This policy describes which personal data is processed when you use the Murmel app and this website. In short: without an account everything stays on your device. With an account your email address is stored with a service provider in Frankfurt. Cloud backup is optional and end-to-end encrypted.
1. Controller
Ömer-Can Dikkule
Hahnenrückstr. 61
55743 Idar-Oberstein
Deutschland
Email: omercan1@hotmail.de
2. App without an account
Recordings, detected events, transcripts and settings are stored only on your device. Sound recognition (SoundAnalysis) and transcription (Apple SpeechAnalyzer) run on the device; no audio is sent to me or to Apple. Without an account I receive no data from the app.
- Speech model: for transcription, iOS downloads the speech model of the selected language from Apple once. This is an Apple service subject to Apple's privacy policy.
- Device backups: like all app data, the data is part of your iCloud or computer backups if you use them. This is part of your relationship with Apple.
- Microphone: the app asks for access the first time you start a recording. You can revoke it at any time in the iOS settings.
3. Account
An account is optional. If you create one, I process:
- your email address and password (stored only as a hash),
- a random user ID, times of registration and sign-in,
- technical request data (IP address, time, device type) in the server logs,
- the codes sent by email (confirmation, password reset).
Purpose and legal basis: providing the account under Art. 6(1)(b) GDPR (contract of use); security and abuse prevention, e.g. limiting sign-in attempts, under Art. 6(1)(f) GDPR.
Retention: until you delete the account, which you can do at any time in the app under Settings → Account → Delete account. The account and all related data on the server are then deleted immediately, and from backups within 7 days. The service provider deletes server logs automatically after a few days.
4. Cloud backup
Cloud backup is optional and only active after your explicit consent. The consent texts are under Consent.
- Data: events you select (time, duration, type of sound, transcript), and the audio if you choose. This content is encrypted on your device; I cannot read or listen to it.
- Visible to the server: your user ID, when you upload, the number and approximate size of entries, whether audio is included and in which week an entry expires under the retention period.
- Legal basis: your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR, because the data may allow conclusions about your health.
- Retention: until you remove or delete an entry from the cloud, at most until the end of the cloud retention period you set (default 90 days). Anything you choose to “keep in the cloud” is excluded. Deletion markers without content remain for up to one year so that a deletion reaches all your devices.
- Withdrawal: at any time in the app. Cloud data is deleted immediately, and from backups within 7 days. Processing before the withdrawal remains lawful.
- Record of consent: I store when you agreed to or withdrew which text version (Art. 7(1) GDPR, legal basis Art. 6(1)(c) GDPR). If you delete your account, this record is pseudonymised and deleted after 3 years.
- Key: the key is stored in your iCloud Keychain and in your recovery key, not with me.
5. Service providers
| Provider | Purpose | Data location |
|---|---|---|
| Supabase, Inc. (USA) | Database, sign-in, storage and server functions for the account and cloud backup | Frankfurt am Main (Amazon Web Services, eu-central-1) |
| Plus Five Five, Inc. “Resend” (USA) | Sending emails with confirmation and sign-in codes | Ireland (eu-west-1) |
A data processing agreement under Art. 28 GDPR is in place with both. As both companies are based in the USA, access from the USA cannot be ruled out; the EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Sub-processors are listed by Supabase and Resend.
6. This website
The website runs on my own server. When you visit it, your IP address is processed technically to deliver the page (Art. 6(1)(f) GDPR). No access logs are stored. The site sets no cookies, loads no content from other providers and uses no analytics or tracking tools.
7. No advertising, no tracking
Murmel contains no advertising and no tracking or analytics tools. Data is not sold, not used for advertising and not used to train AI models. There is no automated decision-making under Art. 22 GDPR.
8. Children and young people
The app can be used without an age limit. For an account and cloud backup, people under 16 need the consent of a parent or guardian (Art. 8 GDPR).
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Many of these rights can be exercised directly in the app (delete account, withdraw consent, remove data from the cloud); otherwise an email to omercan1@hotmail.de is enough.
You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.
10. Changes
If the processing changes, I will update this policy. The version and date above show the current state. For material changes to cloud backup, the app asks for your consent again.