beatVale

Privacy Policy

In short: The beatVale app collects no personal data. Your music, your playlists and your settings stay on your iPhone. The website sets no cookies for visitors and uses no tracking.

Last updated: 21 October 2026

1 Controller

Gruppe5 - Gesellschaft für Unternehmenskommunikation mbH
Andersenstraße 9, 42719 Solingen, Germany
Phone: +49 212 23050-0
Email:

2 The beatVale app

2.1 Everything stays on your iPhone

beatVale works without an account and without servers of its own. The app sends no data to us. On your iPhone it stores:

  • the folders you link and an index of your music files with title, artist, album and cover taken from the files,
  • your playlists, favorites and recently played songs,
  • your sound settings and sound profiles, including the identifier of Bluetooth devices you assign to a profile,
  • other settings such as appearance, wallpaper and app icon.

This data does not leave your iPhone. The one exception: if you allow Siri for beatVale, Apple’s Siri receives the names of your playlists and artists (section 2.5). The data is part of your device backup (iCloud Backup or a backup on your computer) if you have turned that on. Deleting the app deletes it, along with the songs you copied into the app. Your originals and your files in iCloud Drive stay where they are.

2.2 Access to your music files

beatVale reads only the folders and files you choose yourself: on your iPhone, in iCloud Drive, on a USB drive or on a server in your network. If you copy songs into the app, the copies are kept in its folder on your iPhone. The app does not change or send your originals.

2.3 Music app library

If you allow beatVale to access your library, the app reads the songs of the Music app that are on your iPhone and not copy-protected, with title, artist, album and cover. It plays these songs or, if you want, copies them into its folder on your iPhone. The app changes nothing in your library, and none of it is sent to us. You can withdraw access at any time in your iPhone’s settings under Privacy & Security › Media & Apple Music.

2.4 iCloud Drive

If you link a folder from iCloud Drive, the files are kept in your iCloud account with Apple. If you turn on the “beatVale” folder under iCloud Drive in the app’s settings, the app creates this folder in your iCloud Drive. Whatever you put there, Apple stores like any other file in your iCloud Drive. Songs that are not on your iPhone yet are downloaded from iCloud when you play them. We have no access to your iCloud account. Apple’s privacy policy applies to iCloud: www.apple.com/legal/privacy

2.5 Siri

If you allow Siri for beatVale, you can start your music by voice, in the car too. Apple processes your requests to Siri. The app receives only the result, such as the name of a song, album or playlist, and plays the music on your iPhone. So that Siri understands you, the app gives Siri the names of your playlists and artists and the number of your songs. Apple’s privacy policy applies to Siri. You can change whether Siri may use beatVale at any time in your iPhone’s settings.

2.6 Purchase and trial

beatVale is offered through Apple’s App Store. Apple handles purchase and payment as a controller in its own right. We receive no payment details and no names, only aggregated sales figures. The app checks on your iPhone, through Apple’s purchase interface (StoreKit), whether the trial is running or the app has been bought.

2.7 Crash reports and statistics from Apple

If you have allowed sharing with app developers in your iPhone’s settings under Privacy & Security › Analytics & Improvements, Apple gives us crash reports and aggregated usage figures that do not identify you. We use them only to fix bugs. You can turn this sharing off there at any time.

2.8 CarPlay

In CarPlay, beatVale shows songs, covers and controls on your car’s screen. iOS handles the connection between iPhone and car; nothing is sent to us.

2.9 No advertising, no tracking

beatVale contains no advertising, no analytics or tracking tools and no third-party libraries that send data.

3 The website beatvale.com

3.1 Server and logs

The website runs on our own server in a data centre in Germany, which we operate ourselves; the data centre operator has no access to the data. For every request the server temporarily stores: IP address, date and time, the page or file requested, the amount of data sent, the status code, the previously visited page (referrer), and browser and operating system. This is needed to deliver the site and fend off attacks (legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure operation). The logs are deleted after 7 days. The same applies to the logs of our mail server (sender, recipient, time, delivery status); they are deleted after 30 days.

