Privacy Policy for the “Podcasts AM” app

Last updated: 10 November 2026

This privacy policy explains what data the “Podcasts AM” app (the “app”) processes, which servers it connects to and what rights you have. It applies to the app on Android devices (Google Play) and on iPhone, iPad and Mac (App Store); according to the App Store, the iPad version can also be used on Apple Vision, where the same applies as for the iPad. It describes the current version of the app.

Older versions still installed on devices may not yet include some of the functions described here. Some older versions, on the other hand, still include functions that no longer exist: an “Open in Apple Podcasts” button which, when you tap it, opens the show’s page on Apple Podcasts in the corresponding app or in your browser – only this action transmits data to Apple, and Apple’s terms apply (section 5) – and tip purchases, which Apple handles via the App Store as described in section 8.

This policy applies only to the app. The website amapps.app is covered by the website’s privacy policy (in German); app stores and third-party services are governed by their own terms.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), and service provider under § 5 of the German Digital Services Act (Digitale-Dienste-Gesetz – DDG), is:

Andreas Maier

Dürerstr. 14, 73547 Lorch, Germany

Email: support@amapps.app

2. No Data Protection Officer

No data protection officer has been appointed under Art. 37 GDPR, as there is no legal obligation to do so (individual developer, no large-scale processing of personal data). For privacy questions, please contact the controller named above directly.

3. Key points in brief

• There is no user account, no registration and no sign-in.
• The app contains no analytics, tracking or advertising software, no advertising and no crash reporting (for Google’s billing library on Android, see section 8). It uses no advertising ID and no device or installation identifier. No usage profiles are created.
• The app stores your subscribed shows, downloads, playback positions, bookmarks and settings only on your device (section 10, which also covers device backups). It does not transmit this data as a whole, not even to the controller. Individual items from it do, however, become visible in the requests a function needs: for example the selected country or – because the app loads the cover art of your subscribed shows and, if you have turned on automatic downloads, fetches their details and feeds – which shows you have subscribed to (sections 5 and 7).
• To find and play podcasts, the app fetches content from the internet: from Apple (directory, charts, search), from the podcasters’ servers (feeds, audio, images) and from two addresses of the controller (daten.amapps.app and amapps.app), which are hosted by external providers. Purchases go through the App Store or Google Play.
• In doing so, the app’s code uploads nothing from your device (for Google’s billing library on Android, see section 8). For technical reasons, however, each server contacted inevitably learns your IP address, the time, the requested address and a technical identifier (section 4).
• The controller analyses neither individual requests nor where they come from, and does not try to link them to a person. Through the app itself, personal data reaches the controller only if you email the controller (section 9.2). The connection data of requests to daten.amapps.app is processed by Cloudflare on the controller’s behalf (section 6.3). What Apple and Google make available to the controller as the app’s developer is governed by their terms (sections 8 and 14).
• The controller does not sell any data and does not share any data for advertising, analytics or tracking purposes. The exception is the logging data that Google’s billing library transmits to Google on Android (section 8). Google uses this information to improve the library and to help with troubleshooting.
• Where processing is based on legitimate interests, you can object to it at any time (section 16).

4. Connections to the internet – overview

The app connects only to the parties listed below. The app’s code only fetches content from them; it does not send forms, files from your device or usage statistics of its own (for Google’s billing library on Android, see section 8). What a server learns comes solely from the request itself – and that includes which content you fetch:

• Your IP address. No internet connection is possible without it. It can be used to infer roughly which country or region a request comes from.
• The time of the request.
• The requested address. It may contain information such as the selected country, your search term or the identifier of a show or episode (details in the following sections).
• A technical identifier (“user agent”). When contacting daten.amapps.app, the app identifies itself as “PodcastsAM/<version>+<build> (+https://amapps.app)”; when fetching excerpts from the podcasters’ servers, currently as “PodcastsAM/1.0 (+https://amapps.app)”. All other requests made by the app carry the generic identifier of the Dart programming environment (“Dart/<version> (dart:io)”), which does not reveal the app’s name. Video episodes are played by the Android or Apple system player with its own identifier.

The app’s code does not send any account information, device or advertising identifier, usage statistics or crash reports. The exception is the logging data that Google’s billing library transmits to Google on Android (section 8).

