Privacy Policy for the web version of “Podcasts AM”

Last updated: 3 November 2026

This privacy policy explains what data the web version of “Podcasts AM” (the “web version”) processes, which servers your browser connects to when you use it and what rights you have. The web version runs in your browser at podcast.amapps.app and is intended for browsers on computers. It is a limited version of the app: it sells nothing and offers no downloads and no excerpts.

This policy applies only to the web version and to the simple web pages on podcast.amapps.app that lead to it (the “landing pages”): the charts at /top/ and the pages for shows, episodes and genres at /podcasts/, /episodes/ and /genres/ (section 5.3). The apps on Android, iPhone, iPad and Mac are covered by the app’s privacy policy, and the website amapps.app by the website’s privacy policy (in German); third-party services are governed by their own terms.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), and service provider under § 5 of the German Digital Services Act (Digitale-Dienste-Gesetz – DDG), is:

Andreas Maier

Dürerstr. 14, 73547 Lorch, Germany

Email: support@amapps.app

2. No Data Protection Officer

No data protection officer has been appointed under Art. 37 GDPR, as there is no legal obligation to do so (individual developer, no large-scale processing of personal data). For privacy questions, please contact the controller named above directly.

3. Key points in brief

• There is no user account, no registration and no sign-in.
• The web version sets no cookies and shows no advertising. Apart from the counting with GoatCounter (section 9), it contains no analytics or tracking software. There are no purchases, no purchase page, no rating prompt, no downloads and no excerpts.
• To measure reach, the web version and the landing pages count visits and a few events with GoatCounter, without cookies (section 9). No search terms, shows, episodes or other content are included.
• The web version stores your subscribed shows, playback positions, bookmarks, last opened and last played items, and settings only in your browser (section 10). It does not transmit this data as a whole, not even to the controller. Individual items from it do, however, become visible in the requests a function needs: for example the selected country or – because the page loads cover art when it is opened – which shows you have subscribed to and which show you last listened to (sections 6 to 8).
• To find and play podcasts, your browser fetches content directly from the internet: from Apple (search, show details, cover art, including the cover art in the charts), from the podcasters’ servers (feeds, audio, images) and from two addresses of the controller, which are hosted by external providers: podcast.amapps.app (the site itself) and daten.amapps.app (charts and additional content).
• For technical reasons, each server contacted inevitably learns your IP address, the time, the requested address and your browser’s identifier. It can also tell that the request comes from podcast.amapps.app (section 4).
• The landing pages are covered by section 5.3: when you open one, your browser loads only the page itself and cover art from Apple and reports the page view to GoatCounter; it loads audio only when you click play. The landing pages do not set cookies either.
• The controller does not analyse individual requests and does not try to link them to a person. Of GoatCounter’s counting he sees only aggregated figures, for example by country and referring page (section 9). Through the web version and the landing pages, personal data reaches the controller only if you email him (section 11.1). On his behalf, Cloudflare processes the connection data of requests to daten.amapps.app (section 5.2), and GoatCounter processes the data of the counting (section 9).
• The controller does not sell any data and does not share any data for advertising or tracking purposes.
• Where processing is based on legitimate interests, you can object to it at any time (section 16).

4. Connections to the internet – overview

When you use the web version and the landing pages (section 5.3), your browser connects only to the parties listed below. The web version fetches content from them; it does not send forms or files from your device. In addition, it reports visits and a few events to GoatCounter (section 9). Only when you click do amapps.app, where applicable a webmail service (section 11) and, from a landing page, possibly the Apple Podcasts website (section 5.3) come in. What a server learns comes from the request itself – and that includes which content you fetch:

• Your IP address. No internet connection is possible without it. It can be used to infer roughly which country or region a request comes from.
• The time of the request.
• The requested address. It may contain information such as the selected country, your search term or the identifier of a show or episode (details in the following sections).
• The information your browser sends with every request, above all its identifier (“user agent”) with the browser’s name and version and the operating system, as well as your preferred languages. The web version does not add an identifier of its own. However, the “Origin” header or the referring address (“Referer”) that your browser sends shows that the request comes from https://podcast.amapps.app.

