Last updated: 19 October 2026 · Version 1.5 · The German version is authoritative.
1020.dev e.U., Lichtenauergasse 4/1/8, 1020 Vienna, Austria, email: hallo@1020.dev. We are not required to appoint a data protection officer. Legal notice: spin.1020.dev/imprint.
Spin is a social music app: you share songs with friends, follow them and see their posts. We only process the data needed for this. We do not sell data, run no advertising tracking and show no ads. The app contains no advertising or tracking SDK (for example from Meta, TikTok or Google) and no service for measuring ad campaigns; that is why Spin does not ask for the iOS permission for app tracking. To improve the app we evaluate usage events and crash reports (section 5b). How we count the ways people find Spin is described in section 5d.
Sign in with Apple (optional instead of email and password): Apple sends us a unique user identifier, your email address (if you choose, the relay address generated by Apple, "Hide My Email") and, the first time, your name. We store the identifier and email address as your login. In addition, we keep a refresh token issued by Apple. It serves exclusively to remove the link at Apple as well when you delete your account; Apple requires this. Sign-in runs natively via iOS. Apple learns that you use Spin; Apple's privacy notices apply to this step.
Sign in with Google (optional): sign-in takes place in a system browser window directly at Google; Spin embeds no Google SDK. Google sends us a unique user identifier, your email address and your name. We store the identifier and email address as your login. When you delete your account, we remove the link on our side; you can revoke the permission in your Google account yourself at myaccount.google.com/permissions. Google learns that you sign in to Spin; Google's privacy notices apply to this step.
Profile picture from the camera: besides your photos, you can take the profile picture directly with the camera. The image is cropped and downscaled on your device. If you have turned on the iOS Sensitive Content Warning, the app checks the image on your device with this system feature (SensitiveContentAnalysis) before uploading; the image does not leave your device for this, and an image recognised as sensitive is not uploaded. We store only the final profile picture, no raw capture. You allow camera access via iOS and can withdraw it there at any time.
How you found out about Spin. After you register, we ask you once how you came to Spin. Answering is voluntary. We store your answer with your account and evaluate it only in aggregate, to understand which paths lead people to Spin (legitimate interest, Art. 6(1)(f) GDPR). It is deleted with your account.
We collect no location data and no advertising IDs. Your address book leaves your device only as checksums and is not stored (section 5a).
Emails and notifications. We only send you emails about your account (confirmation, password, notice before deleting a long-inactive account), about a moderation decision or in reply to a request from you. We only send advertising or prompts to post again by email with your express consent, and we currently do not ask for such consent. You only receive push notifications if you allowed them. They may also remind you when you have not posted for a while, for example by telling you that friends of yours posted today. You choose which notifications you receive in the app; you can switch them off entirely in iOS Settings.
We use service providers that process data on our behalf. A data processing agreement under Art. 28 GDPR is in place with every provider that stores personal data for us.
