Privacy policy

Who is responsible

PadLoop is developed and published by Positive Vibration SLU (Spain), the data controller for the processing described here.
Address: Barda Tomas Morales, 35100 San Bartolomé de Tirajana, Las Palmas, Spain · CIF B76273051
Contact for any privacy question: [email protected]

The short version

• No account, no e-mail sign-up, no ads inside the app.
• Everything you play, record, import or create stays on your device. We never receive your audio, videos or projects.
• Usage statistics (Google Analytics for Firebase) are off until you say Yes. You can change your mind at any time in MORE.
• Crash reports are on by default, contain no audio or content of yours, and can be turned off in MORE.
• On Android, a one-way fingerprint of the device identifier is stored to make the free trial work once per device.

Your choice: usage statistics

The first time you open PadLoop (version 0.53 and later) a window asks "Will you help us improve PadLoop?". The "No" and "Yes" buttons are equal, and the app works exactly the same if you say No. Until you answer, no usage statistics are sent.

• Yes turns on usage statistics (see below). Events from the first minutes before your answer are sent only if you say Yes; if you say No they are discarded.
• Ad measurement (Android only): a separate box, unchecked by default, lets you also allow us to use these statistics, together with the Android Advertising ID, to measure whether our own Google Ads campaigns work. On iPhone and iPad this is never asked and never done.
• Changing your mind: in MORE you find the switches "Usage statistics", "Ad measurement" (Android) and "Crash reports". Turning usage statistics off also turns ad measurement off and resets the Analytics identifier on your device, so a later Yes starts from a fresh identifier. Withdrawing consent does not affect data already sent before.
• Versions of PadLoop before 0.53 collected usage statistics without asking. When you update, the question is shown to you as well.

What data is processed, why, and on what legal basis

1. Your music and recordings — stay on your device

Microphone recordings, sound sampled from other apps, the audio of videos you pick, songs you split into parts, sounds, banks, projects, performances and MIDI input are processed and stored only on your device, inside the app's private storage. They are never uploaded to us or to anyone else. They leave your device only when you export or share them yourself, or through your phone's own backup/transfer features (see point 9).

2. Usage statistics — only with your consent

If you say Yes, PadLoop uses Google Analytics for Firebase (Google) to record how the app is used: app opens and sessions, which features you use and where you stop (e.g. first pad tapped, first loop recorded, guide steps), how long the app takes to start, whether the unlock or trial screen was shown, started, purchased or restored. Google Analytics also records an installation identifier (app instance ID), phone model, operating system and app version, language, and an approximate location (country/region) derived by Google from the IP address. Events contain no audio, no file names and no content of yours. We use this data only in aggregated reports to decide what to fix and what to add. We do not use it to show you advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in MORE.

3. Ad measurement — Android only, separate consent

If you also check the ad-measurement box (or turn on "Ad measurement" in MORE), the statistics above are additionally linked to your device's Android Advertising ID and used to measure our own Google Ads campaigns (for example, how many installs and first loops come from a campaign). Personalised advertising is always switched off in the app, and PadLoop shows no ads. For this measurement Google may act as an independent controller under its own terms. You can also reset or delete the Advertising ID at any time in your Android settings.

Legal basis: your consent (Art. 6(1)(a) GDPR), separate from the statistics consent and withdrawable at any time.

4. Crash reports — on by default, can be turned off

When the app crashes or hits a serious error, Firebase Crashlytics (Google) sends us a technical report: the error trace, phone model, operating system and app version, free memory/disk, and a random Crashlytics installation identifier. Reports contain no audio or content of yours; occasionally an error message may include the name of an app folder or project. They are pseudonymous (not anonymous) because of the installation identifier. We use them only to find and fix bugs.

Legal basis: our legitimate interest in keeping the app working and secure (Art. 6(1)(f) GDPR). You can object at any time by turning off "Crash reports" in MORE: no further reports are sent and reports not yet sent are deleted from your device.

5. Free trial — fraud prevention

iPhone and iPad: the 7-day free trial is a free App Store item you start yourself; its start date is the date of that App Store transaction. We store no device identifier for this.

Android: to make sure the trial is used once per device (also after "clear data" or reinstalling), the app computes a one-way SHA-256 fingerprint of the Android device identifier (ANDROID_ID) and stores, in Google Cloud Firestore, a record containing only that fingerprint and the trial start date set by the server. The identifier itself never leaves the device, and the record cannot be listed, changed or linked to your name. People who have bought the unlock skip this check. The record is kept for as long as PadLoop is distributed, only to stop the free week from being repeated, and contains nothing else.

Legal basis: our legitimate interest in preventing abuse of the free trial (Art. 6(1)(f) GDPR).

6. App integrity — Firebase App Check

To make sure that only the genuine PadLoop app can write trial records, the app uses Firebase App Check, which asks Google Play Integrity (Android) or Apple DeviceCheck (iPhone/iPad) to confirm that the request comes from an unmodified copy of the app on a real device. This returns a short-lived token; we do not receive any identifier from it.