The web version does not send any account information, device or advertising identifier, or crash reports. It sets no cookies; during playback and when loading some images, however, your browser may send cookies that the podcasters’ servers or their service providers have set themselves (section 8).

Security and encryption

The web version fetches the site itself, daten.amapps.app, Apple’s APIs and image servers and GoatCounter over encrypted connections (HTTPS). It always requests feeds over HTTPS, even if the podcaster specifies an unencrypted “http” address. Your browser loads audio and images from the addresses that the podcasters publish. Whether it loads an “http” address unencrypted, switches it to HTTPS or blocks it is decided by your browser. If it loads unencrypted, third parties on the same network (for example on public Wi-Fi) or your internet provider can see which file is being fetched.

Because the web version and the landing pages work without an account and, apart from the counting with GoatCounter, send no usage data to the controller, the controller – apart from support emails, GoatCounter’s aggregated figures (section 9) and the connection data that Cloudflare processes on the controller’s behalf (section 5.2) – holds no collection of data on the users of the web version or the landing pages that could be lost or stolen.

5. The site podcast.amapps.app and the hosting providers

5.1 The site

When you open podcast.amapps.app, your browser loads the web version: the program code, the graphics engine (CanvasKit), the components for the database in your browser (section 10), icons and the fonts (Roboto, plus Noto fonts for further characters, for example for Chinese, Japanese, Arabic or emoji). The site delivers all of these files itself. It does not load fonts or program components from Google or other providers. The connection data described in section 4 and the requested file are transmitted in the process. In addition, every time it is opened, the site requests its version file (version.json) several times, usually four times, and appends your device’s clock time, so that your browser does not use an outdated copy from its cache. The controller does not run his own server for this; the files are hosted by hosting providers (section 5.2).

5.2 Hosting providers

• GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (part of Microsoft Corporation) – GitHub Pages, separate controller for the access data. GitHub stores the files of podcast.amapps.app and daten.amapps.app and delivers them. Apart from what the delivery of the files involves, the controller passes no data to GitHub. According to GitHub’s documentation on GitHub Pages, GitHub logs the IP address for security purposes when GitHub Pages sites are accessed. GitHub processes this access data under its own responsibility; the controller does not receive it. For delivery, GitHub in turn uses service providers, including Fastly (USA). GitHub’s Privacy Statement applies.
• Cloudflare, Inc. (USA) – processor. Cloudflare receives all requests to daten.amapps.app, provides the encrypted connection and forwards the requests to GitHub Pages. Before forwarding them, Cloudflare removes the headers that may contain your IP address (the “Remove visitor IP headers” setting); according to Cloudflare, GitHub therefore sees only Cloudflare’s address there, not yours. Cloudflare processes the connection data on behalf of the controller; the data processing agreement (Art. 28 GDPR) is part of Cloudflare’s terms. Cloudflare automatically compiles aggregated statistics from the connection data, such as the number of requests. The controller analyses neither individual requests nor the countries they come from, and does not use the connection data to determine anyone’s location. Cloudflare’s Privacy Policy applies.
• For podcast.amapps.app, your browser contacts GitHub directly, so GitHub receives your IP address there. For this address, Cloudflare only handles name resolution (DNS) and does not receive the requests to the site.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in providing the web version, the landing pages (section 5.3) and their files reliably, securely and at low cost without the controller having to run his own server.
• Third country: Cloudflare and GitHub are certified under the EU-U.S. Data Privacy Framework. The transfer is therefore based on the European Commission’s adequacy decision (Art. 45 GDPR).
• Retention: According to Cloudflare, it keeps the connection data on behalf of the controller only for as long as necessary for its services, i.e. for delivery, security and the aggregated statistics; Cloudflare does not publicly state a fixed period. GitHub keeps its access logs according to its own rules; GitHub does not publicly state a fixed period either.

5.3 The landing pages

podcast.amapps.app also hosts the landing pages: simple web pages in English through which people can find the web version, for example via a search engine, namely the charts at /top/ and pages for individual shows, episodes and genres at /podcasts/, /episodes/ and /genres/. They do not load the web version itself; they consist only of the page, a style sheet, a small script and an icon, which GitHub delivers as described in section 5.2.

