Legal Notice & Privacy Policy

Disclaimer

This is an unofficial, independent tool created for personal use. It is not affiliated with, endorsed by, or connected to the Hitster game, Jumbo (the publisher), Apple Music, YouTube Music, or any related entities. All trademarks belong to their respective owners.

Privacy Policy

We take the protection of your personal data seriously. This privacy policy informs you about how we process your personal data when you visit our website, in accordance with the General Data Protection Regulation (GDPR).

1. Data Controller

The controller responsible for data processing on this website is:

2. Your Rights

As a data subject, you have the following rights under the GDPR:

• Right of Access (Art. 15 GDPR)
• Right to Rectification (Art. 16 GDPR)
• Right to Erasure ("Right to be forgotten") (Art. 17 GDPR)
• Right to Restriction of Processing (Art. 18 GDPR)
• Right to Data Portability (Art. 20 GDPR)
• Right to Object (Art. 21 GDPR)
• Right to Lodge a Complaint with a supervisory authority (Art. 77 GDPR)

3. Data Processing for Website Delivery (Cloudflare)

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). We use Cloudflare to provide this website as a Content Delivery Network (CDN) and to ensure its security (e.g., protection from DDoS attacks).

When you access our website, Cloudflare processes data on our behalf to deliver the site securely and efficiently. This is a technically necessary process. The data processed typically includes:

• Your IP address
• Date and time of the request
• The page accessed
• Browser type and operating system
• Referrer URL (the site you came from)

Legal Basis: The legal basis for this processing is our legitimate interest (Art. 6(1)(f) GDPR) in the secure, stable, and high-performance delivery of our website.

Data Processing Agreement: We have concluded a Data Processing Addendum (DPA) with Cloudflare in accordance with Art. 28 GDPR.

Third-Country Data Transfer: Cloudflare is a US company. This data transfer is based on the EU Commission's adequacy decision for the EU-U.S. Data Privacy Framework (DPF), under which Cloudflare is certified. This ensures an adequate level of data protection (Art. 45 GDPR).

In addition to website delivery, we use two further Cloudflare services on our behalf: Cloudflare D1, a database in which broken-link reports are stored (see section 8), and Cloudflare Turnstile, a bot-protection service on our report form. The Data Processing Addendum and the EU-U.S. Data Privacy Framework certification described above apply to these services as well.

4. Cookies

This website does not use cookies for advertising or cross-site tracking. Our web analytics (PostHog, see section 9) runs in a fully cookieless mode and likewise stores no cookies or other identifiers on your device. The bot-protection service used on our broken-link report form (Cloudflare Turnstile, see sections 3 and 8) may set a cookie that is technically necessary to distinguish human visitors from automated traffic; it is used solely for security purposes and not to track you.

5. Contact via Email

If you contact us via email, we will process the data you provide (e.g., your email address, your name, the content of your message) solely for the purpose of responding to your inquiry. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in responding to your request.

6. No Advertising or Cross-Site Tracking

We do not use any advertising networks, marketing trackers, or social media plugins, and we do not track you across other websites. For privacy-friendly, cookieless usage statistics we use PostHog (see section 9). Apart from the processing described in this policy — including web analytics (section 9) and the broken-link report form (section 8) — your personal data will not be processed for any other purposes or shared with any other third parties.

7. Camera Access

Camera access is used solely for QR code scanning on your device. No images or data from the camera are sent to any server. All processing happens locally in your browser.

8. Reporting Broken Links (Report Form)

Our website offers an optional form for reporting a song link that leads to the wrong track. If you choose to submit a report, we process the following data in order to record and correct the issue:

• The report content: the Hitster edition, card number, affected music provider(s), the link the card currently leads to, and — only if you enter it — the corrected link you suggest.
• The country derived from your browser's language setting (e.g. "DE"), to identify the regional catalogue the link relates to.
• A pseudonymized (hashed) form of your IP address (SHA-256 with a secret salt; your raw IP address is not stored) and your browser's user agent, used to prevent abuse and to rate-limit spam submissions.
• The date and time of the submission.

Purpose & Legal Basis: We process this data to correct faulty song links, maintain the quality of the service, and prevent abuse of the form. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

Bot Protection: To protect the form from automated abuse, we use Cloudflare Turnstile. When you use the form, Turnstile processes technical information about your device and network (including your IP address) to distinguish human users from bots (see section 3).

Storage: Reports are stored in a Cloudflare D1 database operated on our behalf (see section 3 for details on Cloudflare and third-country transfers).

Publication: To coordinate fixes, we may publish a list of reported issues on this website. This published list contains only the report content and the country code — it does not include your IP address (hashed or otherwise) or your user agent.

Retention: We keep reports for as long as necessary to correct the affected links and to prevent recurring abuse, and delete or anonymize them thereafter. You can request deletion of a report you submitted at any time by contacting us (see "Your Rights").

9. Web Analytics (PostHog, cookieless)

To understand how our website is used and to improve it, we collect anonymous, aggregated usage statistics using PostHog, hosted in the European Union (PostHog's EU data region). PostHog is configured in a fully cookieless mode: it does not set any cookies and does not store any identifier (such as a device or user ID) on your device or in your browser's storage.

In this mode, PostHog does not build a persistent profile of you and cannot recognise you across different days or across other websites. Instead of a stored identifier, a temporary, rotating value is derived on the server from a salted hash of technical request data (such as your IP address and browser user agent). We do not store your raw IP address for analytics purposes, and we never call any user-identification function.

The data processed for analytics includes the pages you view, the referring page, and general technical information such as approximate region (derived from your IP address), device type, browser, and operating system. We also record anonymous interaction events to improve the tool — for example when a scanned card is recognised or not (including the Hitster edition, card number and the scanned card link, so we can add cards we don't yet support), which music provider is opened, and when a broken-link report is submitted. These events contain only game- and usage-related data, never anything that identifies you. It is all used solely to produce aggregate statistics and improve the service.

Legal Basis: Our legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the performance and usability of our website. Because this cookieless analytics stores no information on, and reads no information from, your device, no consent under the ePrivacy Directive / § 25 TDDDG (Germany) is required.

Processor & Data Transfer: PostHog acts as our processor under a Data Processing Agreement (Art. 28 GDPR), and analytics data is processed in PostHog's EU region.

External Links

This website contains links to Apple Music and YouTube Music. We have no influence on the content of these external pages and therefore cannot accept any liability for this third-party content.