Privacy & Cookies
Last updated: 30 August 2026
1. Controller
The controller responsible for the processing of personal data in connection with AudioCommunity is:
Jojo Flemming
c/o IP-Management #11620
Ludwig-Erhard-Str. 18
DE 20459 Hamburg
Email: 
2. General principles
AudioCommunity is advertising-free. It does not use advertising trackers, third-party analytics, fingerprinting, external advertising networks or automatically loaded social-media embeds.
Stylesheets, scripts, fonts, images, icons and audio content required for the normal operation of the Platform are provided by the Platform itself.
External links are accessed only when users deliberately follow them.
Personal data is processed only where necessary for the operation and use of the Platform, its security and protection against abuse, moderation, compliance with legal obligations or on the basis of consent.
3. Hosting, databases and email
Web hosting, database operation and the sending of system and notification emails are provided using services of:
IONOS SE
Elgendorfer Str. 57
56410 Montabaur
Germany
This may involve the processing of website and database data, uploaded files, technical operational data, server log data, backups and data required for sending email.
When an email is sent, the data processed may include the recipient address, sender, subject, message content and technical delivery information.
Emails are used, for example, for registration and email verification, access codes, requested topic and Cloud Mastering notifications, notifications of new private messages, and administrative or security-related communications.
Notification emails concerning private messages do not contain the text of the private message.
4. Website access, sessions and security
When AudioCommunity is accessed, technically necessary connection and request data is generated. Web servers and hosting infrastructure may process, in particular, the IP address, time of access, requested address, HTTP status and technical information about the client used.
The AudioCommunity application also uses its own security mechanisms.
For rate limiting, the IP address of a visitor who is not logged in is not stored in clear text in the application database. Instead, it is converted into a pseudonymous identifier using a secret key. For logged-in users, an account-related identifier may be used instead.
Security events may include the event type, pseudonymous actor identifier, requested route, internal object references, timestamps and sanitised technical metadata.
Access codes, passwords, session hashes and comparable secrets are not stored as such in security events.
This processing is used in particular to ensure secure and stable operation of the Platform, to detect and prevent abuse, spam and automated attacks, and to investigate errors.
5. Cookies and browser storage
AudioCommunity does not use third-party advertising or tracking cookies.
However, first-party cookies and browser storage are used for Platform functions.
| Storage | Purpose | Retention |
|---|---|---|
| PHP session cookie | Session, login, CSRF protection and form state | according to the configured session duration |
audioCommunity_masteringVisitor | Pseudonymous recognition for anonymous Cloud Mastering votes and protection against multiple voting | 365 days |
audioCommunity_theme | Selected appearance in Local Storage | until changed or deleted in the browser |
audioCommunity_rememberedAccounts | Optional “remember account on this device” function in Local Storage | until removed by the user or deleted in the browser |
audioCommunity_accountDeletionEmail | Temporary storage in Session Storage of the email address of the account being deleted so that it can also be removed from the locally remembered account list after successful deletion | until local cleanup following account deletion, reloading of the deletion form, navigation to another regular Platform page, or at the latest until the browser/tab session ends |
audioCommunity_cloudPlayerReturn | Return state between the Cloud Mastering page and web player in Session Storage or browser history | until the relevant browser/tab session ends or the history entry is removed |
The “remember account on this device” function is used only when selected by the user. For a maximum of five account suggestions, the email address, display name, initials and time of the most recent successful login may be stored locally in the browser.
Access codes and authenticated sessions are not stored in Local Storage by this feature. Remembered accounts can be removed individually or all at once.
audioCommunity_accountDeletionEmail contains only the email address of the account whose deletion is being completed. After account deletion, the value is used locally only to remove the corresponding entry from audioCommunity_rememberedAccounts. The value read from Session Storage is not transmitted to the server again.
The audioCommunity_masteringVisitor cookie has a maximum lifetime of 365 days and can also be removed using browser functions. Removing this cookie does not automatically delete voting data that has already been stored on the server.
Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to the storage of information on terminal equipment and access to information already stored there. Separate consent is not required, in particular, where storage or access is strictly necessary to provide a digital service expressly requested by the user. Where this condition is not met, the statutory consent requirements apply.