| Service | Purpose | Where | Third-country transfer |
|---|---|---|---|
| Supabase (Supabase Inc.) | Backend, login, database, file storage, server logs, counting web visits | Frankfurt, EU | US-based provider; data stays in Frankfurt. Support access covered by EU standard contractual clauses. |
| Apple (APNs, App Store) | App delivery, delivery of push notifications and Live Activities, aggregated download figures per campaign (section 5d) | USA | EU-US Data Privacy Framework (Apple is certified). Apple receives the push token and the notification text. |
| Apple (Sign in with Apple) | Optional login; Apple confirms your identity and sends identifier, email address and name | USA | EU-US Data Privacy Framework. Apple learns that you sign in to Spin. |
| Google (Google Ireland Ltd., Sign in with Google) | Optional login via the system browser; Google sends identifier, email address and name | Ireland / USA | EU-US Data Privacy Framework (Google LLC is certified). Google learns that you sign in to Spin. |
| Resend (Resend Inc.) | Sending our emails: registration confirmation, password reset, moderation notices | USA | EU standard contractual clauses. Resend receives your email address and the message text. |
| PostHog (PostHog Inc.) | Product analytics (section 5b) | EU cloud (Frankfurt) | US-based provider; data stays in the EU. EU standard contractual clauses. |
| Sentry (Functional Software Inc.) | Crash reports (section 5b) | EU region (Germany) | US-based provider; data stays in the EU. EU-US Data Privacy Framework. |
| Spotify | Spin retrieves track metadata and cover art server-side via the Spotify Web API; the access key stays on our server | Sweden / worldwide | No personal data is transmitted — only search terms and track IDs without user reference. When you tap a song you open the Spotify app; from then on their privacy policy applies. |
| Anthropic (Anthropic Ireland, Limited; processing at Anthropic, PBC) | Assessing how well a song fits the day's theme (section 5e) | Ireland / USA | We transmit only the title, artist and album of songs and the day's theme, no information about persons; no personal data reaches a third country in the process. Contractually, Anthropic's data processing addendum with EU standard contractual clauses also applies. No training on this data, deletion within 30 days at the latest (section 5e). |
| Vercel (Vercel Inc.) | Hosting of spin.1020.dev, the share previews, the campaign links and the web forms | worldwide (edge) | EU-US Data Privacy Framework. Vercel sees IP address and browser data of page views. |
| Cloudflare (Turnstile) | Bot protection on the web forms (feedback, notices) | worldwide | EU-US Data Privacy Framework. Cloudflare receives your IP address and browser data for the bot check. |
| Meta (Meta Platforms Ireland Ltd., Instagram) | Our Instagram channel (section 5e); story cards you share to Instagram yourself (section 5d) | Ireland / USA | EU-US Data Privacy Framework (Meta is certified). Meta only receives what we publish on our channel or what you share yourself. |
We pass data to other recipients only where legally obliged (e.g. authorities or courts, Art. 18 DSA) or where you expressly request it.
If you choose "Search contacts" during onboarding, we ask for access to your contacts. We read only the email addresses; they are turned into checksums on your device using SHA-256, and we send only these checksums to our matching function, which compares them against the checksums of registered users. We store neither your contacts nor the checksums — the matching happens in memory and is discarded immediately. People in your address book who do not use Spin are neither stored nor contacted. We no longer read your contacts' phone numbers.
We have deleted all phone numbers. Until 6 September 2026 a phone number had to be given at registration; it served contact matching only and was never visible to other users. On 6 September 2026 we removed that feature and deleted the entire stock — the plain text as well as the checksums derived from it and the table they lived in. We no longer ask for numbers, neither at registration nor in the profile, and we no longer store any. You need do nothing; withdrawing what you gave back then is moot.
Why we deleted them: the numbers were never verified by SMS, and a checksum over a phone number barely protects it — a country's number space is small enough to be computed through. For a feature that serves the same purpose via email addresses, that was no longer proportionate processing (Art. 5(1)(c) and (e) GDPR).
Legal basis for contact matching: access to your address book (voluntary) — your consent (Art. 6(1)(a) GDPR), granted via the permission dialog and revocable at any time in iOS Settings. Processing of the previously stored phone numbers up to their deletion remains lawful; as long as the field was mandatory at registration it rested on performance of the user agreement (Art. 6(1)(b) GDPR).
To see which features are used and where the app fails, we use two services. Both process data in the EU.
PostHog (product analytics), EU cloud. Spin reports individual events — for example "onboarding completed", "song posted", "song shared" or "streaming link opened". Only the details belonging to the respective event are sent along (for example the ISRC of the posted song, the source of a share, whether the post fell within the time window, or from which part of the app a song was opened in Spotify), plus technical measurements about app start-up, such as how long loading took or whether a start was abandoned, and a timestamp and an identifier. Content such as captions or comments is not sent. That identifier starts out as a random string generated on your device; once you are signed in, we link it to your user ID. The analytics data is therefore pseudonymous, not anonymous. When you sign out, a new random identifier begins. We embed no SDK but send the events directly via HTTPS. Your IP address necessarily reaches the server in the process, but PostHog discards it immediately, does not store it and derives no location from it (project setting "discard client IP data", the default on the EU cloud). We keep event data for 12 months.