• When you open one: Your browser loads the landing page from podcast.amapps.app and the cover art of the shows and episodes shown from Apple’s image servers (section 6). It usually loads cover art further down the page only once you scroll near it. Apart from this cover art and the counting (see below), the landing pages load nothing from third parties when opened, including no fonts or scripts, and they fetch nothing from daten.amapps.app. GitHub learns from the requested address which landing page you open, and Apple learns from the cover art fetched which shows and episodes are displayed on it.
• Referring address: Every landing page instructs your browser to send only https://podcast.amapps.app/ as the referring address (“Referer”), never the page’s path, and none at all when switching from HTTPS to unencrypted HTTP. Apple, the podcasters’ servers, GoatCounter and linked sites therefore cannot tell from it which landing page you opened.
• Counting: The landing page’s script reports the visit to GoatCounter once per page load as soon as the page is shown, so for a tab opened in the background only when you switch to it. It transmits the type of page (charts, show, episode or genre), the width of your screen and, only if you come from another website, that site’s address as far as your browser provides it. The name of the show or episode is not included. If you click play, the script additionally reports, once per page load, that something was played, without any name and without information about the page. Otherwise section 9 applies, including the exceptions and switching off the counting (section 16); without JavaScript, the landing pages do not count.
• Playback: A landing page requests audio only when you click play. Your browser then loads the episode directly from the podcaster’s server, where applicable via its service providers, as described in section 8. It also loads from Apple the cover art shown by the player and your browser’s media controls (section 14), unless it has already loaded it; Apple then learns which show the item played belongs to.
• “Open in Podcasts AM”: If you click “Open in Podcasts AM”, “Open episode in Podcasts AM” or, after playing, “Follow free in the web app”, the landing page stores the entries for the last opened and last played items (section 10) in your browser’s local storage for podcast.amapps.app, overwriting the corresponding previous entries. It stores the show (name, creator, ID number, cover art address and address at Apple), the country and whether the player should be open, for an episode also its title, duration, publication date and the addresses of the audio, image and feed. These entries are not transmitted in the process. The web version then opens and shows the show or episode; from then on, what this policy says about the web version applies. Other links to the web version store nothing.
• No cookies: The landing pages set no cookies. When you open them, they write nothing to your browser’s storage; from it, they only read the “skipgc” entry, with which you can switch off the counting (section 16).
• Links: The landing pages link to the web version, to the page amapps.app/podcast-am/get (App Store, Google Play), to this privacy policy and to the legal notice on amapps.app, and occasionally to Apple Podcasts. Your browser opens these pages only when you click (section 11.3); Apple Podcasts is governed by Apple’s Privacy Policy.
• Purpose: making the web version and individual shows, episodes and genres findable and presenting them, listening directly on the page and opening in the web version.
• Legal basis: For the delivery of the landing pages, section 5.2 applies, and for the counting, section 9. For the cover art your browser loads from Apple when you open a landing page, Art. 6(1)(f) GDPR; the legitimate interest lies in showing the shows and episodes on the page with their images straight away. For playback and opening in the web version, which you trigger yourself, Art. 6(1)(b) GDPR.
• Recipients, third country and retention: as in sections 5.2 (GitHub), 6 (Apple), 8 (podcasters’ servers) and 9 (GoatCounter); for the entries in your browser, section 10 applies.

6. Podcast directory, search and cover art (Apple)

The web version uses Apple’s public podcast directory. To do so, your browser queries Apple’s interface itunes.apple.com for search and show details and loads cover art from Apple’s image servers (is1-ssl.mzstatic.com to is5-ssl.mzstatic.com). The web version never contacts Apple’s charts interface (rss.marketingtools.apple.com).

