Privacy policy
The German version is legally binding.
1. Controller
Hannes Richter, Rolandstraße 14a
44894 Bochum, email: hello@knobshift.com
2. Visiting the site
Our hosting provider processes technically necessary data (IP address, time, page, user agent) in server logs to deliver the site and prevent abuse (Art. 6(1)(f) GDPR).
3. Cookieless visit counting
We count page views and a few actions (such as clicking “Download for Mac”, downloads, joining the waitlist) to learn which pages help. We set no cookie and read nothing from your device. From your IP address and user agent plus a random value that changes daily we compute a hash; we never store the IP address itself. The daily value is deleted after one day, after which no entry can be linked to a person. We also store the source (referring site or utm_source), language and device type. Legal basis: our legitimate interest in improving the site (Art. 6(1)(f) GDPR). Counts are deleted after 400 days.
4. Cookies, consent and optional services
We set necessary entries without consent and everything else only with your consent (Art. 6(1)(a) GDPR). Optional services load only after you agree; before that, there is no connection to them. We keep your choice for 12 months and log a random ID, your choice and the time as proof – without IP address or account – for three years.
| Provider | Purpose | Stores | Kept for |
|---|---|---|---|
| Sign-in KnobShift · Necessary | Keeps you signed in after you open the link from the email. | ks_session | 30 days |
| Language KnobShift · Necessary | Remembers the language you picked. | lang | 12 months |
| Privacy choice KnobShift · Necessary | Remembers this choice for 12 months. | ks_consent | 12 months |
5. Protection against bots and abuse
Forms contain a field that is invisible to people and only filled in by bots. For rate limiting and reports we never store IP addresses in plain text, only a salted hash, and delete counters after two days at most.
6. Account and emails
- Account: you sign in with your email address. We store email address, display name, language and sign-up time (Art. 6(1)(b) GDPR). Your email is never public.
- Sign-in emails: we pass your email address to our email provider to send the sign-in link.
- Waitlist: with your consent we send one email when the app is on the App Store, only after you confirm the link in the first email (double opt-in).
- Community notifications: when you follow a post (by creating, voting for or replying to it) we email you when its status changes or the team replies. Every email has unsubscribe links, and you can turn these emails off in your account.
7. Community content
- Dashboards, posts, replies, votes, compatibility reports: content, time and your account. Dashboards, posts and reports are public.
- Automatic moderation: new public texts are checked regularly, usually daily, for spam and unlawful content with Claude, an AI model from Anthropic, PBC (USA). Only the text, which is public anyway, is sent – never your name or email address (Art. 6(1)(f) GDPR).
- Moderation notices: if content of yours is hidden or deleted or your account is suspended, we email you the reasons (Art. 6(1)(c) GDPR with Art. 17 DSA).
8. Processors and transfers outside the EU
For providers based in the USA we state the basis of the transfer: the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) where the provider is certified, otherwise the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
- Vercel Inc. (hosting, installer storage), USA – EU-US Data Privacy Framework.
- Neon (database; Neon, LLC, a Databricks, Inc. company), servers in the EU (Frankfurt) – for access from the USA: EU-US Data Privacy Framework (via Databricks, Inc.).
- Resend (email), USA – EU-US Data Privacy Framework.
- Anthropic, PBC (automatic moderation), USA – not certified under the Data Privacy Framework; standard contractual clauses.
Data processing agreements are in place or being concluded with all processors. Certifications checked on 27 October 2026 (dataprivacyframework.gov).
9. iPad app and Mac bridge
This policy also covers the KnobShift iPad app and the Mac software (KnobShift Companion and KnobShift Bridge).
- No data sent to us: the app and the Mac software send no data to us or to third parties. They contain no analytics, no ads and no tracking across apps or websites.
- The connection stays local: iPad and Mac exchange MIDI data directly, over USB or a Network MIDI 2.0 session on your local network. iPadOS asks for local network access for this. The data doesn’t leave your network.
- Data on your devices: the app stores dashboards, customizations and your own parameter names on the iPad. The Mac software reads and saves presets in your local preset folders. Companion and bridge talk over a local connection on the Mac.
- Links to the website: community, library and help open this website in the browser; what this policy says about the website then applies.
- Test builds: only test packages of the Mac software write a troubleshooting log (to your Downloads folder and ~/Library/Logs), including short summaries of local crash reports. It stays on your Mac, and you decide whether to send it to us. Release versions write no log.
10. Retention
Account data, dashboards and posts until you delete them or your account. Sign-in links expire after 15 minutes, sessions after 30 days.
11. Your rights
You have the right to access, rectification, erasure, restriction, portability, objection and to withdraw consent, and to lodge a complaint with a supervisory authority. Contact hello@knobshift.com.