Security and encryption

The app fetches the controller’s addresses and Apple’s APIs and image servers over encrypted connections (HTTPS). For the podcasters’ servers, this depends on the addresses they publish: because many podcast feeds still use unencrypted “http” addresses, the app allows such connections on all platforms. In that case, third parties on the same network (for example on public Wi-Fi) or your internet provider can see which file is being fetched.

The app stores the data described in section 10 only in its own storage areas on the device, not in generally accessible folders, and does not share it with other apps; the protection of these areas is handled by Android, iOS and macOS. Payment data is processed solely by Apple and Google; the app does not see it. Because the app works without an account and sends no usage data to the controller, the controller – apart from support emails and the connection data that Cloudflare processes on the controller’s behalf (section 6.3) – holds no collection of data on the app’s users that could be lost or stolen.

5. Podcast directory, charts and search (Apple)

The app uses Apple’s public podcast directory. To do so, it queries Apple’s APIs (rss.marketingtools.apple.com for the charts, itunes.apple.com for search and show details) and loads cover art from Apple’s image servers (e.g. is1-ssl.mzstatic.com).

• Charts: The app loads the charts for the selected country every time it starts – even if another area of the app is currently shown – as well as when you change the country and when you refresh. The country code is transmitted.
• Cover art: The app loads the cover art in charts, search, show pages and your library from Apple’s image servers; it loads the cover art of your subscribed shows every time it starts, even if another area of the app is currently shown.
• Search: When you search, your search term is transmitted to Apple together with the selected country as soon as you pause briefly while typing (after about 0.4 seconds) or repeat the search. It is used only to show you matching shows from Apple’s directory. The controller does not receive your search terms, and the app does not store them.
• Show details: When you open a show, the app queries Apple with the show’s ID number and the selected country to obtain the address of the podcast feed. This also applies when, on start-up, the app restores the show page you left open last time. If you start an episode from the excerpts area, the app queries Apple in the same way to fill in the creator’s name.
• Automatic downloads: If you have turned on this function in the settings (“Auto-download new episodes”; off by default), the app queries Apple for the details of each subscribed show every time it starts (ID number; the country is always “us”). Apple can therefore see which shows are queried from your IP address. The app then loads the feeds and, where applicable, the newest episode (section 7).
• Country: Unless you choose a country yourself, the app uses the region from your device’s language settings or, failing that, the USA. It stores your choice on the device.

The app does not store Apple’s responses as such. Only details of shows (name, creator, ID number, cover art address) that you have subscribed to, downloaded, last opened or last listened to are stored permanently, along with the cover art for the playback controls (section 10).

• Recipient: Apple as a separate controller. According to Apple’s privacy policy, Apple Distribution International Ltd. (Ireland) is the controller for users in the European Economic Area; the data is usually stored by Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Apple’s Privacy Policy applies.
• Purpose: displaying charts, search results, show details and cover art; automatically downloading new episodes if you have turned this on.
• Legal basis: Art. 6(1)(b) GDPR where you trigger the function yourself or have turned it on (search, opening a show or episode, automatic downloads). For the requests at start-up (charts, cover art, where applicable the show you last opened), Art. 6(1)(f) GDPR; the legitimate interest lies in being able to show you current charts, your library and the point where you left off as soon as you open the app.
• Third country: For users in the European Economic Area, the recipient is Apple Distribution International Ltd. in Ireland. Where Apple passes the data on to Apple Inc. in the USA, Apple states that it relies on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).
• Retention: according to Apple’s rules; the controller has no influence over this.

6. Additional content and settings from amapps.app

The app fetches two kinds of files from the controller’s addresses. The controller does not run his own server for this; the files are hosted by hosting providers (section 6.3).

6.1 Additional content (daten.amapps.app)

For selected shows, the controller provides additional content at daten.amapps.app: short summaries, key points, chapters, show notes and lists of short excerpts from episodes with accompanying text. No audio files are stored there; the audio of the excerpts comes directly from the podcasters’ servers (section 7).