Sentry (crash reports), EU region. If the app crashes or stops responding, we transmit a technical error report: the stack trace, device model, iOS version and app version. This includes the diagnostics iOS itself creates about crashes, hangs and excessive energy or memory use (Apple MetricKit). The app's reports carry no user reference, and the transmission of default personal data is disabled — in particular no IP address is transmitted. No continuous recording of usage (performance tracing) takes place. If our server functions report an error to Sentry, the report may contain your internal user ID (not your name or email address) so that we can match the error to an operation. We keep error reports for 90 days.
Both serve solely the stability and improvement of Spin. We do not run advertising tracking, use no advertising identifiers, and do not pass this data to third parties for advertising purposes. The app is declared accordingly in the App Store.
Legal basis: our legitimate interest in a stable and comprehensible app (Art. 6(1)(f) GDPR). You can switch analytics off yourself at any time: Profile → Settings → Privacy → "Usage analytics". With the switch off, no event leaves your device and the link to your user ID is dropped on the device. An email to hallo@1020.dev also works.
Spin stores content you share and is therefore a hosting service under Regulation (EU) 2022/2065 (DSA). For this we process:
We do not disclose a notifier's name or email address to the person concerned. Legal bases: legal obligation (Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 DSA) and legitimate interest in a safe app (Art. 6(1)(f) GDPR). Retention: section 6.
Share links and profile cards. If you share a post or your profile via "Share", Spin creates a link (spin.1020.dev/s/… or /u/…). Anyone with this link sees a preview without logging in: for a post the title, artist, cover, caption, date, your username, display name and profile picture, plus the number of likes and comments; for the profile card your username, display name and profile picture. Share links do not expire; they disappear when you withdraw or delete the post or delete your account. The profile card at /u/your-username is available to anyone who knows your username — regardless of whether your profile is private. Your profile picture is stored at an unguessable address but is available to anyone who knows that address. Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR) — you trigger the sharing yourself.
Story cards. If you share a story card (an image with song, username and QR code) to Instagram or via the share menu, the app creates the image on your device and hands it to the app you choose. For Instagram, the app passes along an identifier of our app so that Instagram accepts the card; we transmit no information about you to Meta. What happens to the image after that is up to the respective service.
Counting web visits. When someone opens a preview (spin.1020.dev/s/… or /u/…), the homepage, a campaign link (spin.1020.dev/go/…) or the Android page, or taps "Get Spin" or "I want Spin on Android" there, we count it in a daily statistic. We store only the date, the page or button, a rough device class (iPhone, Android, computer, automated request, other) and, if the link contains one, a campaign identifier such as "invite" or the identifier of an ad. We derive the device class from the browser identifier at the moment of the request. We do not store the browser identifier itself, nor the IP address, the link that was opened, a username, a cookie or any other identifier. Each entry is just a number per day and cannot be linked to a person. This shows us how people find Spin (for example through ads, invitations or events) and whether an Android version would be worthwhile. When a campaign link leads to the App Store, the address contains the campaign identifier. Apple uses it to attribute downloads to the campaign and only gives us aggregated figures. We use no tracking SDK, no advertising pixel and no cookies for this, and nothing is stored on or read from your device for it. Legal basis, to the extent personal data is processed at all: our legitimate interest in understanding Spin's reach (Art. 6(1)(f) GDPR).
Selection. Every day Spin automatically selects a song of the day, every week a user of the week (terms of use, section 2a). Only posts from accounts with a public profile are eligible; no accounts of Spin itself, no suspended accounts and no hidden posts. For this we process the posts of the spin day or week, the number of likes and reactions on them and whether a post fell within the time window, and for the user of the week also their number of posts that week and, in case of a tie, their streak. We store the selected post or account with score and time, and for the song of the day also the next places, from which our team prepares the Instagram feature.
