Privacy notice – Strophy (closed test phase)
As of: 28 September 2026
This is a translation. The German version prevails in case of any discrepancy.
Strophy is a private project in a closed test phase. Only people I have invited personally can take part. This notice explains which data is involved, what it is used for and who gets to see it.
1. Controller
Jonas Bartkowski
Machabäerstraße 1, 50668 Köln
E-Mail: jonas.bartkowski+dataprotection@jb1services.com
No data protection officer has been appointed, and none is required.
2. What data is processed
Your email address. You gave it to me personally so that I can give you access. I add it to the test-user list of my Google Cloud project – only then does Google allow you to sign in – and use it to contact you about the test phase. The app itself does not store your email address.
Sign-in with Google. Sign-in runs through Google and Amazon Cognito.
Strophy asks Google only for the openid permission. As a result I receive a
pseudonymous identifier of your Google account (the "subject ID") – not your
name, not your email address, no profile picture. This identifier links your
Google account to your learner profile.
Your learner profile.
- a display name you choose yourself (a nickname is enough – please do not use your full name),
- the languages you are learning and your interface language,
- your learning progress: which words you know, your answers in the game and in flashcards, review dates, results per song,
- words you add yourself and your own translation corrections,
- the songs generated for you (lyrics, audio file, favourites).
Technical data. When you open the site, the servers process technically necessary data (including IP address, time and requested address). Application logs are deleted automatically after 30 days.
Storage in your browser. Strophy keeps your sign-in tokens, your profile ID and your language settings in your browser's local storage, and short-lived values for the sign-in process in session storage. This is strictly necessary to run the service (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). There are no tracking, analytics or advertising cookies and no third-party scripts.
3. Purposes and legal bases
- Providing the app and your learning progress, generating songs: Art. 6(1)(b) GDPR (use of the test service you agreed to).
- Granting access and contacting you via your email address: Art. 6(1)(a) GDPR (your consent, given by handing over the address for this purpose).
- Technical logs for operation, troubleshooting and security: Art. 6(1)(f) GDPR (legitimate interest in a working, secure service).
4. Recipients and service providers
I do not sell data and do not use it for advertising. I use the following service providers as processors to run the service:
| Service | Purpose | Location of processing |
|---|---|---|
| Amazon Web Services (AWS) – Lambda, S3, CloudFront, Cognito, Secrets Manager | Hosting, sign-in, storage of audio files | Frankfurt (eu-central-1); CloudFront delivers worldwide |
| Turso | Database (learner profile, progress) | AWS Ireland (eu-west-1); transfer to Turso Inc. (USA) possible |
| Sign-in ("Sign in with Google"), test-user list | Google Ireland Ltd., Dublin; transfer to Google LLC (USA) possible | |
| Anthropic | Generating lyrics and translations | USA |
| ElevenLabs | Generating the music from the lyrics | USA |
For sign-in with Google, Google is itself responsible for your Google account; Google's privacy policy applies to that.
What the AI services receive: Anthropic receives the word list a song is to be built from, as well as words and lines that need translating – including words you add yourself. ElevenLabs receives the finished lyrics and a style description. Neither service receives your display name, your profile ID or your Google identifier. Still: do not enter anything personal as your own words (no names, addresses or the like).
Transfers to third countries: Some providers are based in the USA or may access data from there. Transfers rely on:
- Amazon Web Services, Google LLC and ElevenLabs: the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), which these providers have joined; Google and ElevenLabs additionally rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR),
- Anthropic: the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of Anthropic's data processing addendum,
- Turso: the EU-US Data Privacy Framework where applicable, otherwise the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of the data processing addendum with Turso.
5. Retention
- Learner profile, progress and songs: until you ask for deletion, at the latest until the end of the test phase. When the test phase ends, I will delete the test data or ask you beforehand whether you want it carried over into the regular version.
- Email address and entry in the test-user list: until the end of the test phase or until you ask me to remove it.
- Server logs: 30 days.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).
During the test phase there is no button for this in the app yet. Just write to me at jonas.bartkowski+dataprotection@jb1services.com – I will handle it by hand, usually within a few days.
You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for my place of residence: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
7. Test phase
Strophy is unfinished. Features may change, fail or be removed, and data may – despite due care – be lost. If a data breach occurs, I will inform you.
If this notice changes, I will let you know in advance.