Privacy.
Last updated 27 August 2026
This site sets no cookies and stores nothing in your browser. There is no advertising, no advertising network, no cross-site tracking, and nothing here is sold or shared with data brokers. That is why you have not been shown a consent banner — there is nothing to consent to.
Who is responsible
The controller for the processing described here is:
Alexander Henderson Hamilton, TODO_STREET, TODO_POSTCODE TODO_CITY, Germany
support@audiout.app
The scale of processing here does not require a data protection officer, so there is not one. Write to the address above with any question about your data and it reaches me directly.
Serving the site
The site is hosted on Cloudflare. To deliver a page to you, Cloudflare necessarily processes your IP address and the request itself, and uses them to keep the service up and to block attacks. Legal basis: legitimate interests, Art. 6(1)(f) GDPR — the interest being running a website that works and is not trivially knocked over. Cloudflare acts as a processor under a data processing agreement, with EU standard contractual clauses covering transfers.
Fonts
The typeface this site uses is served from this site's own domain. No font service, content delivery network or other third party is contacted to render a page, so nothing about you is sent anywhere to display type.
Analytics
The site uses PostHog, hosted in the European Union, to count visits and see which pages and buttons people actually use. It runs in cookieless mode: it stores nothing on your device and reads nothing from it.
Instead of an identifier kept in your browser, PostHog derives a visitor value on its servers by hashing your IP address, browser user agent and the site's hostname together with a secret that is regenerated every day and then destroyed. The IP address is discarded after that and is not stored. Because the secret changes daily and is not kept, the value cannot be traced back to you, cannot follow you to another site, and cannot connect today's visit to tomorrow's.
What is recorded: pages viewed, referring site and campaign parameters, clicks, how far down a page you scrolled, approximate device and browser type, and the checkout steps described below. There is no session recording and no profiling. Legal basis: legitimate interests, Art. 6(1)(f) GDPR — understanding whether the site works, using the least identifying method available.
One consequence worth stating plainly: because nothing here can be linked back to a person, I genuinely cannot look up "your" analytics data, and so Art. 11(2) GDPR means the access and deletion rights below cannot be exercised against it. This is a limit created by collecting less, not a way of avoiding the rules.
Buying
Checkout is run by Paddle, which is the merchant of record — the actual seller. When you open the checkout, Paddle's script loads from cdn.paddle.com and Paddle receives whatever you enter: name, email address, billing country and payment details. Card details never touch this site or any server of mine.
Paddle decides how it handles that data as its own controller, under its own privacy notice shown at checkout. What comes back to me is limited: your email address, the transaction reference, and the country, so that a licence key can be issued. Legal basis for my part of it: performance of a contract, Art. 6(1)(b) GDPR.
The site also records that a checkout was opened, that an email address was entered, whether payment failed, and whether a purchase completed. These go to PostHog as described above and carry the Paddle transaction reference but no name, email address or payment information.
Licence keys
Your email address, licence key and transaction reference are stored on the licence server at license.audiout.app so that keys can be issued, re-sent when you ask on the "Resend my key" page, and verified by the app. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. Kept for as long as the licence is valid, plus the statutory retention periods German tax and commercial law impose on records of a sale.
If you write to support@audiout.app I keep the message so I can answer it and so I have context if you write again. Legal basis: performance of a contract for support on a purchase, Art. 6(1)(b), or otherwise legitimate interests, Art. 6(1)(f). Deleted when it is no longer needed and no retention duty applies.
Your rights
Under the GDPR you can ask for access to your data (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), and a portable copy (Art. 20). You can object at any time to anything based on legitimate interests, including analytics (Art. 21). One email to support@audiout.app is enough — no form, no particular wording.
You also have the right to complain to a supervisory authority. The competent one for me is TODO_YOUR_STATE_DATA_PROTECTION_AUTHORITY, though you may complain to the authority where you live or work instead.
To object to analytics before contacting me, any content or tracker blocker will stop it, and browsers with tracking protection do so already.
Changes
If what the site does changes, this page changes with it and the date at the top moves. Any change that meant collecting more than is described here would be announced on the site first.