Privacy policy
Last updated: 10 September 2026 · applies to the sonventory.com website and the Sonventory Mac app
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) for the operation of this website is:
Sonventory, owner: Tibor Czekayc/o COCENTER
Koppoldstr. 1
86551 Aichach, Germany
Email: info@tiborczekay.com
A different division of roles applies to the processing that takes place inside the app on your own Mac. It is described separately in section 4.
2. The essentials, briefly
- This website sets no cookies of its own, uses no tracking tools and contains no form. Our hosting provider may set a cookie that is strictly necessary to keep the site secure (section 3.1); there is none for analytics or advertising.
- The site itself stores nothing in your browser: no localStorage, no sessionStorage. There is no setting to remember, the site follows your device’s light or dark appearance without saving a preference. It is published in English.
- Fonts are loaded locally from our own server. No connection is made to Google Fonts.
- The Sonventory app is a pure desktop application. There is no registration, no user account and no server of ours on which your content, videos, metrics, comments or analyses would be stored.
- We run exactly one small helper service for the app: a relay service for the sign-in flow at TikTok and Instagram (section 6). It has no database and stores no content.
3. Website
3.1 Hosting (Cloudflare)
This website is hosted with Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany, as the European branch of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; “Cloudflare”).
When the website is accessed, Cloudflare processes technically necessary connection data (in particular IP address, date and time of access, URL requested, browser and device type) in order to deliver the site, keep it stable and fend off attacks. The legal basis is Article 6(1)(f) GDPR (legitimate interest in secure and performant operation).
Cloudflare may set a cookie of its own that is strictly necessary to distinguish human visitors from bots and to fend off attacks. It carries no analytics or advertising purpose, and it is not read by us. Such storage is exempt from the consent requirement under section 25(2) no. 2 TDDDG because it is strictly necessary to deliver the service you requested; you can delete it at any time in your browser settings.
A data processing agreement is in place with Cloudflare (Article 28 GDPR). Where data is transferred to the USA, the transfer relies on the adequacy decision for the EU-US Data Privacy Framework, to which Cloudflare, Inc. is certified, and additionally on EU standard contractual clauses.
3.2 Email communication
If you contact us by email we process the sender and recipient address, the message content and technical metadata in order to deal with your enquiry (Article 6(1)(b) or (f) GDPR). We currently use iCloud Mail from Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple describes international transfers and its use of standard contractual clauses in its privacy policy.
4. The app: who is responsible for what
Sonventory’s catalogue and analysis run on your Mac. We do not host your channel library or receive its videos, comments or analysis results automatically. We are responsible for our own website, support correspondence and sign-in relay processing described in this policy.
If you determine why and how channel data is analysed, you are normally the controller for that processing. If you act only on a client’s documented instructions, the client may be the controller and you its processor. Roles depend on the actual processing and responsibilities, not simply on where the software runs. See the EDPB guidance on controllers and processors.
What this means for you in practice
Channel comments can contain personal data. You or your client must establish the relevant legal basis, provide any required information to the people concerned, and set appropriate retention and deletion practices. Where a controller engages a processor, Article 28 GDPR requires an appropriate agreement. The applicable obligations depend on your role and use case.
The following sections explain the app’s data flows and the external services involved, including the relay processing for which we are responsible.
5. Connecting to the platforms
In the app you connect channels you own or are validly mandated to manage. Sign-in happens in your system browser, directly with the platform concerned. The app never receives your password; it receives a read-only access token, which is stored in your Mac's login keychain. You can revoke access at any time in the settings of the platform concerned.
| Platform | Provider | What is retrieved |
|---|---|---|
| YouTube | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Videos and metadata for your channel, metrics and audience data from the analytics interface, comments, and, through data portability, your video files. |
| TikTok | TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland | Videos and metadata for your account, metrics, and, through data portability, your video files together with the sound credit TikTok states. |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland | Posts and metadata for your professional account, insights, comments, the media URL, and Instagram's own statement about the audio used. |
Retrieval happens directly between your Mac and the platform concerned. We are not involved and receive nothing from it. According to their own statements the platforms also process data outside the EU; their privacy notices and transfer bases govern.
6. Relay service for sign-in (Cloudflare Worker)
When exchanging the sign-in code for a token, TikTok and Instagram require a secret provider credential. Such a secret cannot sit inside a shipped app without being readable there. We therefore run a minimal relay service for this as a Cloudflare Worker at an address of our own.
This service accepts the sign-in code, adds the provider credential, forwards the exchange to the platform and returns its answer. It has no database, no user accounts and no copy of your content; its application code does not persist tokens or sign-in codes. Token refresh requests also pass through this relay. Cloudflare’s operational logging is described below. For Instagram it additionally provides the HTTPS landing page Meta requires, which hands the process straight back to the app on your Mac.
The relay processes connection and request metadata for delivery, troubleshooting and abuse prevention. Cloudflare Workers Logs are enabled in the deployment configuration. Request URLs may include the short-lived Instagram authorisation code; therefore the absence of an application database does not mean the absence of operational logs. The legal bases are Article 6(1)(b) GDPR for the sign-in function and Article 6(1)(f) GDPR for secure operation. Cloudflare’s standard Workers Logs retention is up to seven days, depending on the plan. See Cloudflare Workers Logs and section 3.1.
This service is not needed for signing in to YouTube; Google expressly states that the credential for desktop applications is not confidential. There the exchange happens directly between your Mac and Google.