Assessing the theme with AI. To assess how well a song fits the day's theme, once a day we send the title, artist and album of up to 30 songs together with the theme to Anthropic's AI model Claude Haiku. We transmit no information about persons: no user ID, no username, no caption, no number of likes. The model returns a number for each song. It counts for half; the other half is other users' reactions. If the model fails or there is no theme, only the reactions count. Under its contract terms, Anthropic does not use this data to train its models and deletes it within 30 days at the latest, except in the event of a violation of its usage policy or where the law requires longer retention. The themes themselves are created outside the app, partly with the help of AI, and contain no user data. Spin uses no other AI in operation.
The selection has no legal or similarly significant effect on you (Art. 22 GDPR): it only decides on a badge and a possible Instagram feature.
Badges in the app. A selected post gets a badge that only appears where the post is visible anyway. The user of the week gets a badge on their profile for seven days and afterwards an entry in their profile history. If you allowed notifications, we let you know when you have been selected.
Trendsetter. If you were the first to post a song in Spin and at least three other accounts posted the same song afterwards, we mark your post "Trendsetter". For this we compare which song was posted when; hidden posts and suspended accounts do not count. Only people who can see the post anyway see the note; the number of such songs appears on your profile. The note stays as long as the post exists. As with the selection, the legal basis is performance of the user agreement (Art. 6(1)(b) GDPR).
Featuring on Instagram. We feature the song of the day and the user of the week on Spin's official Instagram channel, only if the profile is public. For the song of the day we publish the song's title and artist, your username and, where present, your caption; for the user of the week only your username — no profile picture, no further data. Instagram is operated by Meta Platforms Ireland Ltd.; data may reach the USA in the process (Meta is certified under the EU-US Data Privacy Framework). From publication, Meta's privacy policy applies to the post there, and other Instagram users can see and share it. We have no control over copies that other Instagram users have already shared.
Legal bases and objection. Selection and in-app badges are part of the rules of play (performance of the user agreement, Art. 6(1)(b) GDPR, in conjunction with section 2a of the terms of use). We base the Instagram feature on our legitimate interest in promoting Spin and our users' music (Art. 6(1)(f) GDPR, in conjunction with section 5 of the terms of use). You can object at any time — in advance or afterwards — by emailing hallo@1020.dev. We then remove the post from our channel and, if you wish, take you out of the selection altogether. If you set your profile to private, you are no longer selected either.
What you see. At the end of your feed there are face-down cards. When you turn one over, it shows an earlier song (title, artist, cover — never the one of the current spin day) of a public profile you do not follow yet, together with that person's username, display name and profile picture and a "Follow" button. As long as you follow fewer than three people, such earlier songs may also appear as "Suggestions for you" in the feed and while setting up your account. They are chosen based on whom your friends follow or what is popular on Spin at the moment. You cannot like, react to or share them there, but you can open the song in Spotify.
When your songs are shown this way. Conversely, your earlier songs can be shown to others in this way, but only if you have expressly agreed ("Join" below the cards or in Settings under Privacy; default: off), only while your profile is public and only within your history-visibility setting. Only data your public profile shows anyway is shown, plus the song, no caption. Suspended accounts and people who have blocked you or whom you have blocked never appear. We store the time of your consent; if you end it, it is deleted.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the switch in Settings. If you agreed before app version 1.5, your consent also covers the suggestions in the feed and while setting up new accounts. We point this out to you in the app; you can end it at any time via the switch.
If Spin offers an invitation program (terms of use, section 5a), we store who invited whom, with which code (for codes used in campaigns, for example at universities or events, also the campaign identifier), when the code was redeemed and whether the invitation met the conditions for the reward. For that we count the spin days on which the invited person posted. The inviting person learns that their invitation was accepted and sees the invited person's account. The invited person automatically follows them unless they opt out when redeeming. The invitation page spin.1020.dev/i/… shows anyone who has the link the inviting person's username and the code.
Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR). The link is kept until one of the two accounts is deleted.
What communities are. Spin has communities, for example for universities, clubs or companies. Only we create them. Communities are run by Spin, not official offerings of the university, club or company, and they receive no data about you from us. Anyone can join the open "Spin Community" without a code; all others only with the community's code. Without a code you can ask to join; we decide on the request. We do not create communities whose membership reveals health, religion, beliefs, political opinions, trade-union membership or sexual orientation.