• Charts: The web version does not load the charts for the selected country from Apple, but from an unchanged copy of Apple’s charts on daten.amapps.app that is renewed regularly, usually daily (section 7), because browsers are not allowed to read Apple’s charts directly. The copy contains Apple’s image addresses unchanged; your browser therefore still loads the cover art in the charts from Apple’s image servers.
• Cover art: Your browser loads the cover art in charts, search, show pages and your library from Apple’s image servers. Every time you open the page, it loads the cover art of the charts and of your subscribed shows, even if another area is currently shown. If you have not subscribed to the show you last listened to, it also loads that show’s cover art for the library. Apple can therefore tell, every time you open the page, which shows you have subscribed to and which show you last listened to. If a show’s feed names no image of its own at all, the image in the large player and in the media controls (section 14) also comes from Apple, including when the web version reopens the player as you open the page; Apple then learns which show is in the player.
• Search: When you search, your search term is transmitted to Apple together with the selected country as soon as you pause briefly while typing (after about 0.4 seconds), so possibly also an unfinished word, or when you repeat the search. It is used only to show you matching shows from Apple’s directory. The controller does not receive your search terms, and the web version does not store them.
• Show details: When you open a show, the web version queries Apple with the show’s ID number and the selected country to obtain the address of the podcast feed. This also applies when, on opening the page, it restores the show page you left open last time.
• Country: Unless you choose a country yourself, the web version picks one based on your browser’s language settings or, failing that, the USA. China is not offered in the web version. It stores your choice in your browser.

The web version does not store Apple’s responses as such. The web version permanently stores details of shows (name, creator, ID number, address at Apple, cover art address) that you have subscribed to, last opened or last listened to, and, with the episode you last listened to, also the address of the podcast feed (section 10).

• Recipient: Apple as a separate controller. According to Apple’s privacy policy, Apple Distribution International Ltd. (Ireland) is the controller for users in the European Economic Area; the data is usually stored by Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Apple’s Privacy Policy applies.
• Purpose: displaying search results, show details and cover art, including the cover art in the charts.
• Legal basis: Art. 6(1)(b) GDPR where you trigger the function yourself (search, opening a show, playing an episode or opening it in the large player, changing the country, refreshing the charts). For the requests when the page is opened (cover art of the charts, of your subscribed shows and of the show you last listened to, where applicable the show you last opened and, if the feed names no image of its own, the cover art in the reopened player), Art. 6(1)(f) GDPR; the legitimate interest lies in being able to show you the charts, your library and the point where you left off as soon as you open the page.
• Third country: For users in the European Economic Area, the recipient is Apple Distribution International Ltd. in Ireland. Where Apple passes the data on to Apple Inc. in the USA, Apple states that it relies on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).
• Retention: according to Apple’s rules; the controller has no influence over this.

7. Charts and additional content from daten.amapps.app

At daten.amapps.app, the controller provides additional content for selected shows: short summaries, key points, chapters (where applicable with an “Excerpt” marker within the episode) and show notes. For the web version, the copy of Apple’s charts, renewed regularly and usually daily, is also kept there (section 6). No audio files are stored there.

• When: Every time you open the page, the web version requests the charts for the selected country and the list of covered shows. It also requests the charts when you change the country, when you refresh and on “Try again”, plus a second time if the first response is empty or fails. It requests the list of covered shows again only once the copy held in memory is older than one hour or could not be loaded last time. When you open a covered show, it loads the show’s index and, where applicable, files for individual episodes; for indexes without short texts for the episodes, also as you scroll the episode list, which shows how far you have scrolled. It also loads the index and the episode file when you open an episode in the large player and, if the podcaster provides no chapters, when you play an episode. This also applies when, on opening the page, the web version restores the show you last opened or the player. As a rule, the web version requests nothing there for shows that are not covered. Only if the list of covered shows cannot be read at that moment, although the server is responding, does it send a request when you open a show or episode or play an episode, using an identifier derived from the address of the podcast feed; this identifier, too, allows the show to be determined.
• What is transmitted: IP address, time, the requested file and the information your browser sends (section 4). The web version adds no identifier of its own and appends no parameters. Because the address of the charts contains the country and the file names contain an identifier of the show or episode, the requests do, however, reveal which country you have selected and which covered shows and episodes you open or play.
• In the browser: The web version keeps the responses as such only in memory and never beyond closing or reloading the page. For shows from the charts that you have subscribed to, last opened or last listened to, it permanently stores the details listed in section 6 (section 10). It reuses additional content for at most one hour, and the charts until you refresh them or change the country.
• Purpose: displaying the charts and providing the additional content.
• Legal basis: Art. 6(1)(b) GDPR where you trigger the function yourself (opening a show or episode, playing an episode, scrolling the episode list, changing the country, refreshing the charts). For the requests when the page is opened, Art. 6(1)(f) GDPR; the legitimate interest lies in showing you the charts and the additional content without delay as soon as you open the page.
• Hosting: Cloudflare and GitHub, as described in section 5.2.