6. User accounts, registration and login
When a user account is registered and used, the data processed includes, in particular, username, display name, email address, account status, role, preferred language and appearance, notification settings and creation, modification and verification timestamps.
Login uses time-limited one-time codes.
Access codes and verification tokens are not stored in clear text in the database but as cryptographic verification data. Challenge ID, purpose, expiry time, number of attempts, time of use and session reference may also be stored.
Access codes are valid for ten minutes and can be used only once. Email verification links are valid for 24 hours and can likewise be used only once.
7. Forum and public content
When the forum is used, the data processed includes, in particular, post content, topic, forum, display name or, where anonymous use is permitted, the name or label provided, timestamps and technical attribution and security data.
Published posts and the displayed names or labels are publicly accessible and may also be indexed by search engines.
Forum posts may contain images or other permitted attachments. These are stored together with the technical information required to associate them with the relevant post.
Deleting a user account does not automatically delete forum posts that have already been published. Where technically provided, the connection to the active user account is removed. Statutory rights to rectification or erasure remain unaffected.
Please do not publish personal or confidential information that is not intended to be publicly accessible.
8. Private messages
Registered users may send private messages to one another.
The data processed includes, in particular, the participants in the conversation, sender, message text, timestamps, read status and, where applicable, hidden and blocking states.
Private messages are not public. They are not routinely read by administrators or moderators and are not available to them as a general message inbox.
A received message may be reported. In that case, the reported message and a limited amount of conversation context required for assessment are stored together with the report reason, any additional explanation and moderation data and may be reviewed by authorised administrators or moderators.
Users can delete their own messages using the available deletion function. An empty conversation is subsequently removed.
Merely hiding a conversation does not delete it.
When a user is blocked, the shared conversation is removed in accordance with the implemented deletion logic. When an account is deleted, conversations and blocking relationships associated with that account are deleted in accordance with the implemented deletion logic.
9. Topic subscriptions and notifications
Users with an active account and a verified email address can voluntarily subscribe to individual topics.
The data processed includes, in particular, user, topic and post references, selected language, subscription and dispatch timestamps, delivery status and an unsubscribe token stored only as a hash.
Topic titles, author names and content of new posts may form part of a notification email.
A topic subscription can be ended at any time.
Other optional notifications, for example concerning private messages or Cloud Mastering activity, depend on the settings selected in the user account and can be disabled there again.
10. Cloud Mastering
Cloud Mastering processes the files and information supplied by the user.
This may include, in particular, the audio file, an optional cover image, track title, artist or band name, optional external links and other publication information provided by the user.
The audio file is processed on the server. This creates technical analysis and processing data, preview files, mastering variants, processing jobs and, where applicable, finished output files.
According to the technical audit on which this Privacy Notice is based, audio processing takes place within the AudioCommunity infrastructure. No transfer of audio files to an external cloud mastering or AI service was identified in the application code examined.
Uploading a track does not by itself make the track public. Only publication makes the content intended for publication accessible to other users or visitors.
This may include, in particular, the track title, artist name, cover image, supplied external links, preview audio, voting results and listening notes.
Original files are not provided as publicly downloadable files. Finished masters and other protected downloads are associated with the authorised track owner.
Voting
Registered users and, where provided, anonymous visitors may vote on mastering positions.
For registered votes, an association with the user account is stored. Anonymous votes use a pseudonymous visitor identifier.
Track reference, voting position, weighting or reputation information and timestamps may also be processed.
When a user account is deleted, votes on tracks owned by other users may remain in decoupled form for statistical purposes without a user or visitor identifier.
Listening notes
Listening notes may contain text, track and user references, a position in the sound field and timestamps.
The track owner may delete a track. The track and its associated files and records are then removed in accordance with the implemented deletion logic.
11. Reports and moderation
Content, private messages and users may be reported using the respective reporting functions.
The data processed may include, in particular, the affected content or its reference, report category and reason, additional explanation and necessary contact information where applicable, processing status, moderation decisions, internal notes, communication and timestamps.
Reports concerning private messages may additionally contain a snapshot of the reported message and a limited amount of conversation context.
Only appropriately authorised persons have access to this data.
The processing is used to investigate possible violations of law and the Community Rules, prevent abuse and ensure that moderation decisions can be carried out and documented appropriately.