• When: every time the app starts (the list of covered shows and the excerpt list for the selected country), when you change the country and when you refresh; when you open a covered show (the show’s index and, where applicable, files for individual episodes) and when you open an episode in the player, including when, on start-up, the app restores the show you last opened or the player; for chapters, if the podcaster does not provide any; before an excerpt is played. As a rule, the app requests nothing there for shows that are not covered. Only if the list of covered shows cannot be read at that moment, although the server is responding, does the app send a request when you open a show or episode, using an identifier derived from the address of the podcast feed; this identifier, too, allows the show to be determined.
• What is transmitted: IP address, time, the requested file and the user agent “PodcastsAM/<version>+<build> (+https://amapps.app)”, i.e. the app’s name, version and build number. The app appends no parameters and sends no account information and no device identifier. Because the file names contain the country or an identifier of the show or episode, the requests do, however, reveal which country you have selected and which covered shows and episodes you open.
• On the device: The app keeps the responses only in memory, for at most one hour, and the excerpt list until the app is closed. It stores none of them on disk.
• Purpose: providing the additional content and excerpts. The name and version in the user agent identify the requests as coming from this app; this is intended to make it possible later to tell when older versions of the app are no longer in use. The controller does not currently analyse this information; this policy will be updated before that changes.
• Legal basis: Art. 6(1)(b) GDPR where you open a show, an episode or an excerpt. For the requests at start-up and the inclusion of name and version in the user agent, Art. 6(1)(f) GDPR; the legitimate interest lies in showing additional content and excerpts without delay and in identifying the requests as coming from this app and its version.

6.2 Purchase page settings (amapps.app)

Every time the app starts and when you return to the app – in that case at most once an hour after the last successful fetch – the app loads the file https://amapps.app/podcast-am/paywall.json. It determines how the purchase page is designed, how often it appears and whether subscriptions are offered there.

• What is transmitted: only the technically necessary connection data (IP address, time, the fixed address of the file, user agent “Dart/<version> (dart:io)”). The app appends no parameters. The file contains settings for different regions; the app decides on the device which of them applies, based on your device’s region setting. Your region is not transmitted.
• On the device: The app stores the most recently loaded file until it receives a newer one.
• Purpose and legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in being able to adjust the purchase page without an app update.

6.3 Hosting providers

• Cloudflare, Inc. (USA) – processor. Cloudflare receives all requests to daten.amapps.app, provides the encrypted connection to the app and forwards the requests to GitHub Pages. Cloudflare processes the connection data on behalf of the controller; the data processing agreement (Art. 28 GDPR) is part of Cloudflare’s terms. Cloudflare automatically compiles aggregated statistics from the connection data, such as the number of requests. The controller analyses neither individual requests nor the countries they come from, and does not use the connection data to determine anyone’s location. Cloudflare is not involved for amapps.app (section 6.2). Cloudflare’s Privacy Policy applies.
• GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (part of Microsoft Corporation) – GitHub Pages, separate controller for the access data. GitHub stores the files and delivers them: directly for amapps.app, and behind Cloudflare for daten.amapps.app. Apart from what the delivery of the files involves, the controller passes no data to GitHub. According to GitHub’s documentation on GitHub Pages, GitHub logs the IP address for security purposes when GitHub Pages sites are accessed. GitHub processes this access data under its own responsibility; the controller does not receive it. For requests to daten.amapps.app, Cloudflare removes the headers that may contain your IP address before forwarding them (the “Remove visitor IP headers” setting); according to Cloudflare, GitHub therefore sees only Cloudflare’s address there, not yours. For amapps.app (section 6.2), your device contacts GitHub directly, so GitHub receives your IP address there. For delivery, GitHub in turn uses service providers, including Fastly (USA). GitHub’s Privacy Statement applies.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in providing the files reliably, securely and at low cost without the controller having to run his own server.
• Third country: Cloudflare and GitHub are certified under the EU-U.S. Data Privacy Framework. The transfer is therefore based on the European Commission’s adequacy decision (Art. 45 GDPR).
• Retention: According to Cloudflare, it keeps the connection data on behalf of the controller only for as long as necessary for its services, i.e. for delivery, security and the aggregated statistics; Cloudflare does not publicly state a fixed period. GitHub keeps its access logs according to its own rules; GitHub does not publicly state a fixed period either.

