WhisperingKeys app & website
Privacy Policy
WhisperingKeys is quiet, human-made piano music. We want the app and website to feel the same way: calm, simple, and respectful of your privacy. In short, we collect as little as possible, we never sell anything, and we don't track you.
Korte samenvatting in het Nederlands
De WhisperingKeys-app is gratis, zonder account, zonder advertenties en zonder tracking of analytics. Wat je typt bij “Share what you need” gaat één keer via onze server (Cloudflare) naar een AI-dienst om een stemming te kiezen en wordt door ons niet opgeslagen of gelogd. In de offline modus blijft je tekst op je telefoon. Privéberichten en songverzoeken (met optioneel naam en e-mail) komen per e-mail bij WhisperingKeys binnen en worden alleen bewaard om te kunnen antwoorden. Je kunt altijd vragen om verwijdering. Een persoonlijke notitie bij “Send a song” staat alleen in de gedeelde link. De AVG (GDPR) is van toepassing. Vragen of verzoeken: [email protected]. Je mag ook een klacht indienen bij de Autoriteit Persoonsgegevens.
1. Who we are
The WhisperingKeys app and the website whisperingkeys.app are published by WhisperingKeys, a solo piano project based in the Netherlands. WhisperingKeys is the controller of your personal data under the EU General Data Protection Regulation (GDPR). You can reach us at [email protected].
2. The short version
- The app is free. There are no accounts, no ads, and no tracking or analytics SDKs. We don't build profiles and we don't sell or share data for advertising.
- Listening, browsing moods and using the sleep timer all happen on your device. We don't store your listening history.
- Data only leaves your phone when you choose to: when you use “Share what you need” online, send us a message or song request, or share a song link with someone.
- We keep messages only so we can read and answer them, and you can ask us to delete them at any time.
3. Using the app
The app has no login and asks for no personal details. It does not use advertising identifiers, analytics, crash-reporting or tracking SDKs, and it does not ask for access to your contacts, photos, location or microphone.
- Playing music. To stream a track, your phone requests the audio file from the server that hosts it (our own hosting on Cloudflare once the app's audio is live). Like any web request, this involves your IP address and basic device information, which the hosting provider processes briefly to deliver the file and protect against abuse. We don't use this to identify you.
- Settings and the sleep timer run only on your device.
- External links (Spotify, SoundCloud, our website, email) open in other apps or your browser. Their own privacy policies apply there.
- App Store. Downloads and any app-level statistics Apple provides to developers are handled by Apple under Apple's privacy policy. We only see aggregated, anonymous numbers if you have allowed Apple to share them.
4. “Share what you need” (AI mood picker)
You can type a few words about how you feel, and the app suggests one of its moods with a few tracks and one gentle sentence.
- Online: your text is sent once, over an encrypted connection, to our small server (a Cloudflare Worker), which forwards it to an AI service to pick a mood from our own track list. The result comes straight back to your phone.
- We do not store or log what you type. Our server has no database, keeps no logs of message content, and marks responses as “do not cache”.
- The AI provider receives the text to produce the answer. The AI provider's own terms and privacy policy apply to how they process it. We will name the provider here when the online feature goes live.
- Offline mode: if the online service isn't available or not enabled, the app matches keywords on your device and your text never leaves your phone.
- Please don't include names, contact details or other sensitive information about yourself or others. A few words about your mood are enough.
5. Private messages and song requests
In the app you can send WhisperingKeys a private message or request a song.
- What we receive: your message or story, and, only if you fill them in, a name or nickname and an email address (so we can reply or tell you when a piece is ready).
- How it travels: the app sends it to our Cloudflare Worker, which passes it to an email delivery provider (for example Resend). The provider delivers it to the WhisperingKeys mailbox ([email protected], a Google Gmail account). Our server does not store or log the content.
