Privacy.

Last updated 18 October 2026

This site sets no cookies. It keeps three small notes in your browser, each only after you do something, and they are never sent anywhere. There is no advertising, no advertising network, no cross-site tracking, and nothing here is sold or shared with data brokers.

Who is responsible

The controller for the processing described here is:
Alexander Henderson Hamilton, c/o flexdienst – #21970, Kurt-Schumacher-Straße 74, 67663 Kaiserslautern, Germany
support@audiout.app

The scale of processing here does not require a data protection officer, so there is not one. Write to the address above with any question about your data and it reaches me directly.

What is collected and why

Grouped by what you are doing. Each part says what is collected, what it is for, and the legal basis.

Visiting the website

The site is hosted on Cloudflare. To deliver a page to you, Cloudflare necessarily processes your IP address and the request itself, and uses them to keep the service up and to block attacks. Legal basis: legitimate interests, Art. 6(1)(f) GDPR — the interest being running a website that works and is not trivially knocked over.

When a request fails on my side, the failure is recorded in an error log kept by PostHog in the European Union: the path that failed and the error text, never your IP address, your browser or anything you sent. Same legal basis.

No third parties to display a page: the typeface this site uses is served from this site's own domain. No font service, content delivery network or other third party is contacted to render a page, so nothing about you is sent anywhere to display type. The one exception is the Buy page, which loads Paddle's checkout.

The site uses PostHog, hosted in the European Union, to count visits and see which pages and buttons people actually use. It runs in cookieless mode: it sets no cookies and stores nothing on your device.

Instead of an identifier kept in your browser, PostHog derives a visitor value on its servers by hashing your IP address, browser user agent and the site's hostname together with a secret that is regenerated every day and then destroyed. The IP address is discarded after that and is not stored. Because the secret changes daily and is not kept, the value cannot be traced back to you, cannot follow you to another site, and cannot connect today's visit to tomorrow's.

What is recorded: pages viewed, referring site and campaign parameters, clicks, how far down a page you scrolled, approximate device and browser type, and the checkout steps described below. There is no session recording and no profiling. Legal basis: legitimate interests, Art. 6(1)(f) GDPR — understanding whether the site works, using the least identifying method available.

PostHog also records how fast each page loaded and, when something moved while loading, which page element it was. This describes the page, not you.

Answering the two-question survey

Some visitors are shown two optional questions: what made them look for something like Audiout, and which features matter most to them. Answering is up to you. Each answer is sent as you give it, so if you close the survey after the first question, that answer is kept. Closing it otherwise sends only the fact that it was closed.

Your answers go to PostHog in the European Union, the same analytics service described above, with the same daily visitor value and nothing more. The survey asks for no name or email address. It also records what opened it (a download, the Features link, or scrolling down the home page). If you pick "Other" and type something, that text is sent as you wrote it, so please leave out anything personal. Legal basis: legitimate interests, Art. 6(1)(f) GDPR, to learn what people want from Audiout.

Buying Audiout

Checkout is run by Paddle, which is the merchant of record — the actual seller. When you open the Buy page, Paddle's script loads from cdn.paddle.com and Paddle receives whatever you enter: name, email address, billing country and payment details. Card details never touch this site or any server of mine.

Paddle decides how it handles that data as its own controller, under its own privacy notice shown at checkout. It shares your email address and the transaction details with me, and the licence server keeps your email address and Paddle's transaction and customer references, so that a licence key can be issued. Legal basis for my part of it: performance of a contract, Art. 6(1)(b) GDPR.

The site also records that a checkout was opened, that an email address was entered, which kind of payment was picked (card, PayPal, Apple Pay and so on), that payment was submitted, whether it failed, whether a purchase completed, and, if you leave the Buy page before finishing, the last of those steps you reached. These go to PostHog as described above and carry the Paddle transaction reference but no name, email address, card number or other payment details.