7. Podcasters’ servers: feeds, playback, downloads and excerpts

The podcasts themselves do not come from the controller. Your device loads feeds, audio and video files, chapters and images directly from the servers that the podcasters specify in their feeds. The controller does not provide any of these files himself and receives nothing from these connections. For excerpts, however, the address requested, the section of the file, the image address and the user agent are taken from the files on daten.amapps.app (section 6.1).

• Feed: when you open a show – including when, on start-up, the app restores the show you last opened – and during automatic downloads (section 5). The server does not learn the app’s name in this case.
• Chapters and images: The app loads images of episodes, chapters and excerpts, and where applicable the podcaster’s own chapter files, directly from the respective server. Right at start-up, it loads the images shown for your downloads, for the episode you last listened to and on the excerpts button, even if another area of the app is currently shown. The image servers can tell from this which images are being fetched from your IP address.
• Playback: The app loads streamed audio episodes through a cache that can be reached only from within your device (address 127.0.0.1). Video episodes are played directly by the Android or Apple system player. If loading is interrupted for an episode you are currently listening to, the app checks every five seconds, for up to five minutes, whether the server is responding again by requesting the first byte of the file, and then resumes playback.
• Downloading: The app downloads the episode’s file from the podcaster’s server. Only for video episodes does it first query the file size and ask you to confirm the download. It plays downloaded episodes without an internet connection.
• Excerpts: In the excerpts area, the app loads short portions of the audio files directly from the podcasters’ servers – for the excerpt shown and, in advance, for the following ones. In doing so, it identifies itself with the user agent “PodcastsAM/1.0 (+https://amapps.app)”; the podcasters can therefore tell that the request comes from this app.
• Podcasters’ service providers: Many podcasters route the addresses of their episodes through audience measurement or redirect services (for example Podtrac) and have their files delivered by hosting services (for example Libsyn, Megaphone or Podigee). These services then also receive the request. Which services are involved is decided by the podcaster, not by the controller.

• Recipients: the operators of the podcast servers and their service providers as separate controllers. They are located worldwide; their own privacy terms apply, over which the controller has no influence.
• Purpose: displaying, playing and downloading the content you choose.
• Legal basis: Art. 6(1)(b) GDPR (the function you requested). For the requests at start-up (images, where applicable the feed of the show you last opened), preloading the following excerpts and the check after loading has been interrupted, Art. 6(1)(f) GDPR; the legitimate interest lies in showing you your library and the point where you left off as soon as you open the app, and in smooth playback with as few interruptions as possible.
• Third country: The servers may also be located outside the EU, including in countries without an adequacy decision. Your device fetches the content from them directly, just as when you visit a website; the servers receive only the information contained in the request itself (section 4). The controller does not pass any further data on to them; in the controller’s view, this therefore does not constitute a transfer by the controller to a third country. For shows and episodes, you choose the content yourself; which shows the excerpts come from is selected by the controller. The controller has no contracts with the podcasters or their service providers.
• Retention: according to the rules of the respective providers.

8. In-app purchases (App Store and Google Play)

In the app you can purchase “Podcasts AM Pro” – depending on what is on offer, as a one-time purchase or as a monthly or yearly subscription. Which offers the purchase page currently shows is controlled by the settings described in section 6.2.