8. Podcasters’ servers: feeds, images and playback

The podcasts themselves do not come from the controller. Your browser loads feeds, audio files, chapters and images directly from the servers that the podcasters specify in their feeds. The controller does not provide any of these files himself and receives nothing from these connections.

• Feed: when you open a show, including when, on opening the page, the web version restores the show you last opened. Some servers do not allow browsers to read their feed. The request still reaches the server; the web version then shows a notice that the show can only be opened in the app.
• Chapters and images: Your browser loads images of episodes and chapters, and where applicable the podcaster’s own chapter files, directly from the respective server; it loads chapter files when an episode is loaded. If an episode has no image of its own, the web version uses the show’s image from the feed. Your browser loads the image of the episode you last listened to, so often the show’s image, as soon as you open the page, for the bar at the bottom. While the large player is open, it loads chapter images each time playback reaches a chapter with its own image; this reveals roughly how far you have listened. The image servers can tell which images are being fetched from your IP address.
• Playback: Your browser plays episodes with its own audio player directly from the podcaster’s server. It requests the file in parts (range requests): when you resume an episode or skip within it, it requests the file from that point. The podcaster’s server and every intermediate service (see below) can therefore tell roughly where you resume and where you skip to. The web version does not create a cache of its own for this. Episodes cannot be downloaded in the web version.
• Cookies of these servers: The web version sets no cookies. However, it loads the audio without a “crossorigin” attribute. Your browser therefore sends, as far as it allows third-party cookies, cookies that the podcaster’s server or an intermediate service has set itself. The same can happen with images that your browser loads as an ordinary image element as a fallback, because the image server does not allow the site to read them directly.
• Podcasters’ service providers: Many podcasters route the addresses of their episodes through audience measurement or redirect services (for example Podtrac) and have their files delivered by hosting services (for example Libsyn, Megaphone or Podigee). These services then also receive the request. Which services are involved is decided by the podcaster, not by the controller.

• Recipients: the operators of the podcast servers and their service providers as separate controllers. They are located worldwide; their own privacy terms apply, over which the controller has no influence.
• Purpose: displaying and playing the content you choose.
• Legal basis: Art. 6(1)(b) GDPR (the function you requested). For the requests when the page is opened (where applicable the feed of the show you last opened, the image of the episode you last listened to), Art. 6(1)(f) GDPR; the legitimate interest lies in showing you straight away the point where you left off.
• Third country: The servers may also be located outside the EU, including in countries without an adequacy decision. Your browser fetches the content from them directly, just as when you visit a website; the servers receive only the information contained in the request itself (section 4), including the range information and, where applicable, their own cookies (see above). The controller does not pass any further data on to them; in the controller’s view, this therefore does not constitute a transfer by the controller to a third country. You choose the content yourself. The controller has no contracts with the podcasters or their service providers.
• Retention: according to the rules of the respective providers.

9. Analytics with GoatCounter

Reach is measured with GoatCounter – without cookies and without cross-device recognition. The web version and the landing pages (section 5.3) do not load a script from GoatCounter for this; they report each count themselves with a single request to podcastam.goatcounter.com. The following are counted:

• the visit: once per page load, as soon as the page is actually shown;
• in the web version, at most four events, each at most once per page load: that a search was made, that a show was subscribed to, that something was played and that a show can only be opened in the app because its server blocks browsers (“feed blocked”);
• on the landing pages (section 5.3), instead of these events only one, at most once per page load: that something was played.