12. Historical forum content
Some of the publicly available forum content originates from the former Tontechnik Forum.
Historical author names serve as archive labels. They are not used to create new user accounts and previous login credentials are not reactivated for access to the new Platform.
Requests for rectification, anonymisation or erasure of personal information contained in historical content are reviewed on a case-by-case basis.
13. Legal bases
Where processing is necessary to provide a user account or a Platform function requested by the user, the legal basis is Article 6(1)(b) GDPR.
Where processing is necessary to comply with a legal obligation, the legal basis is Article 6(1)(c) GDPR.
Where processing is necessary for the secure and reliable operation of the Platform, protection against abuse and spam, moderation and handling of reports, preservation of coherent discussions, or the establishment, exercise or defence of legal claims, the legal basis is Article 6(1)(f) GDPR.
The legitimate interests include, in particular, the security and integrity of the Platform, protection of its users, prevention of abuse and manipulation, and the functional operation of a public discussion and audio community.
Where a function expressly relies on consent, processing is based on Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.
The GDPR provisions governing the processing of personal data and Section 25 TDDDG governing storage and access on terminal equipment each apply within their respective scope.
14. Recipients and publication
Personal data is made available only to persons or organisations that require it for the relevant purpose.
These may include in particular:
- IONOS SE for hosting, database operation and email delivery,
- authorised administrators and moderators where required for operation, security or moderation,
- authorities or other bodies where disclosure is required by law,
- the public where content has deliberately been published by the user.
External links, for example to websites, YouTube, Instagram, SoundCloud, Bandcamp or Spotify, are not automatically embedded or accessed by AudioCommunity.
A connection to the external provider is established only when a user follows such a link. The provider's own privacy rules apply to its subsequent processing.
15. Retention and deletion
Personal data is generally stored only for as long as necessary for the relevant purpose or where statutory retention duties or legitimate grounds require continued storage.
Where a fixed period cannot be specified, retention is determined in particular by the duration of the relevant user relationship or process, the need to prevent abuse, moderate content and document security-relevant events, legal obligations and possible legal claims.
User accounts
Account data is generally processed for the lifetime of the user account.
When an account is deleted, account-related data is deleted or decoupled in accordance with the relevant function.
Forum posts that have already been published are not automatically deleted together with the account.
Private messages
Users can delete their own messages. Empty conversations are removed. Blocking and account deletion trigger the deletion mechanisms provided for those functions.
In the absence of such a deletion action, existing private conversations currently have no fixed automatic age-based deletion period.
Cloud Mastering data
Tracks may be deleted by their respective owners. Track deletion covers the database records and files associated with the track under the technical deletion logic.
Access codes
One-time codes are valid for ten minutes. Used or expired challenges are removed through the applicable cleanup process.
Cookies and browser storage
The retention periods and deletion criteria are stated in Section 5.
Security, moderation and operational data
There are not currently uniform fixed age-based retention periods for all security events, audit data, reports and moderation history, dispatch and notification data, and certain operational, monitoring and processing records.
They are retained according to the necessity criteria applicable to their respective purpose, in particular for as long as required to process a matter, prevent abuse, document security or moderation-relevant events, comply with legal obligations, or establish, exercise or defend legal claims.
Backups
Database and file backups are deleted according to the operationally configured rotation period. The AudioCommunity backup function currently uses a default retention period of 30 days.
Deletion from the active system does not retroactively modify backups that already exist. Data contained in such backups disappears when the relevant backup is deleted or overwritten as part of the regular rotation.
The retention period for additional technical server logs depends on the IONOS hosting configuration actually in use.
16. Automated protective measures
Rate limits, spam filters and comparable technical protective measures may operate automatically.
Final moderation decisions remain under human responsibility.
Based on the functionality examined, AudioCommunity does not make decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect that person.
17. Data subject rights
Subject to the statutory requirements, data subjects have in particular the right to:
- access their personal data,
- have inaccurate data rectified,
- request erasure,
- restrict processing,
- data portability where the applicable requirements are met.
Where processing is based on Article 6(1)(f) GDPR, a right to object exists in accordance with Article 21 GDPR.
Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Data subjects also have the right to lodge a complaint with a data protection supervisory authority.
Competent supervisory authority:
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Germany
Email: poststelle@lfd.niedersachsen.de