Privacy Policy

Last updated: 2 August 2026

1. Controller

Jens Roggenfelder
Heidebroichstr. 36
50374 Erftstadt
Germany
Email: ed.ppa-rabthcis@rtsE-Mail Adresse, bitte JavaScript aktivieren

2. What I do not collect

This website does not use cookies. No personal data is collected for marketing. There are no tracking pixels, no embedded social media widgets with tracking, no profiling.

3. Hosting and server logs

The website is hosted by Host Europe GmbH (Hansestrasse 111, 51149 Cologne, Germany). When you visit the site the hosting provider automatically processes technically necessary data such as IP address, time of access, URL requested, browser type, and referrer. Logs are deleted after a maximum of 14 days. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating the website).

A data processing agreement under Art. 28 GDPR is in place with Host Europe.

4. Visitor statistics

I use GoatCounter (Martin Tournoij, Netherlands) for visitor statistics. GoatCounter does not set cookies, does not store IP addresses permanently, and does not generate a persistent visitor ID. A short-lived hash of IP and user agent is computed and deleted after a maximum of eight hours to deduplicate same-day visits.

In addition to page views I also count clicks on individual links (setup downloads, SHA256 checksums, donate buttons, share buttons per target, language switcher, GitHub links) as anonymous events. This uses the same method and the same data as a page view; the counter just appears in a separate area of the GoatCounter dashboard. No additional data is collected.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in lightweight statistics). You can opt out by enabling Do Not Track in your browser or by blocking scripts from gc.zgo.at.

GoatCounter privacy notice: www.goatcounter.com/help/gdpr.

5. Email contact

If you email me, I process your address and the contents of the message to answer your inquiry. Legal basis: Art. 6 (1) (b) or (f) GDPR. Emails are deleted once the matter is closed, at the latest after statutory retention periods.

To answer inquiries I use AI assistance (Claude by Anthropic PBC, USA). Incoming emails, including the sender address and content, are transmitted to Anthropic in the process; this is the only way I can keep up with the volume of inquiries and feedback as a single person. Anthropic is certified under the EU-US Data Privacy Framework and the content is not used to train AI models. This also applies to replies and thank-you notes around donations (see section 8). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in handling inquiries promptly). Please note: this processing happens right when your email arrives, so I cannot offer handling without AI assistance. If you do not agree with this, please refrain from contacting me and from donating. Anthropic privacy policy: www.anthropic.com/legal/privacy.

5a. Community world map

On the start page you can voluntarily place a pin on a world map to show that your SoundTouch box is alive again with STR. The form posts your input to a small API endpoint on the same server as this website (Host Europe, see section 3). No external third parties, no transfer to third countries.

Stored data: a deliberately coarse location that you choose by tapping the map (rounded to roughly one kilometre, never house level), a reaction you pick from a fixed list, an optional speaker model, the language, and a salted SHA256 hash of your IP address. The IP hash is used only for spam and duplicate detection (one pin per coarse cell per connection, with rate limits). No name, no email address, no free text and no images are stored, and no cookies are set.

So that you can still place your pin on a later visit after jumping over to the map from the STR app, your browser keeps an anonymous functional flag locally (using the browser's localStorage, not a cookie). It only holds the value “active”, no personal data and no identifier, never leaves your browser, and is deleted automatically once you have placed a pin. You can remove it yourself at any time by clearing this site's browser data.

Publicly visible on the map: the coarse location, the chosen reaction, the optional model, and the submission date. The IP hash stays internal.

Legal basis: Art. 6 (1) (a) GDPR (consent by actively submitting the form, confirmed with a checkbox). You can request deletion at any time by emailing ed.ppa-rabthcis@rtsE-Mail Adresse, bitte JavaScript aktivieren. The reaction symbols (OpenMoji, CC BY-SA 4.0) and the map base are served locally from this website; no third-party requests are made.

6. External links

The site links to external providers such as GitHub, Buy Me a Coffee, Ko-Fi, PayPal, Liberapay, Open Collective, Steady, Mastodon, Bluesky, and Reddit. Their respective privacy policies apply once you click. No tracking happens on this site before you click (no embeds, no like buttons).

Via the sharing feature you can recommend STR on the platforms listed there, by email or by copying the link. The share buttons are plain links: no scripts, cookies, or tracking pixels from these platforms are loaded. Which button was clicked is counted anonymously via GoatCounter (see section 4), without sending anything to the platform itself. Only when you click a button does the respective platform or app open with a prepared title or text; from that point their privacy policy applies. For Mastodon you are asked for your instance the first time. The instance address is stored only in your browser (localStorage, key str-mastodon-instance) so you are not asked again, and it never leaves your device. Use “Use a different Mastodon instance” to delete the entry. Copying the link or the suggested text for a newsroom happens entirely in your browser, and the copied content is never transmitted. Only the click is counted as described above.

6a. Embedded YouTube video

The start page embeds a YouTube video about STR using the privacy-enhanced mode via youtube-nocookie.com. When the page loads, no connection to YouTube is made; you only see a preview image stored locally on this server. Only when you click play does the video player load from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). At that point Google receives your IP address and further technical data such as browser type and time of access. Even in privacy-enhanced mode Google may process its own data, possibly on servers in the USA.

Legal basis: Art. 6 (1) (a) GDPR (consent by deliberately clicking play). If you do not click, no data is sent to Google. Google privacy policy: policies.google.com/privacy.

7. Radio station favicons in the desktop app

The STR desktop app fetches favicons (small logos) for radio stations whose stream providers do not supply one from the free favicon service of DuckDuckGo (DuckDuckGo Inc., USA). Your computer sends the station's domain to DuckDuckGo and DuckDuckGo returns the matching logo. DuckDuckGo sees your IP address during that lookup. I store nothing on my side. If you prefer not to use it, you can block network traffic to icons.duckduckgo.com, the app keeps working, stations then show with placeholder icons.

7a. App update check

The STR desktop app checks once, about eight seconds after startup, whether a newer version is available. To do so it makes a single GET request to a small endpoint on the same server as this website (Host Europe, see section 3), with no cookies and no request body. Only non-identifying technical details are sent: the running app version, the build stamp, operating system and processor architecture, and, if set, the language configured in the app. No device identifiers, no network or speaker data, and no personal data are sent.

The server counts the request anonymously via GoatCounter (see section 4), broken down by version, operating system, processor architecture and the configured language, so I can see how many installations are up to date and which languages and platforms to prioritise. No IP address is sent to GoatCounter and no visitor hash is formed; only the bare request is counted. As with any connection, the hosting provider technically sees your IP address during the request (section 3); it is not linked to the update data.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in being able to notify you of security and feature updates). If you prefer not to use it, you can turn the update check off by setting the environment variable STR_NO_UPDATE_CHECK=1, or block the app's connection to st-reborn.de in your network. The app keeps working without the update check.

8. Donations

Donations are handled by the external payment platforms listed above. I only receive the data required for bookkeeping (amount, date, optionally a name). Payment processing is done by the respective provider under their own privacy policy.

9. Your rights

Under Art. 15 to 21 GDPR you have the right to access, rectification, deletion, restriction of processing, data portability, and objection. You can file complaints with your competent data protection supervisory authority. For North Rhine-Westphalia (where the controller resides) that is the Landesbeauftragte für Datenschutz NRW (www.ldi.nrw.de).

10. Changes

I update this policy when technical or legal changes require it. The current version is always available on this page.