• Handling: On iPhone, iPad and Mac, Apple handles the purchase via the App Store; on Android, Google does so via Google Play. Payment, billing, subscription management, cancellation and refunds are handled by Apple or Google as separate controllers under their own terms and privacy policies (Apple, Google).
• What the app learns: the offers with their prices – including an introductory offer such as a trial period, if the store offers you one – as well as whether a purchase has been completed or restored and which product it concerns. The app does not receive your name, your email address or your payment details. It does not read receipts, transaction IDs or purchase tokens; it does not give the store any identifier of its own for you and sends none of this to a server of the controller. There is no server-side verification of purchases; the app relies on the purchase status reported by the store.
• What the controller learns: The app does not report any purchases to the controller. Which information about sales Apple and Google make available to the controller as the app’s developer, for example for billing and tax purposes, is governed by their terms.
• On the device: Only the fact that Pro is unlocked and the identifier of the product used to unlock it are stored.
• Connection to the store: Every time it starts, the app loads the current offers from the store, even if you already have Pro. If it could not load the offers, it tries again when you open the purchase page and when you return to the app. On Android, it also asks Google Play every time it starts and every time you return to the app which purchases belong to your Google Play account. This allows it to acknowledge pending purchases (Google Play otherwise refunds unacknowledged purchases after three days) and to unlock Pro again after a reinstallation. Using “Restore Purchases” on the purchase page, you can retrieve earlier purchases yourself at any time.
• Manage subscription (Android only): If Pro comes from a subscription, “Manage subscription” in the settings opens Google Play’s subscription management; the address contains the identifier of the subscription and of the app.
• Google’s billing library: The Android version includes Google’s library for purchases (Google Play Billing Library). According to Google’s release notes, since version 6 it logs whether its calls succeed or fail and whether there are problems with the connection to Google Play. Google uses this information to improve the library and to help with troubleshooting. It is transmitted to Google via Google components, not to the controller; Google processes it under its own terms and under its own responsibility.
• Legal basis: Art. 6(1)(b) GDPR for the purchase, unlocking, acknowledgement and restoring purchases at your request. For loading the offers every time the app starts and, on Android, for automatically checking your purchases every time the app starts and every time you return to it, Art. 6(1)(f) GDPR. The legitimate interest lies in always showing current prices on the purchase page, acknowledging pending purchases in time and unlocking Pro again after a reinstallation without any action on your part.
• Third country: For Apple, the recipient in the European Economic Area is Apple Distribution International Ltd. (Ireland); for passing data on to Apple Inc. (USA), Apple states that it uses Standard Contractual Clauses (Art. 46 GDPR). Where data goes to Google LLC in the USA, Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR).

9. Other functions

9.1 Rating prompt (iPhone, iPad and Mac only)

On iPhone, iPad and Mac, the app occasionally uses Apple’s own rating prompt to ask for a rating in the App Store – only after at least five days, three starts and 60 minutes of listening time, and no more than once every 90 days. The app checks these conditions using counters on the device (section 10). The app does not learn whether or how you rate it; the rating is processed by Apple. No rating prompt appears on Android. Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in asking satisfied users for a rating at a suitable moment without disturbing them.

9.2 Email to support

Via “Email support” in the menu and via “Why? Tell us” next to the “Player page” setting, the app opens a draft email to support@amapps.app in your email app. It is pre-filled with a subject line, the app version and build number, and the operating system and its version; for “Why? Tell us”, also with the player page layout you have selected. You can edit or discard the draft before sending it. The app itself sends nothing. Only when you send the email does the controller receive your email address, where applicable the name stored in your email app, the content and this information.

• Purpose: handling and answering your enquiry, troubleshooting.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in answering your enquiry and fixing errors in the app. If your enquiry concerns a purchase, additionally Art. 6(1)(b) GDPR.
• Recipients: Emails to support@amapps.app are received by Cloudflare, Inc. (USA) as a processor and forwarded, without the message itself being stored, to the controller’s mailbox at GMX (1&1 Mail & Media GmbH, Brauerstr. 48, 76135 Karlsruhe, Germany); GMX stores them there under its privacy policy. The sender, recipient, subject, time, technical message ID, delivery status and the results of the sender checks (SPF, DKIM, DMARC) are logged in the controller’s Cloudflare account. Third country: Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). Your own email provider also processes the email, under its own terms. The controller sends replies via Apple’s iCloud+ (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Apple Inc., USA) from an amapps.app address. Apple processes the reply, including your email address and any parts of your message quoted in it, under its Privacy Policy; for transfers to the USA, Apple states that it uses Standard Contractual Clauses (Art. 46 GDPR).
• Retention: for as long as necessary to handle your enquiry; the email and the replies to it, including the copies at GMX and iCloud, are then deleted unless statutory retention obligations apply. According to Cloudflare, it keeps the log in the Cloudflare account for 31 days.

9.3 Sharing the app and external links

“Share the app” opens your device’s share menu with a short text and the link https://amapps.app/podcast-am/get. You decide where to send it; the app itself transmits nothing in the process. The text contains no information about shows, episodes or your usage.

When you tap the relevant link, the app also opens this privacy policy, Apple’s standard licence terms (“Terms & Conditions” on the purchase page on iOS and macOS) and Google Play’s subscription management (section 8) in your browser or the corresponding app. The app itself transmits nothing in the process. The data processed there is governed by the terms of the respective providers, and for amapps.app by the website’s privacy policy (in German).