The web version and the landing pages do not count while the page is only being pre-rendered, when it runs inside another site’s frame, when the browser is controlled by a program or when you have switched off counting (section 16).

Each count from the web version carries the language in which it is displayed; it follows from your browser’s language settings. On the landing pages, which exist only in English, the visit carries the type of page instead, and the “played” event carries no information about the page. No search terms, names of shows or episodes or other content are included. Also recorded are the referring page (only with the visit and only if your browser provides it; on the landing pages, also only if you come from another website), browser and operating system, the approximate screen size (for this, the web version and the landing pages transmit the width of your screen) and the country derived from the IP address, plus the region for requests from the USA, Russia and China. GoatCounter derives browser and operating system from the browser identification. GoatCounter does not evaluate the list of preferred languages your browser sends. The IP address and the full browser identification are not stored; they are held in memory for at most eight hours so that repeated page loads within one visit are not counted twice. GoatCounter does not store individual page views for this site; evaluation happens in aggregate form. As neither the IP address nor the full browser identification is retained, attribution to individual people is not provided for. The figures are not public; only the controller has access to the GoatCounter account and views them after signing in. The data is held on servers of Hetzner Online GmbH (Gunzenhausen, Germany) in Finland and Germany, which GoatCounter uses as a service provider for this; GoatCounter names no other recipients.

• Recipient: GoatCounter.com, operated by Martin Tournoij, Ireland, as a processor. GoatCounter’s privacy policy applies.
• Purpose: finding out whether and how the web version and the landing pages are used. The web version is a market test of whether an offering in the browser is worthwhile.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in a data-minimising analysis of usage. You can object to the counting at any time and also switch it off yourself (section 16).
• Third country: no transfer to a third country. GoatCounter is operated from Ireland, and the data is held in Finland and Germany.
• Retention: GoatCounter keeps the aggregated figures without a fixed period; no automatic deletion is set. If the account is deleted, GoatCounter states that data may remain in backups for up to 30 days. What is held in memory to recognise a visit is kept for at most eight hours.

10. Storage in your browser

The web version stores the following data only in your browser: in a database in the storage your browser provides to the site (IndexedDB or, where available, the “Origin Private File System”) and in the browser’s local storage (“localStorage”). It sets no cookies and does not install a service worker. The web version does not transmit this data as a whole either to the controller or to third parties, and the controller has no access to it. Individual items from it do, however, feed into the requests described in sections 6 to 8: above all the selected country. In addition, the requests for cover art when the page is opened reveal which shows you have subscribed to and which show you last listened to. The stored data does not include an account, your name, your email address or a device identifier.

The web version keeps all other responses from Apple and daten.amapps.app and the images only in memory; they are discarded at the latest when you close or reload the page. As with any website, your browser also keeps files of the site and fetched content in its own cache; this is handled by your browser.

Deletion: You can delete subscribed shows (by unsubscribing from the show) and bookmarks individually in the web version. You can remove all data by clearing the site data for podcast.amapps.app in your browser (depending on the browser, for example under “Cookies and site data”). In a private window, your browser deletes the data when you close the window. If your browser does not allow storage, the web version keeps everything only in memory and says so at the top of the page; everything is then gone when you reload or leave the page.

Legal basis: Art. 6(1)(b) GDPR for the data resulting from your use (subscribed shows, positions, bookmarks, last opened and last played items, settings).

Storing and reading information in your browser (§ 25 TDDDG): The web version stores the information listed above in your browser, reads it back and reads your browser’s language settings (for the display language and the country, section 6). The landing pages store the entries for the last opened and last played items (overwriting the previous ones) when you click one of their three links to the web version named in section 5.3. In both cases, this is done in order to provide the functions you use (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

11. Other functions

11.1 Email to support

Via “Email support” in the menu and via “Why? Tell us” in the “Player page” setting, the web version opens a draft email to support@amapps.app in your email program. It is pre-filled with a subject line, the version and build number, and the note “Web” together with the operating system your browser reports; for “Why? Tell us”, also with the player page layout you have selected. You can edit or discard the draft before sending it. The web version itself sends nothing. Only when you send the email does the controller receive your email address, where applicable the name stored in your email program, the content and this information. If you have registered a webmail service for email links in your browser, the draft opens there instead. That service then receives the subject and the pre-filled information as soon as you click, before you send anything; its own terms apply.

