address and a sign-in token (a Firebase Authentication refresh token) directly to the app on your computer. The app stores both only locally in its settings folder (file konto.json, readable only by your user account), together with the time of the last successful check. At startup and once a day thereafter, the app asks Google (Firebase Authentication and Firebase Cloud Storage) whether the account is still activated; in doing so, the token and your IP address are transmitted to Google. Without an internet connection, an activation remains valid for 14 days. No other data, such as data about your scores or your use of the app, is transmitted in the process. Choosing “Sign out” in the app deletes the file.
Suggestions for improvement and crash reports from the app. With “Suggest an improvement” (also by ⌥- or Alt-clicking an element of the app) and “Send to Notavela” for a crash report you can send us a message from within the app. Data is transmitted only when you click “Send” in the dialog, and only what the dialog lists beforehand: title and description, the context of the element clicked (such as bar, instrument, voice and pitch of a note, or the label and command of a button, plus the current selection, the visible page, view and mode of operation), the pictures you choose (a section of the score and a picture of the editor window drawn by the app itself) and attachments (if you wish, the open score and files of your own; for crash reports the report file with its summary), as well as your email address, the identifier of your account, the app version, operating system, the app's language and the file name of the open score. None of this is sent automatically. The message is stored in Firebase Cloud Storage by Google (data centre in Frankfurt am Main, region europe-west3) and shown in the members area to the operator only. The legal basis is Art. 6(1)(b) GDPR (processing your message) and Art. 6(1)(f) GDPR (legitimate interest in fixing errors in and improving the app). Messages are kept until they have been dealt with and are deleted afterwards; on informal request by email we delete them earlier at any time.
The legal basis is Art. 6(1)(b) GDPR (providing the access you have requested). A data processing agreement is in place with Google; for transfers to the USA, see section 3. We delete your members area account upon informal request by email, and otherwise after 24 months without a sign-in.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent given with effect for the future (Art. 7(3)). An informal email is sufficient.
Right to object: Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
7. Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for me: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.
8. No automated decision-making
No automated decision-making or profiling takes place.