- Where it is kept: only in that mailbox, so we can read and answer it. Messages are never shown publicly. If a song request leads to a piece, it may be published with an anonymous dedication only (for example “For someone missing their mother”), never with your name or details.
- Spam protection: we use a hidden form field, length limits and rate limiting. Rate limiting uses a one-way hash of your IP address for a few minutes and never includes the message content.
- Deletion: email us at any time and we will delete your messages and any reply thread.
6. Sending a song to someone
- When you send a song, your personal note and optional “from” name are written into the link itself. They are not stored on any server of ours.
- You share the link through your phone's share sheet (for example WhatsApp, Messages or email). Those apps handle the message under their own policies. Anyone who has the link can read the note, so only share it with the person it is meant for.
- The recipient's gift page on our website reads the note in their browser. It asks search engines not to index the page and tells the browser not to pass the link on to other sites.
- The page loads the SoundCloud player only after the recipient presses play. From that moment SoundCloud may set cookies or collect data under SoundCloud's privacy policy.
7. The website
- The website has no analytics, no advertising and no tracking cookies of our own.
- Hosting: the site is served by Cloudflare. Cloudflare processes technical data such as IP addresses to deliver pages and protect against attacks, under its own privacy policy.
- Embedded players: the home page includes SoundCloud and Spotify players. When they load, your browser connects to SoundCloud or Spotify, which may set cookies and process your data under their own policies (SoundCloud, Spotify).
- Fonts: the site loads its typefaces from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google (Google privacy policy).
- “Notify me” form: it is currently a preview and does not store or send anything. If we connect it in the future, we will update this policy first and explain exactly what is kept.
- If you email us directly, we use your email only to reply.
8. Services we rely on
| Service | What for | Data involved |
|---|---|---|
| Cloudflare | Website hosting, app audio hosting, the Worker behind AI and messages | IP address and technical request data; message content passes through in memory only |
| AI provider (to be named at launch) | Picking a mood for “Share what you need” | The text you type, once per request |
| Email delivery provider (e.g. Resend) | Delivering messages and song requests to us | Message, optional name and email |
| Google (Gmail, Google Fonts) | Our mailbox; website fonts | Messages you send us; IP address for fonts |
| SoundCloud, Spotify | Embedded players on the website and gift page | Data they collect when their player loads |
| Apple | App Store distribution | Under Apple's own policy |
Some of these companies may process data outside the European Economic Area, for example in the United States. Where that happens, they rely on safeguards recognised under the GDPR, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
9. Legal basis and how long we keep data
- Share what you need, messages, song requests and song links: we process your data because you ask us to (to provide the feature you chose; Article 6(1)(b) GDPR) and, for spam protection and security, on the basis of our legitimate interest in keeping the service safe (Article 6(1)(f)).
- Hosting and security data: legitimate interest in running a secure website and app.
- Retention: AI requests are not stored by us at all. Rate-limit hashes expire within minutes. Messages and song requests stay in our mailbox only as long as needed to read and reply, and are deleted on request.
10. Your rights
Under the GDPR you can ask us to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. Just email [email protected]; we'll respond within one month. Because we don't keep accounts, it helps to send your request from the same email address you used, or describe the message so we can find it.
You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority in your own EU country.
11. Children
The music is suitable for everyone, but the app and website are not directed at children under 13, because the message, request and AI features accept free text. We don't knowingly collect personal data from children under 13. If you are under 16, please ask a parent or guardian before sending us a message or song request. If you believe a child has sent us personal data, contact us and we will delete it.
12. Security
All connections use HTTPS encryption. Our server keeps no message database or content logs, and access to the WhisperingKeys mailbox is protected. No system is perfect, so please don't send highly sensitive information.
13. Changes to this policy
If we change how we handle data, for example when the online AI feature or the website sign-up goes live, we will update this page and the effective date above. For important changes we will also mention it in the app.
14. Contact
WhisperingKeys, the Netherlands · [email protected]
See also our Terms of Use.