10. Local storage on your device

The app stores the following data only on your device – in a local database, in the app settings and as files. The app does not transmit this data as a whole either to the controller or to third parties, and the controller has no access to it. Individual items from it do, however, feed into the requests described in sections 5 to 8: above all the selected country. In addition, the requests for cover art and images at start-up and, if you have turned it on, automatic downloading reveal which shows you have subscribed to or downloaded. The stored data does not include an account, your name, your email address or a device identifier.

The app keeps all other responses from Apple and daten.amapps.app and all other images only in memory; they are discarded at the latest when the app is closed.

Deletion: You can delete subscribed shows (by unsubscribing from the show), downloads and bookmarks individually in the app. You can remove all other data by deleting the app from your device or, on Android, by clearing the app’s data in the device settings. On the Mac, the app’s data folder may remain after the app has been deleted (in the “Library/Containers” folder within your user folder); you can delete it there yourself. Copies in a device backup remain until you delete the backup or it is replaced.

Device backup: The app does not exclude this data from your device’s backup. If you use, for example, iCloud Backup, Google backup or, on the Mac, Time Machine, the database, the settings and – on iPhone, iPad and Mac – also downloaded episodes and the cache of the episode currently playing may become part of your backup. The cache for excerpts is not included. The backup is then stored in your Apple or Google account or on your own backup drive, not with the controller; backups with Apple and Google are governed by their terms.

Legal basis: Art. 6(1)(b) GDPR for the data resulting from your use (subscribed shows, downloads, positions, bookmarks, last opened items, settings including the flag for the player page default, Pro status, the technical flags for automatic downloads and playback, caches). For the counters for the purchase page and the rating prompt, Art. 6(1)(f) GDPR; the legitimate interest lies in showing the purchase page and the rating prompt in moderation and not too often.

Storing and reading information on your device (§ 25 TDDDG): The app stores the information listed above on your device, reads it back and reads your device’s region setting (sections 5 and 6.2). It does so in order to provide the app functions you use (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

11. App permissions at a glance

The app does not request permissions for location, camera, microphone, contacts, photos or files. On iPhone and iPad, it does not ask for permission to track you and does not use an advertising ID.

12. Recipients and transfers to third countries

The controller does not sell any data and does not share any data with third parties for advertising, analytics or tracking purposes. The exception is the logging data that Google’s billing library transmits to Google on Android (section 8). Google uses this information to improve the library and to help with troubleshooting. Only the following parties receive data, and only to the extent described.

Processors (acting on behalf of and on the instructions of the controller)

• Cloudflare, Inc. (USA) – provision of daten.amapps.app (section 6.3) and forwarding of emails to support@amapps.app (section 9.2). Third country: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Separate controllers (acting under their own privacy terms)

• Apple (Apple Distribution International Ltd., Ireland; Apple Inc., USA) – directory, charts, search and cover art (section 5), as well as the App Store, purchases and the rating prompt on iPhone, iPad and Mac (sections 8 and 9.1), and sending replies to your emails via iCloud+ (section 9.2). Third country: the recipient in the European Economic Area is Apple Distribution International Ltd. (Ireland); for passing data on to Apple Inc. (USA), Apple states that it uses Standard Contractual Clauses (Art. 46 GDPR).
• Google (Google LLC, USA, or the Google company responsible for your region according to Google’s Privacy Policy) – Google Play, purchases and the billing library’s logs on Android (section 8). Third country: where data goes to Google LLC in the USA, adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• GitHub, Inc. (USA) – hosting service on which the files of amapps.app and daten.amapps.app are stored (GitHub Pages, section 6.3). Apart from what the delivery of the files involves, the controller passes no data to GitHub. Only the access data generated when the files are fetched – for amapps.app in particular the IP address; for daten.amapps.app, Cloudflare removes it beforehand – is processed by GitHub as a separate controller, for the security of its services; the controller does not receive it. For delivery, GitHub uses service providers such as Fastly (USA). Third country: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• Operators of the podcast servers and their service providers (worldwide) – feeds, audio, chapters, images and excerpts (section 7). Third country: this includes countries without an adequacy decision; the servers receive only the information contained in the request that your device sends directly to them (section 7).

