Privacy policy

How AirPitch handles data on airpitch.de — local camera MIDI control, no upload

1. Controller

nopainsoft
nopainsoft.de
Email: hello@nopainsoft.de

2. Summary

AirPitch is a browser-based musical instrument. Camera and audio processing happen locally on your device. No camera images are transmitted to our servers or stored there. No user account is required.

3. Camera and hand tracking

• Webcam access is requested only after your explicit consent in the browser.
• Video data is processed locally in the browser (MediaPipe Hand Landmarker).
• No camera data is transmitted to us or third parties.
• No camera images are stored permanently.
• Processing is used to control the instrument (pitch, timbre, optional pan, drums) and to provide the features you request.

Legal basis (GDPR): Art. 6(1)(a) (consent via browser permission) and Art. 6(1)(b) (use of the offered application).

4. Audio

Sound is generated locally via the Web Audio API. The microphone is not used. No audio recordings are transmitted or stored.

5. Local storage (localStorage and sessionStorage)

Your calibration and settings may be stored in your browser's localStorage so your preferences persist on your next visit. This includes, for example:

• Instrument presets, pitch range, and control parameters
• Drum pad mappings and MIDI configuration
• A pseudonymous visitor identifier (web-theremin-visitor-id) used only for the optional visitor counter (see section 7)
• A signed support license token after a voluntary PayPal donation to unlock Pro drum pads

A session flag (web-theremin-visit-sent) in sessionStorage ensures the visitor counter is incremented at most once per browser session.

This data stays on your device except where explicitly noted below (visitor counter, license verification). You can delete it at any time via your browser settings.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in usability).

6. Progressive Web App (service worker)

The app may cache static files (HTML, CSS, JavaScript, WASM, models) in the browser for faster loading and offline use. Drum samples and optional MediaPipe fallback files may be cached on demand when you use those features. No personal usage profiles are created.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable delivery).

7. Visitor counter

When the stats API is available (production deployment on airpitch.de), the app sends a pseudonymous identifier (random UUID from localStorage) to our license/stats server once per browser session via POST /api/stats/visit.

• Purpose: aggregate visit and unique-visitor counts displayed in the app — not marketing or profiling.
• Server-side storage: the UUID is kept in a local stats file on our Netcup vServer to distinguish returning visitors (up to 50,000 identifiers). Only aggregate totals are shown publicly.
• No link to camera data, audio, or instrument settings. The UUID cannot identify you by name.
• Retention: identifiers are kept for counting purposes until manually removed or the stats store is reset. No automated marketing use.

You can prevent future counting by clearing site data in your browser or blocking requests to the stats API. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding basic site usage).

8. Server log files (hosting)

The site is hosted on a Netcup vServer (Netcup GmbH, Daimlerstraße 25, 76275 Ettlingen, Germany). When you visit the site, the hosting provider may process technically necessary access data (e.g. IP address, timestamp, requested file, user agent) in server log files. This supports security and operation. We do not use this data for marketing or profiling.

Legal basis: Art. 6(1)(f) GDPR.

9. Cookies and tracking

AirPitch does not use its own tracking cookies or analytics tools (e.g. Google Analytics). Technically necessary browser storage (see sections 5–7) may be used instead of cookies.

When you voluntarily start a PayPal checkout, you are redirected to PayPal's website. PayPal may set its own cookies and process personal data under its privacy policy. This happens only if you choose to donate — not during normal instrument use.

10. Voluntary support payments (PayPal)

You may voluntarily support the project to unlock Pro drum pads (additional thumb-pinch mappings and full MIDI drum control). Payments are processed by PayPal. We receive payment confirmation and do not receive your PayPal password. Payment-related data (e.g. transaction ID, amount, payer email where provided by PayPal) is used only to issue your unlock license on this device.

PayPal's privacy policy applies during checkout: paypal.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (contract/support) and Art. 6(1)(f) GDPR (fraud prevention).

11. License verification

If you unlock Pro drum pads, the app may send your stored license token to our server (GET /api/license/verify) to confirm it is still valid. No other personal data is transmitted with this request.

Legal basis: Art. 6(1)(b) GDPR (performance of the support/unlock feature).

12. No sale of data

We do not sell personal data. Data is not shared with third parties unless required by law or you have consented (e.g. by starting PayPal checkout).

13. Your rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR) with future effect — e.g. by revoking camera permission in browser settings or clearing site data
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

14. Data security

The site is served over HTTPS. Because camera processing is local, the risk of unintended data transmission is greatly reduced.

15. Changes

We update this privacy policy when the app or legal requirements change. The version published on this page applies.

Last updated: July 2026 · Legal notice