3.2 No cookies, no tracking, no third-party content

The website sets no cookies and uses no analytics or tracking services. Fonts and images are on our own server; visiting the site sends no data to other providers. The exception are the pages with a form: they load a service that protects against misuse (see 3.6).

Only the operator uses the admin area of the beta test. After signing in, the site sets a session cookie there that is strictly necessary for the sign-in (§ 25(2) no. 2 TDDDG) and expires when the browser is closed. Visitors get no cookie.

If you click the App Store badge, you go to Apple. Only then does Apple receive data from your browser; Apple’s privacy policy applies.

3.4 Contact by email and contact form

If you email us or use the contact form on the support page, we use your details only to answer your request. With the form, these are your email address, the topic and your message and, if you provide them, your name and details of your device and versions. The form stores nothing on the web server; it sends your details as an email to our support mailbox. Before sending, you confirm with a checkbox that you have read this policy. The legal basis is Art. 6(1)(b) GDPR, for general enquiries Art. 6(1)(f). We use service providers as processors to run our mailboxes. We delete the message once it has been dealt with, unless a legal retention duty requires longer storage (up to 6 years for business letters, § 257 HGB, § 147 AO).

3.5 Beta test: sign-up and questionnaire

You can sign up for the public beta test on this website.

  • Data: first name, email address, iPhone model, iOS version and whether you use CarPlay. Optionally also: the car brand, the size of your music collection and your file formats. We also store the time of sign-up and confirmation.
  • Purpose: selecting the testers, inviting them, reminding them of the questionnaire, evaluating the test and – for testers who filled in the questionnaire – sending a code that unlocks the app for free on the App Store.
  • Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by email to ; we then delete your details.
  • Required or voluntary: signing up is voluntary. Without first name, email address and the details on iPhone and CarPlay we cannot select you, though. All other details are optional.
  • TestFlight: we do not pass your data to Apple. If you are selected, we send you a link to Apple’s TestFlight app. What Apple processes when you join the test through this link is governed by Apple’s privacy policy. If you send feedback or crash reports in TestFlight, we receive them from Apple; they may contain your Apple ID email address and details of your device. We use them only to fix bugs and delete them with the other test data.
  • Questionnaire: selected testers get a personal link with a random code. We store your answers with that code, not with your email address. As long as the sign-up data is kept, we can link the code to your sign-up (pseudonymous); this link ends when that data is deleted. Please do not write anything in free-text fields that identifies you or others.
  • Storage: on our own server in Germany (see 3.1).
  • Deletion: unconfirmed sign-ups after 7 days; details of people not selected after the selection; all sign-up data and email addresses four weeks after the test ends. Exception: if the app is not yet on the App Store when the test ends, we keep first name and email address of testers who filled in the questionnaire until the thank-you code has been sent, at most three months after the test ends, and delete them right after. After that, questionnaire answers can no longer be linked to anyone. Deleted details may remain in server backups until the backup is overwritten in its regular cycle, at most 30 days.

3.6 Protecting the forms

The pages with a form (the contact form on the support page of beatvale.com, the sign-up and the questionnaire on beta.beatvale.com) include the Turnstile service of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). It checks whether a human is using the form and is loaded when you open these pages; no other page includes it. For this, Cloudflare processes your IP address and technical characteristics of your browser, sets no cookies and does not use the data for advertising. Processing may also take place in the USA; Cloudflare is certified under the EU-US Data Privacy Framework. The check is necessary to protect the forms against misuse (§ 25(2) no. 2 TDDDG); the legal basis is our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR).

4 Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to .

Withdrawal: if you have given consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). Processing before the withdrawal remains lawful.

Objection: you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21 GDPR), for example the server logs. Write to .

Complaint: you can complain to a data protection supervisory authority (Art. 77 GDPR). Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

5 Security

The website is served over encrypted connections (HTTPS) only.

6 No automated decisions

We make no decisions based solely on automated processing and create no profiles.

7 Changes

If the app, the website or the law changes, we update this policy. The version dated at the top of this page applies.