Your licence key

Your licence key is stored on the licence server at license.audiout.app, tied to the transaction reference from Paddle and to your email address, so that keys can be issued, re-sent when you ask on the "Resend my key" page, and verified by the app. The key is emailed to you from hello@audiout.app through Cloudflare's email service. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

The licence server keeps a delivery log in PostHog in the European Union for 14 days, with your email address only as a hash, so a key that never arrived can be traced. Legal basis: legitimate interests, Art. 6(1)(f) GDPR.

When a free trial starts, ends or turns into a purchase, and when a licence is bought, a record of that event goes to PostHog in the European Union. It carries the random ID of that copy of Audiout (or the transaction reference, when there was no trial), how many days into the trial it happened, and, for a purchase, which link brought you to the site, never your name, email address or licence key. Legal basis: legitimate interests, Art. 6(1)(f) GDPR, in knowing how many people go from download to trial to purchase, so the app and the site can be improved where people drop off.

Using Audiout for Mac

Discovery, routing, volume and playback stay on your network. None of it touches a server, even offline. The app's other connections are about your licence, your trial and updates:

  • a check of your licence key;
  • a check-in once per launch, carrying your key, a random ID for that Mac and the app version, and nothing else;
  • when you start the free trial, that random ID and a one-way hash that identifies the Mac without revealing anything about it, so a trial runs once per Mac;
  • the update check, when one runs.

The licence server keeps, for each key, the Macs that check in with it (the random ID, the app version, and when it was first and last seen), and for each trial, when it started and ends and whether it became a purchase. Your IP address is stored only as a one-way hash. A build compiled from source makes none of these connections. Legal basis: performance of a contract, Art. 6(1)(b) GDPR, for the licence checks and updates, and legitimate interests, Art. 6(1)(f) GDPR, for running a trial once per Mac.

Usage statistics are separate. Nothing else leaves the app unless you turn on "Share anonymous usage statistics", which is off by default and asked once during setup. With it on, the app sends PostHog in the European Union a random ID for that copy of Audiout, which features get used, crash and error reports (counts and fixed labels, never free text), Bluetooth connection quality as coarse ranges, the app version, Mac model, macOS version, language, region, time zone, network type, city, and whether Audiout is licensed. Speaker Bluetooth addresses and names never leave the Mac.

The app's own diagnostic log stays on the Mac. It leaves only if you save it yourself from Settings › About and attach it to an email. What you play, and what your speakers are called, never leave the Mac. Legal basis: consent, Art. 6(1)(a) GDPR, withdrawn at any time in Settings › General.

Using Audiout Remote for iPhone

The iPhone app sends usage statistics to PostHog in the European Union, on by default, switched off in Settings › "Share usage data". What it sends is a random ID generated once per install, never your name or account, together with the same short fixed set of properties the Mac app sends.

The microphone is used only while running a sync measurement: a sound is played and the phone listens for it. That sound is analysed on the phone itself and the result discarded immediately — it is never recorded to a file, and never sent anywhere. Legal basis: consent, Art. 6(1)(a) GDPR, in addition to the microphone permission iOS itself asks you to grant.

The app uses your phone's local network access to find and control your Mac. Nothing about that discovery or control leaves your local network.

Buying the Mac app's licence from inside the iPhone app is handled by Apple as an in-app purchase: Apple takes payment and any billing details never reach me. The app sends Apple's signed record of the purchase to the licence server, which keeps the purchase's transaction ID and the licence key it issued — no email address, no name. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. A refund through Apple revokes the key.

Asking to hear when the iPhone app is out

If you ask on the Audiout Remote page to be emailed when the iPhone app is on the App Store, your email address is stored on the licence server at license.audiout.app, with the time you asked and whether you confirmed. Nothing is sent to that address until you confirm by clicking the link in the confirmation email, and after confirming you get exactly one email: the announcement. These emails are sent through Cloudflare's email service. Every email carries an unsubscribe link, and unsubscribing deletes the address immediately. Legal basis: consent, Art. 6(1)(a) GDPR, withdrawn by unsubscribing.