Legal basis: our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).

7. Purchases

The one-time unlock (and, on iPhone/iPad, the free trial item) is handled entirely by Google Play or the App Store under their own privacy policies. We never see your payment details or your name. The app asks the store whether the unlock was purchased, restored or refunded, to turn the paid features on or off. If you said Yes to usage statistics, purchase, restore and refund events are part of the statistics described in point 2.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR); for the statistics, your consent.

8. Plugins (sound kits, instruments, track separation)

Optional plugins are downloaded from Google Play (Play Asset Delivery) or the App Store (On-Demand Resources). We run no download server of our own; the store handles the download under its own privacy policy.

9. Backups on your phone

On Android, the app's settings (for example trial date, unlock status, your privacy choices) can be included in your phone's automatic Google backup, linked to your own Google account; your projects and audio are not included in that cloud backup. When you move to a new phone with Android's device-transfer feature, projects and sounds are copied directly between your devices. We cannot access these backups.

10. If you write to us

"Report a problem" opens your e-mail app with a pre-filled message containing the app version, operating system, phone language and an internal project ID; you decide what to send. We use your e-mail address and message only to answer you and keep them for as long as needed to handle your request.

Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR).

This website

The website padloop.net is a set of static pages: it has no accounts, no forms and no comments.

• Statistics, only if you agree. The site uses Google Analytics (Google Ireland Limited) to count visits, see which pages are read and which parts of the site are used (for example a tap on a store link or starting a video, an audio example or the pad), only after you press Accept in the cookie banner (legal basis: your consent). If you press Decline, nothing is loaded and no analytics cookies are set. IP addresses are anonymised; data is kept for at most 14 months. You can change your choice at any time with Cookie settings at the bottom of every page.
• Videos. The videos and clips are served from our own server. Short silent clips start by themselves when they come into view (you can pause them, or turn them off); videos with sound are downloaded only when you press play. No video platform is involved.
• Server logs. Like every web server, ours (in the European Union) records technical data of each request (IP address, page, date, browser) to keep the site secure and working (legal basis: our legitimate interest). These logs are deleted automatically after a short period and are not used to identify you.
• The pad you can play on the home page runs entirely in your browser: nothing you play is sent anywhere. With statistics accepted we only count that the pad was used, not what you played.

Details on cookies and browser storage: see the cookie policy.

Permissions the app asks for

• Microphone — only to record when you tap a record button. Never without your action. An ongoing recording can continue with the screen off, with a visible notification on Android.
• Audio from other apps (Android 10+, "Sample from other apps") — Android's screen-capture permission is used for audio only, after you confirm the system dialog; no images of your screen are captured. The sound stays on your device.
• Photos and videos ("Sound from a video") — only the video you pick is opened, to extract its sound on your device. On Android this uses the system file picker.
• Bluetooth — only to find and connect MIDI keyboards and controllers when you start a search. On Android 11 and older the system calls Bluetooth scanning a "location" permission; PadLoop does not read or store your location.
• Notifications (Android) — only for the "recording in progress" / "playing" notification that keeps audio alive with the screen off.

Who receives data

• Google (Google Ireland Ltd / Google LLC), as our processor for Firebase (Analytics, Crashlytics, Firestore, App Check). See Firebase privacy and security and how Google uses data from apps that use its services. For ad measurement (point 3) Google may act as an independent controller.
• Google Play / Apple App Store, as independent controllers, for purchases, the iPhone/iPad trial item and plugin downloads.
• Nobody else. We do not sell personal data.

Google may process data in the United States and other countries. These transfers are covered by the EU–U.S. Data Privacy Framework, under which Google LLC is certified, and by the European Commission's Standard Contractual Clauses.

How long data is kept

What we do NOT do

• No ads inside the app, no ad networks, no personalised advertising.
• No account, no e-mail collection, no access to your contacts.
• No upload of your audio, videos or projects.
• No sale of personal data.

Children

PadLoop is a music app for a general audience and is not directed at children. We do not knowingly collect personal data from children under 14 (the age of digital consent in Spain; it may be different in your country). Usage statistics are collected only after a Yes; if you are under that age, please answer No or ask a parent. If you believe a child has given consent, write to us and we will help.

Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time (MORE > Usage statistics / Ad measurement). Write to [email protected].

Because PadLoop has no account, we only hold pseudonymous identifiers and normally cannot tell which data belongs to you. The quickest way to exercise your rights is in the app: turning off usage statistics stops the collection and resets the Analytics identifier; turning off crash reports stops crash reports; uninstalling deletes everything stored on your device. If you write to us, we may ask for information that lets us find your data (Art. 11 GDPR).

You also have the right to lodge a complaint with a data protection authority: in Spain, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or the authority of the country where you live (for example the Garante per la protezione dei dati personali in Italy).

Changes to this policy

If the app starts processing data in a new way, we will update this page and the date above, and where needed ask for your consent again in the app.