• Purpose: handling and answering your enquiry, troubleshooting.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in answering your enquiry and fixing errors in the web version.
• Recipients: Emails to support@amapps.app are received by Cloudflare, Inc. (USA) as a processor and forwarded, without the message itself being stored, to the controller’s mailbox at GMX (1&1 Mail & Media GmbH, Brauerstr. 48, 76135 Karlsruhe, Germany); GMX stores them there under its privacy policy. The sender, recipient, subject, time, technical message ID, delivery status and the results of the sender checks (SPF, DKIM, DMARC) are logged in the controller’s Cloudflare account. Your own email provider also processes the email, under its own terms. The controller sends replies via Apple’s iCloud+ (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Apple Inc., USA) from an amapps.app address. Apple processes the reply, including your email address and any parts of your message quoted in it, under its Privacy Policy.
• Third country: Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). For Apple, the recipient is Apple Distribution International Ltd. in Ireland; for transfers to the USA, Apple states that it uses Standard Contractual Clauses (Art. 46 GDPR).
• Retention: for as long as necessary to handle your enquiry; the email and the replies to it, including the copies at GMX and iCloud, are then deleted unless statutory retention obligations apply. According to Cloudflare, it keeps the log in the Cloudflare account for 31 days.

11.2 Sharing the site

“Share the app” in the menu opens the share menu of your browser or operating system with a short text and the link https://podcast.amapps.app/. If your browser has no share menu, your email program opens with this text instead; if a webmail service is registered, that service receives the text as soon as you click (section 11.1). You decide where to send it; the web version itself transmits nothing in the process. The text contains no information about shows, episodes or your usage.

11.3 External links

When you click the relevant link, the web version opens this privacy policy and the legal notice on amapps.app in your browser. For shows that can only be opened in the app, “Get the app” opens the page amapps.app/podcast-am/get, which takes you to the App Store or Google Play. The web version itself transmits nothing in the process. The website amapps.app is covered by the website’s privacy policy (in German); the App Store and Google Play are governed by the terms of Apple and Google respectively.

12. Recipients and transfers to third countries

The controller does not sell any data and does not share any data with third parties for advertising or tracking purposes. Only the following parties receive data, and only to the extent described.

Processors (acting on behalf of and on the instructions of the controller)

• Cloudflare, Inc. (USA) – provision of daten.amapps.app (section 5.2) and forwarding of emails to support@amapps.app (section 11.1). Third country: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• GoatCounter.com (Martin Tournoij, Ireland) – analytics (section 9). Third country: none; operator and servers are in the EU.

Separate controllers (acting under their own privacy terms)

• Apple (Apple Distribution International Ltd., Ireland; Apple Inc., USA) – directory, search and cover art, including the cover art in the charts (section 6) and the cover art on the landing pages (section 5.3), and sending replies to your emails via iCloud+ (section 11.1). Third country: the recipient in the European Economic Area is Apple Distribution International Ltd. (Ireland); for passing data on to Apple Inc. (USA), Apple states that it uses Standard Contractual Clauses (Art. 46 GDPR).
• GitHub, Inc. (USA) – hosting service on which the files of podcast.amapps.app and daten.amapps.app are stored, including the landing pages (GitHub Pages, sections 5.2 and 5.3). Apart from what the delivery of the files involves, the controller passes no data to GitHub. Only the access data generated when the files are fetched – for daten.amapps.app Cloudflare removes the IP address beforehand, for podcast.amapps.app GitHub receives it directly (section 5.2) – is processed by GitHub as a separate controller, for the security of its services; the controller does not receive it. For delivery, GitHub uses service providers such as Fastly (USA). Third country: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• Operators of the podcast servers and their service providers (worldwide) – feeds, audio, chapters and images (section 8). Third country: this includes countries without an adequacy decision; the servers receive only the information contained in the request that your browser sends directly to them (section 8).