Your emails to support (section 9.2) are forwarded by Cloudflare to the controller’s mailbox at GMX (1&1 Mail & Media GmbH, Karlsruhe, Germany), where they are stored. Replies are sent by the controller via Apple’s iCloud+ (Apple Distribution International Ltd., Ireland; Apple Inc., USA).

13. Retention

• On your device: as described in section 10, until you delete the data or remove the app. The app limits the caches automatically.
• With the controller: The app sends the controller no data about your usage, and the controller does not keep any such data himself. Support emails and the replies to them are kept for as long as necessary to handle them and are then deleted, including the copies at GMX and iCloud, unless statutory retention obligations apply.
• With Cloudflare (on behalf of the controller): According to Cloudflare, it keeps the connection data of requests to daten.amapps.app only for as long as necessary for delivery, security and the aggregated statistics (section 6.3); Cloudflare does not publicly state a fixed period. According to Cloudflare, it keeps the log of forwarded emails (section 9.2) for 31 days.
• With GitHub: according to GitHub’s rules as a separate controller; GitHub does not publicly state a fixed period.
• With Apple, Google and the podcast servers: according to the rules of the respective providers, over which the controller has no influence.

14. App stores and operating system

The app is obtained and updated via Google Play or the App Store. The store operators and your device’s operating system may independently collect data over which the controller has no influence. The privacy terms of Google or Apple apply. What Apple and Google make available to the controller as the app’s developer, such as sales overviews or – depending on your device settings – crash reports, is likewise governed by their terms.

So that you can control playback via the lock screen, notification, headphones or Bluetooth, the app passes the title and cover art of the episode currently playing to the operating system. The share menu and your email app are likewise functions of the operating system or of other apps.

15. Your rights

Under the GDPR you have – subject to the respective legal requirements – the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20), as well as the right to object under Art. 21 (section 16). The app does not base any processing on consent.

To exercise these rights, simply write to support@amapps.app; no particular form is required. As the app works without an account, the controller generally cannot link the app’s requests to a person (Art. 11 GDPR). You can, however, provide additional information that makes this possible; your rights under Art. 15 to 20 GDPR then apply to that extent as well (Art. 11(2) GDPR). The controller will provide you with information about the emails you have sent to him. You can view and delete the data on your device (section 10) yourself at any time. You can also exercise your rights directly against Apple, Google, GitHub and the podcast providers.

16. Right to object under Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. The controller will then no longer process the data concerned unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

The following are based on legitimate interests:

• the requests to Apple at start-up: charts, cover art and, where applicable, the show you last opened (section 5),
• the requests to daten.amapps.app at start-up and the inclusion of name and version in the user agent (section 6.1),
• fetching the purchase page settings (section 6.2),
• the use of the hosting providers Cloudflare and GitHub (section 6.3),
• the requests to the podcasters’ servers at start-up, the preloading of excerpts and the check after loading has been interrupted (section 7),
• loading the purchase offers at start-up and, on Android, the automatic check of your purchases (section 8),
• the rating prompt (section 9.1) and handling emails to support (section 9.2),
• the counters for the purchase page and the rating prompt on your device (section 10).

You can send your objection informally by email to support@amapps.app. The controller will review every objection and let you know how it will be implemented. As the app works without an account, the controller cannot link requests to an individual device. You can, however, stop some of the processes listed yourself straight away: the app only loads the audio of excerpts while you have the excerpts area open; you can reset the counters on your device by clearing the app data. Without an internet connection, no requests are made, and downloaded episodes can still be played.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for the controller is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany

18. Obligation to provide data and automated decision-making

You are under no statutory or contractual obligation to provide any data. However, the app’s online functions cannot work without the technical connection data, in particular the IP address. You can listen to downloaded episodes even without an internet connection.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Which purchase page settings apply for your region (section 6.2) is selected by the app on your device; this has no legal or similarly significant effect on you.

19. Children

The app is not specifically directed at children. It does not ask for anyone’s age and does not process any age-related data. The controller does not knowingly collect personal data from children.

20. Changes to this privacy policy

This privacy policy may be updated if the app, the services used or the legal situation change. The current version published here applies (see “Last updated” at the top).

21. Contact

For privacy questions, you can reach the controller at support@amapps.app.