7. Music recognition (Apple)
Music recognition uses the interface built into macOS by Apple (ShazamKit). The process is as follows:
- On your Mac, the app cuts short audio excerpts from your videos.
- From each excerpt a signature is computed locally: a numerical profile from which the audio cannot be reconstructed.
- That signature is sent to Apple to be matched against the music catalogue. The audio or video file itself is not transmitted.
- What comes back is catalogue information about the detected recording, such as title, artist, album and ISRC.
The provider is Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple describes international transfers and its use of standard contractual clauses in its privacy policy. Apple's privacy terms apply.
8. Comments and sentiment
Comment sentiment analysis uses Apple's Natural Language framework built into macOS and runs entirely on your Mac. Comment text is not transmitted to Apple, to us, or to any other third party. It does not leave your device.
The comments come from the platforms (section 5) and can contain display names, text and timestamps. Your role and responsibilities are described in section 4.
9. Video files
For music recognition the app needs the video file. It is downloaded from the platform concerned to your Mac, analysed there, and then deleted again; only the recognition results and the metadata are kept permanently. Nothing is uploaded to us or to a recognition service.
10. Purchase and subscription (Apple)
App Store purchase and subscription processing follow the Apple Media Services Terms and the merchant identified at checkout. We provide the app licence and support. The app uses StoreKit to check entitlements; we do not receive payment-card details.
The app checks the validity of your subscription through StoreKit, locally on your Mac. No account with us is created by this, and no purchase data is transmitted to us. From Apple we receive sales and financial reports for business administration. The app does not send its channel library with these reports. Apple's privacy terms apply in addition.
11. Crash and diagnostic data
The app contains a local diagnostic log to help you troubleshoot. It stays on your Mac and is not transmitted automatically. If you send us a log for support, that happens solely at your initiative; we then process it to deal with your enquiry (Article 6(1)(b) or (f) GDPR) and delete it once the matter is closed.
Separately, macOS can send crash reports to Apple if you have enabled that in your system settings. You control that transmission there; from it Apple provides us only pseudonymised technical reports.
12. Recipients of the data
The recipients are exclusively the bodies named in this policy: Cloudflare (website and relay service), Apple (music recognition, app distribution, email), and Google, TikTok and Meta to the extent that you connect the platform concerned yourself. In addition, where required by law, our tax adviser and the tax authorities in the context of our bookkeeping.
No data is passed on for advertising purposes. We build no database about channels, creators or their music usage, and we do not use your content for benchmarks, statistical analysis or model training. Technically we have no access to it.
13. Transfers to third countries
International transfers depend on the receiving provider and service. Cloudflare describes its EU-US Data Privacy Framework certification and standard contractual clauses in its privacy policy. Apple describes its transfer safeguards in its own policy (section 7). The platforms you connect may process data in additional countries under their own notices and safeguards. We do not claim that every provider relies on the same mechanism.
14. Retention and deletion
| Data | Retention |
|---|---|
| Data in the app on your Mac | For as long as you keep it. Delete the relevant Sonventory library folders, exported files and any backups you control. Removing the app alone does not necessarily remove its Documents folder, exports or keychain entries. |
| Access tokens in the keychain | Disconnect in the app to remove the local connection. Revoking at the platform invalidates authorisation but may not delete local keychain entries. Expired tokens are replaced during refresh. |
| Downloaded video files | Only for the duration of recognition, then deleted automatically. |
| Relay service | No application database. Operational request logs can include callback URL data; Cloudflare’s standard Workers Logs retention is up to seven days, depending on the plan. |
| Website logs | As determined by the hosting provider, briefly, for delivery and attack defence. |
| Email correspondence | At the latest 6 months after the exchange is concluded, unless a statutory retention obligation applies. |
| Business records | For the statutory retention periods. Accounting vouchers generally eight years, commercial and business letters generally six years (section 257 HGB, section 147 AO). |
15. Your rights
The website has no form and requires no Sonventory account. When you use sign-in or email support, the data needed for that function is processed on the bases described above. Where processing depends on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Platform permissions can be revoked with the platform.
You have the following rights against us in respect of personal data concerning you:
- right of access (Article 15 GDPR),
- right to rectification (Article 16 GDPR),
- right to erasure (Article 17 GDPR),
- right to restriction of processing (Article 18 GDPR),
- right to data portability (Article 20 GDPR).
If your rights concern data processed in the app on a user's device, please direct the request to that user as the controller (section 4). We cannot answer such requests because we have no access to that data.
Right to object (Article 21 GDPR)
Where we process data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. Send the objection informally to the contact address given above.
You may lodge a complaint with a data protection supervisory authority under Article 77 GDPR, particularly in the Member State of your habitual residence, place of work or the alleged infringement. For example, you can contact the Hamburg Commissioner for Data Protection and Freedom of Information or the Bavarian Data Protection Authority. A correspondence address alone does not determine which authority is competent.
16. No automated decision-making
We do not use the website or relay to make decisions about you that have legal or similarly significant effects under Article 22 GDPR. Music recognition and comment sentiment provide descriptive results. Do not treat sentiment scores as reliable assessments of individual people.
17. Language
The Sonventory website and these legal documents are published in English. The app supports German and English. This policy is published in English only, and there is no other language version of it that could take precedence. You can write to us in English at the address in section 1; we will answer in English.
18. Changes to this policy
We update this privacy policy when the legal position, the services used or the app's features change. The version published on this page at any given time applies.