Who sees what. In a community you can share one song per week. All members of that community see this song of the week, including members who don't follow you, even if your profile is private: title, artist and cover of the song, your username, display name and profile picture, and the number of likes. We show nobody who liked your song; only you learn it by notification, if you have turned on notifications for likes. The current and the previous week are shown. A community's member list is not visible; members only see how many there are, so others learn that you are a member only when you share a song there. People who blocked you or whom you blocked, and suspended accounts, don't see your songs of the week and don't appear.
Charts and week crown. If you open another member's song of the week in Spotify, we store that; your own songs don't count. A community's charts rank the songs of the week by how many members opened them; each account counts once. Members only see this number; we show nobody who opened which song. If your song of the week is number one, it gets the week crown: for one week we show it to all members of that community above the charts, with your username, display name, profile picture and the number of opens, and a small crown appears next to your name. If you allowed notifications, we let you know.
Uni league. In the uni league, the university communities compete with each other. For this we add up, per week, the posts, songs of the week, opens of other people's songs in Spotify, likes and comments of the members of each university community. We only show totals per university and points per member, never figures about individual people; for universities with fewer than 5 members we show no figures. If you don't want to be counted, you can leave your university's community.
What we process. Your memberships (since when, how), your songs of the week, likes, opens, week crowns and your notification settings per community. If you send a join request, we see your username, the community or the name of the requested community and your message.
Notifications. If you allow push notifications, we tell you once a week that a new week starts in your community (default: on) and, if you want, about likes on your song of the week (default: off). You set both per community in Settings → Communities.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR), also for the charts, the week crown and the uni league; joining is voluntary and you can leave at any time (Settings → Communities).
Retention. We delete songs of the week 8 weeks after their week ends, immediately when you leave the community; opens and week crowns are deleted together with the song of the week. Memberships last until you leave. We delete join requests 6 months after our decision.
We store your data as long as your account exists. You can delete your account at any time in the app (Profile → Settings → Delete account). This removes login, profile, profile picture, posts, comments, likes, reactions, saved songs, follows, blocks, push and Live Activity tokens, invitations, community memberships, songs of the week, join requests, awards, streak credits, your feedback and your consent logs. Specifically:
Statutory retention obligations remain unaffected.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
Scope of the data export. The export contains everything we have stored about your account: profile and settings; all posts including songs and captions; comments, likes, reactions, saved songs; follows in both directions (including requests); blocks you have set; reports you have made (without the review outcome); your acceptances of the terms of use; time and device type of stored push and Live Activity tokens (not the token itself); share links; invitations; songs you opened in Spotify from Spin; your community data (memberships with notification settings, songs of the week, your likes on songs of the week and which ones you opened, week crowns, join requests); your answer to the question how you found out about Spin; the "Trendsetter" note on your posts; counters of notification bundling and of contact matching; whether a checksum of your email address is stored for contact matching (not the checksum) and whether an Apple refresh token is stored (not the token). Not included are reports by others about you (Art. 15(4) GDPR), other people's posts and comments, and password hashes and session tokens. The export is created on request, not stored, and handed to you as a JSON file to share.
For all requests: hallo@1020.dev. We reply within one month.
Right to complain: you can complain to a data protection supervisory authority, in Austria the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at — or to the authority of your place of residence.
Spin is not directed at children under 16. By registering you confirm you are at least 16; we do not perform age verification. We do not knowingly collect data from children under 16. If we learn of it, we delete the account. Parents and guardians can reach us at hallo@1020.dev.
All connections are TLS-encrypted. Passwords are stored only as hashes. Access to other users' data is restricted in the database itself (row-level security), not only in the app. Access keys to third-party services are kept exclusively on the server.
We update this policy as needed, for example for new features or changes in the law. The current version is available in the app (Settings → Privacy) and at spin.1020.dev/privacy. We inform you in the app about material changes.