Privacy policy

Last updated: 19 October 2026. Courtesy translation. In case of doubt, the German version applies.

1. Privacy at a glance

Chord Drills runs entirely in your browser. There is no registration, no cookies, no advertising and no analytics or tracking services. No fonts, scripts or images are loaded from third-party servers. What you enter (for example MIDI notes) is not transmitted to me. Personal data is processed only as described in this policy.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Alexander Lach
Steinbrecherstraße 28
38106 Braunschweig
Germany
Email: chorddrills@gmail.com

3. Hosting via GitHub Pages

This website is provided through GitHub Pages. The provider is GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (a Microsoft company).

When you open the site, the hosting provider processes technical data in server log files, in particular your IP address, the date and time of the request, the page requested, the amount of data transferred and browser and operating system information. This data is necessary to deliver the site and keep it secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the service securely and efficiently). I have no access to these logs and do not evaluate them.

Data may be transferred to the USA in this process. According to GitHub, such transfers rely on EU standard contractual clauses and the EU-US Data Privacy Framework. You can find more information in GitHub's privacy statement: docs.github.com/site-policy/privacy-policies/github-general-privacy-statement.

The connection to the site is encrypted via HTTPS (TLS).

4. Settings stored in your browser (Local Storage)

Chord Drills stores only settings that you choose yourself in your browser's local storage so that they are still there on your next visit. These include: language, color scheme, display option for the progressions, metronome tempo and sound, volume, and the best results of the time attack (high scores). This data stays on your device, is not transmitted to me or to third parties, and is not used for tracking.

The legal basis is Section 25(2) no. 2 TDDDG (storage is strictly necessary for the function you requested) in conjunction with Art. 6(1)(f) GDPR. You can delete this data at any time in your browser settings ("site data" or "local storage").

5. MIDI input

When you connect a MIDI keyboard, your browser asks for your permission (Web MIDI). The notes you play are processed locally in your browser only. Nothing is transmitted to me or to third parties. You can withdraw the permission at any time in your browser settings.

6. Sound output and speech output

All sounds (piano sound, metronome, grooves) are generated directly in your browser and are not transmitted.

The optional speech output ("Spoken announcements") is switched off by default. If you switch it on, Chord Drills uses the speech output of your browser or operating system. Depending on the browser and the voice chosen, the text to be spoken (for example "C major seven") may be sent to the manufacturer of the browser or the voice. I have no influence on this; see your browser's privacy information.

7. External links and voluntary support

The "Buy me a coffee" button lets you support the project voluntarily. It only contains links to Ko-fi and PayPal; no content from these providers is embedded in the page. Only when you click a link do you leave Chord Drills, and the respective provider processes your data under its own privacy policy (PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; Ko-fi: operator as stated in its legal notice).

If you donate, I receive the information that the provider passes on to me (for example name or pseudonym, amount, message and possibly email address). I process it to handle and document the payment and to meet tax record-keeping obligations (Art. 6(1)(b) and (c) GDPR) and do not pass it on.

8. Contact

If you send me an email, I process your details (email address, content of the message) to handle your request (Art. 6(1)(f) GDPR; for requests relating to a contract, Art. 6(1)(b) GDPR). I delete the data once your request has been dealt with and no statutory retention obligations apply. My mailbox is operated through Google Mail (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; in part Google LLC, USA); your message is processed on the provider's servers there.

9. Your rights

Within the limits of the law you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). You can withdraw any consent at any time with effect for the future. Please contact the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me as the controller is the Data Protection Commissioner of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany (lfd.niedersachsen.de).

10. Changes to this policy

If Chord Drills or the legal requirements change, I will adapt this policy. The version published here applies.