Legal # Privacy policy [Deutsche Fassung](https://bitwerk.systems/datenschutz/) This privacy policy applies to the website bitwerk.systems, to bitwerk news (news.bitwerk.systems) and to the bitwerk app for Android. It explains which personal data is processed when you use it, for what purpose and on what legal basis, and which rights you have. It also describes which services on the internet bitwerk servers and players contact. ## Controller Ben Pilger\ Taunusstr. 4A\ 63303 Dreieich\ Germany\ Phone: +49 160 98641438\ Email: ## In short - This website sets no cookies and uses no advertising tools and no tracking across websites. - We count visits with Cloudflare Web Analytics, without cookies and without profiles of visitors. - We measure which product pages and sections are read with our own Umami server in Germany, without cookies and without profiles of visitors. - Fonts and images come only from our own server. No third-party content is embedded (no videos, maps, social media plugins or font services). - The only form is the launch list sign-up ("Reserve your place"): it sends your email address, the devices you picked and the language of the page to bitwerk news (news.bitwerk.systems), which asks you to confirm by email (double opt-in, see "News and release notes by email"). Buttons such as "Request an s1" only open your own email program with a prefilled message; we receive data only when you send it. - If you subscribe to our news or release notes on news.bitwerk.systems, we store your email address with double opt-in and send no tracking pixels; every mail lets you unsubscribe (see "News and release notes by email"). ## Hosting by Cloudflare The website is delivered by Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). When you open a page, Cloudflare processes the data every browser transmits for technical reasons: your IP address, date and time of the request, the requested address, the page you came from (referrer), browser and operating system (user agent), the amount of data transferred and the status code. Cloudflare uses this data to deliver the pages quickly and to protect the website against attacks and overload (for example DDoS protection). In Cloudflare's dashboard we see aggregated statistics and, when Cloudflare blocks a request as an attack, details of that request. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure, stable and fast website. Cloudflare processes the data as our processor under Art. 28 GDPR, based on the data processing agreement that is part of Cloudflare's terms. Cloudflare runs data centres worldwide, and a request is usually answered by one near you. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); for other third countries the agreement contains the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). How long Cloudflare keeps this data is described in[Cloudflare's privacy policy](https://www.cloudflare.com/privacypolicy/). The test site staging.bitwerk.systems is not public. Anyone who opens it signs in through Cloudflare Access; Cloudflare then processes the email address entered and sets a necessary sign-in cookie. Only people we have authorised get access. ## Visitor statistics with Cloudflare Web Analytics To see which pages are visited how often and how fast they load, we use Cloudflare Web Analytics. The page loads a small script from Cloudflare (static.cloudflareinsights.com) that reports the page address, the page you came from, browser, device type, country and load times to Cloudflare; for technical reasons Cloudflare also receives your IP address. The script sets no cookies, stores nothing in your browser and builds no profiles across websites. We only see aggregated numbers, no individual visitors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is knowing the reach and load times of the website and improving them. Processing and third-country transfers are covered as described in the section on Cloudflare. You can object to this processing (see "Your rights") or block the script with a content blocker. ## Visitor statistics with Umami To learn which product pages and which parts of them interest visitors, we run Umami, an open-source statistics tool, on our own server at Hetzner Online GmbH in Germany (stats.bitwerk.systems). The page loads a script from this server that reports the page address, the page you came from, browser, operating system, device type, screen size, language and country (derived from the IP address, which is not stored). On product pages it also reports how many seconds each section was on screen, how far you scrolled and which links or buttons in the page you clicked. On every page it reports a click on a mail link or on the link to the news sign-up. The script sets no cookies, stores nothing in your browser and builds no profiles; to tell visits apart, Umami uses a value derived from the IP address and browser with a salt that changes regularly, so a visitor cannot be recognised later. If your browser sends "Do Not Track", nothing is measured. We only see aggregated numbers, no individual visitors; no data goes to third parties. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is knowing which content interests visitors and improving the website and our products accordingly. Hetzner processes the data on our behalf (Art. 28 GDPR). The data is deleted after 24 months at the latest. You can object to this processing (see "Your rights"), switch on "Do Not Track" or block the script with a content blocker. ## Contact by email When you email us, we process your email address, your name if you give it, and the content of your message to answer your request, prepare a quote or handle an order. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or steps before one, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests). Our email is received and stored by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, as our processor. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR). We delete your messages once they are no longer needed for their purpose. Messages that belong to a quote, an order or an invoice are kept as long as commercial and tax law require (up to ten years). ## News and release notes by email On [news.bitwerk.systems](https://news.bitwerk.systems/) we publish news and release notes, and you can subscribe to them by email, each topic on its own (for example release notes or security updates). - **What we store:** your email address, the topics you picked and a random key for the links in our mails. As proof of your consent we also store when and from which IP address the subscription was requested, the consent text you saw, and when and from which IP address you confirmed it. - **Double opt-in:** after you subscribe we send one mail with a confirmation link. You only receive mails after you confirm. A request that is not confirmed within 7 days is deleted with all its data. - **No tracking:** our mails contain no tracking pixels and no tracked links, and we do not record whether or when you open a mail or click a link. The public pages set no cookies. - **Unsubscribe:** every mail has a link to unsubscribe from its topic and a link to manage your topics. When you unsubscribe from your last topic, or from everything at once, we delete your address and the proof of consent immediately. A record of each mail sent to you (address, time, delivery status) is deleted after 30 days; daily backup copies of the database are kept for 14 days. The legal basis for sending the mails is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future; the proof of consent is kept to meet our duty to demonstrate it (Art. 6(1)(c) and Art. 7(1) GDPR). The service runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, and is delivered through Cloudflare as described above; the mails are sent through Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. Both act as our processors (Art. 28 GDPR). We use the data only to send the topics you picked and never pass it on to anyone else. ## Storage in your browser If you choose a light or dark colour scheme at the top right, your browser keeps that choice in local storage (entry "starlight-theme"). The website also keeps a technical navigation entry for the session (session storage, entry "sl-sidebar-state"). This stays on your device, is not sent to us, and can be deleted in your browser settings. It is strictly necessary for a function you asked for (§ 25(2) no. 2 TDDDG). ## The bitwerk app The bitwerk app for Android is a remote control for your own bitwerk server. It sends no data to us or to third parties, contains no advertising, analytics or crash reporting, and needs no account with us. The web interface of your server, which the app opens, may load cover images from Spotify while Spotify plays (see "bitwerk servers and players"). - **Finding your server:** the app sends a short search message into your local network and talks only to bitwerk servers there. What you then see and enter (library, playback, your login) goes only to your own server, which you or your organisation operate; we do not receive it. - **Camera:** used only when you tap "Scan setup code", to read the QR code on a player display. The image is processed on the phone and neither stored nor transmitted. The scanner is part of the app itself and works offline; it uses no Google Play services and sends nothing to Google or anyone else. - **On your phone:** the app remembers the address of the last server you opened. Your server's web interface may keep its own settings and your login in the app's storage. Uninstalling the app deletes all of it. Installing the app through Google Play is subject to Google's privacy policy. Legal basis for the functions above: Art. 6(1)(b) GDPR (the app does what you ask it to) and § 25(2) no. 2 TDDDG for what is stored on the phone. ## bitwerk servers and players A bitwerk server and its players run in your own network and are operated by you or your organisation. They send no usage data, crash reports or logs to us and contain no analytics. Your library, your listening history and your accounts stay on your server. Some features fetch information from public services on the internet. These services receive the public IP address of your network and the data named below, directly from your device and not through us: - **Update check** (on by default): once a day the server asks GitHub (GitHub, Inc., USA) for the latest bitwerk version. It sends nothing about your installation. - **Covers, artist and album information, lyrics** (on by default, once music is in the library): artist, album and track names go to MusicBrainz, the Cover Art Archive, Wikidata, Wikipedia and Wikimedia Commons; artist, title, album and duration of a track go to LRCLIB to find its lyrics, also for tracks played from Spotify or the radio. Each item is looked up once and then kept on the server. - **Internet radio** (when used): station searches go to the public directory radio-browser.info; a station is streamed straight from its broadcaster, who also supplies its logo. Reporting played stations to the directory is off unless you switch it on. - **Spotify** (when used): when someone plays Spotify on a player or links a Spotify account, Spotify handles that playback and the account's data under its own privacy policy; cover images are then loaded from Spotify. - **Off until you switch them on:** AI assistants (Anthropic, Google, OpenAI or a model in your own network) receive only library information such as artists, titles and tags, never audio; Last.fm and ListenBrainz receive the listens of the account you connect; webhooks, MQTT and Home Assistant receive what you set up. Each of these services can be switched off in the server's settings. Requests carry no email address or other personal data, only a generic program name and version. The operating system of a device also keeps its clock and software lists up to date through the usual time and package servers. As the operator of a server you decide which of these services it uses; we receive none of the data they process. ## Links to other websites Links to other websites are plain links: your browser contacts the other website only when you click one. Its operator is responsible for its data processing. ## Your rights You have the right to - access the data we process about you (Art. 15 GDPR), - have incorrect data corrected (Art. 16 GDPR), - have data erased (Art. 17 GDPR) and its processing restricted (Art. 18 GDPR), - data portability (Art. 20 GDPR). **Right to object:** where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). An email to is enough. You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the alleged infringement (Art. 77 GDPR). ## Further information You are under no legal or contractual obligation to provide data to us; without an email, however, we cannot answer a request. There is no automated decision-making, including profiling (Art. 22 GDPR). The website is served only over an encrypted connection (HTTPS). Last updated: 6 November 2026 Source: https://bitwerk.systems/privacy/