Emailing support

If you write to support@audiout.app, Cloudflare forwards the message to my mailbox at Google (Gmail), where I keep it so I can answer it and so I have context if you write again. A support request is deleted 30 days after the issue is resolved. Email about anything else is kept for six years after the last message, then deleted. Legal basis: performance of a contract for support on a purchase, Art. 6(1)(b), or otherwise legitimate interests, Art. 6(1)(f).

What is stored in your browser

No cookies. The site keeps three small notes in your browser's storage, each written only after you do something, each there only to remember that choice:

  • whether you picked the light or dark theme;
  • whether you paused the moving background;
  • which surveys you have answered or closed, by the survey's ID, so the same survey is not shown to you again.

They hold no identifier and are never sent anywhere. Clearing this site's data in your browser removes them. PostHog, the analytics service, stores nothing in your browser at all.

Who receives your data

Nothing is sold or shared with data brokers. These receive data:

  • Cloudflare hosts the site and the licence server, processes each request to them, sends the licence and notification emails, and forwards email sent to support@audiout.app. It acts as a processor under a data processing agreement.
  • Google hosts the Gmail mailbox that support email is forwarded to and stored in.
  • PostHog, in the European Union, receives the website analytics, survey answers, the site's error log, the licence server's delivery log, trial and purchase events, and the apps' usage statistics when they are on.
  • Paddle runs checkout as merchant of record and handles what you enter there as its own controller.
  • Apple takes payment when you buy the licence inside the iPhone app.

Where your data is processed

PostHog processes everything it receives in the European Union. Cloudflare and Google are US companies and may process data in the US. Those transfers rely on the EU–US Data Privacy Framework and on the EU standard contractual clauses in their terms. Paddle and Apple describe their own transfers in their privacy notices.

How long data is kept

  • Website analytics, including survey answers: one year, then deleted.
  • Cloudflare's request logs for the site and the licence server: 3 days.
  • The site's error log: 14 days.
  • The licence server's delivery log: 14 days.
  • Trial and purchase events: one year, then deleted.
  • Usage statistics from the Mac and iPhone apps: one year, then deleted.
  • Your licence key, its transaction reference, your email address and the Macs that check in with it: for as long as the licence can be used. A refunded or revoked licence is deleted three years after it was revoked.
  • Trial records: three years after the trial ends, then deleted.
  • A release notification address: deleted immediately when you unsubscribe.
  • Requests to re-send a key or to be notified, kept to stop the forms being used to send spam: two days, then deleted.
  • Support requests: 30 days after the issue is resolved. Other email: six years after the last message. Then deleted.
  • The notes in your browser: until you clear this site's data.

Your rights

Under the GDPR you can ask for access to your data (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), and a portable copy (Art. 20). Where something is based on consent, you can withdraw it at any time, as described next to it above. One email to support@audiout.app is enough — no form, no particular wording.

Right to object. You can object at any time to anything above that is based on legitimate interests, including analytics (Art. 21 GDPR). Email support@audiout.app.

You only have to give your email address to buy, so the key can reach you. Without the trial check, the app cannot start a free trial. Everything else is optional.

You also have the right to complain to a supervisory authority. The competent one for me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin's state data protection authority), though you may complain to the authority where you live or work instead.

One consequence worth stating plainly: because analytics and survey answers cannot be linked back to a person, I genuinely cannot look up "your" analytics data or find a single person's survey answer, and so Art. 11(2) GDPR means the access and deletion rights above cannot be exercised against it. This is a limit created by collecting less, not a way of avoiding the rules.

To object to analytics before contacting me, any content or tracker blocker will stop it, browsers with tracking protection do so already, and the site honours the Do Not Track setting.

Changes to this page

If what the site does changes, this page changes with it and the date at the top moves.