Privacy policy
This policy covers Drop Chord Station at chords.fretmatrix.com. Updated: 6 September 2026.
Controller and contact
Alexander Badiarov, Goltsteinstr. 58, 50968 Cologne, Germany.
Email: elexandor@gmail.com · Phone: +49 221 29997031. See also the legal notice.
Hosting and server logs
The service is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The booked web hosting location is Nuremberg, Germany. Netcup acts as processor under Article 28 GDPR. Requests generate server logs containing IP address, time, requested URL, referrer, status code, transferred volume and browser information. They support operation, troubleshooting and abuse prevention under Article 6(1)(f) GDPR. Our legitimate interest is a reliable, secure service. Logs rotate daily with at most 14 files retained per log type.
Cookies and storage on your device
The session cookie FRTX_SESSION contains a random session identifier for sign-in and protection against forged requests. It has no fixed expiry date. Browsers may restore sessions after restarting; you can explicitly sign out or delete site data.
Local Storage remembers your selected language, display and playback settings, local USER songs and library overrides. IndexedDB (fretmatrix-autosave) stores your current draft and up to 50 undo steps. Local Storage is the fallback when IndexedDB is unavailable. Drafts are not automatically published as online songs. Local data remains until replaced or removed by deleting site data, which can erase unsaved drafts.
These storage operations provide functions you requested under Section 25(2)(2) TDDDG. Personal data processing relies on Article 6(1)(b) GDPR for providing these functions and Article 6(1)(f) for security.
Optional usage statistics
Only after you consent, the app counts song views, playback, favorites, saves, printing and PDF export. Requests contain the event type, song category, where applicable a song identifier, and selected view options for saving/printing/export. The server groups these into daily totals. Song identifiers can be linked to a stored song and its author. Statistics requests contain no user identifier, password or song content and send no session cookie. Technical server logs still apply.
The purpose is to improve frequently used features. The basis is Article 6(1)(a) GDPR and, where device information is involved, Section 25(1) TDDDG. Declining does not restrict app functions. Your choice is stored locally without a personal identifier as fretmatrix.privacy.v1 for at most 180 days. You may withdraw consent for future processing at any time in Privacy settings; earlier lawful processing is unaffected. Aggregated totals are retained only while needed for this analysis.
Accounts, songs and community
Registration requires a username, email and password. Passwords are stored as cryptographic hashes. Account and language settings, folders, saved songs and song revisions are processed to provide your account under Article 6(1)(b) GDPR. Without mandatory details an account cannot be created; the local app remains available.
Optional profile details such as name, city, country, website, social links and avatar can be publicly visible with your username. Email addresses and passwords are not part of public profiles. Comments and published songs are available to visitors. Unlisted songs can be opened by anyone holding the link and are therefore not private. Private songs remain associated with your account. Others may retain copies of previously public content.
Account data and content are generally retained for the duration of your account. Archiving or removing a song from the visible library may retain data and revisions for recovery. To request complete deletion or access, contact the email address above. Legal retention requirements or legal claims may prevent immediate complete deletion. According to its provider documentation, Netcup creates daily backups of website content, databases and email, retained for no more than seven days. Data deleted from the live service may remain in these backups until rotation.
Password recovery and abuse prevention
Forgot password uses your email to send a confirmation link and a notification after a successful change. The single-use link expires after 30 minutes and changes the password only after you confirm with a new password. Previous sessions are then invalidated. Passwords are never sent by email. Delivery data temporarily resides in a protected outbox, is removed after successful handoff to the mail server, and expired messages are removed on the next delivery run. Delivery uses Netcup’s mail service with support@fretmatrix.com as sender. Netcup retains mail server connection logs for 14 days; these logs do not contain email content.
To limit abusive sign-in, registration and recovery requests, the app keeps temporary hashed counter keys derived from a login identifier, email address or IP address. These are not anonymous data. Windows last up to one hour and expired counters are cleaned on subsequent requests. The bases are Articles 6(1)(b) and (f) GDPR for account recovery and service protection.
Contact, recipients and external links
Contact messages are processed to answer your request under Article 6(1)(b) or (f) GDPR, depending on the matter. They are deleted when the matter is resolved and no legal retention or legitimate evidence requirement remains. The contact address above uses Gmail; when you use that address, Google processes the email under that service's terms. Messages to support@fretmatrix.com are also forwarded to this Gmail address; a copy remains in the Netcup mailbox. See Google's privacy information.
Fonts and libraries used at app startup and for PDF export are served locally. Links to the forum, Ko-fi or other services open those services only when clicked; their own policies then apply. The operator and processors required for hosting and mail delivery can access the relevant account data. This app does not use automated decisions including profiling under Article 22 GDPR.
Your rights
Subject to the legal conditions, you have rights of access, correction, erasure, restriction and portability under Articles 15–20 GDPR. You may object to processing based on legitimate interests for reasons relating to your situation under Article 21 and withdraw consent for future processing at any time. Please contact the controller above.
You may complain to a supervisory authority under Article 77 GDPR, in particular the North Rhine-Westphalia data protection authority, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, or the authority at your habitual residence.