Your emails to support (section 11.1) are forwarded by Cloudflare to the controller’s mailbox at GMX (1&1 Mail & Media GmbH, Karlsruhe, Germany), where they are stored. Replies are sent by the controller via Apple’s iCloud+ (Apple Distribution International Ltd., Ireland; Apple Inc., USA).

13. Retention

• In your browser: as described in section 10, until you delete the data.
• With the controller: The web version and the landing pages send the controller no data about your usage, apart from the counting with GoatCounter, which he sees only in aggregate. Support emails and the replies to them are kept for as long as necessary to handle them and are then deleted, including the copies at GMX and iCloud, unless statutory retention obligations apply.
• With GoatCounter: the aggregated figures without a fixed period, and for up to 30 days in backups after the account is deleted; what is held in memory to recognise a visit, for at most eight hours (section 9).
• With Cloudflare (on behalf of the controller): According to Cloudflare, it keeps the connection data only for as long as necessary for delivery, security and the aggregated statistics (section 5.2); Cloudflare does not publicly state a fixed period. According to Cloudflare, it keeps the log of forwarded emails (section 11.1) for 31 days.
• With GitHub: according to GitHub’s rules as a separate controller; GitHub does not publicly state a fixed period.
• With Apple and the podcast servers: according to the rules of the respective providers, over which the controller has no influence.

14. Browser and operating system

The web version runs in your browser. The makers of your browser and operating system may independently collect data over which the controller has no influence; their terms apply.

So that you can control playback via the media keys or the media controls of your browser or operating system, the web version passes the title, show, creator and cover art of the episode currently playing to your browser, and a landing page (section 5.3) passes the title, show and cover art. The share menu and your email program are likewise functions of your browser, your operating system or other programs.

15. Your rights

Under the GDPR you have – subject to the respective legal requirements – the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20), as well as the right to object under Art. 21 (section 16). The web version does not base any processing on consent.

To exercise these rights, simply write to support@amapps.app; no particular form is required. As the web version works without an account, the controller generally cannot link requests or counts to a person (Art. 11 GDPR). You can, however, provide additional information that makes this possible; your rights under Art. 15 to 20 GDPR then apply to that extent as well (Art. 11(2) GDPR). The controller will provide you with information about the emails you have sent to him. You can view and delete the data in your browser (section 10) yourself at any time. You can also exercise your rights directly against Apple, GitHub and the podcast providers.

16. Right to object under Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. The controller will then no longer process the data concerned unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

The following are based on legitimate interests:

• the use of the hosting providers GitHub and Cloudflare (section 5.2), including the delivery of the landing pages by GitHub (section 5.3),
• the cover art your browser loads from Apple when you open a landing page (section 5.3),
• the requests to Apple when the page is opened: cover art of the charts, of your subscribed shows and of the show you last listened to, where applicable the show you last opened and, if the feed names no image of its own, the cover art in the reopened player (section 6),
• the requests to daten.amapps.app when the page is opened, including the charts (section 7),
• the requests to the podcasters’ servers when the page is opened (section 8),
• the analytics with GoatCounter (section 9), including on the landing pages,
• handling emails to support (section 11.1).

You can send your objection informally by email to support@amapps.app. The controller will review every objection and let you know how it will be implemented. As the web version works without an account, the controller cannot link requests or counts to an individual browser. You can, however, switch off the counting yourself straight away: in your browser, create the entry “skipgc” with the value “t” in the local storage for podcast.amapps.app (in the browser’s developer tools with localStorage.setItem('skipgc', 't')), as on sites that use GoatCounter’s counting script. The web version and the landing pages then no longer count until you clear the site data.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for the controller is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany

18. Obligation to provide data and automated decision-making

You are under no statutory or contractual obligation to provide any data. However, the web version cannot work without the technical connection data, in particular the IP address.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

19. Children

The web version is not specifically directed at children. It does not ask for anyone’s age and does not process any age-related data. The controller does not knowingly collect personal data from children.

20. Changes to this privacy policy

This privacy policy may be updated if the web version, the services used or the legal situation change. The current version published here applies (see “Last updated” at the top).

21. Contact

For privacy questions, you can reach the controller at support@amapps.app.