Song PeakDeutsch

Song Peak Privacy Policy

This policy explains, in accordance with Article 13 of the General Data Protection Regulation (GDPR), which personal data are processed when you use the “Song Peak” app, for what purposes, on what legal basis, and what rights you have.

1. In short

2. Controller

Morav IT UG (haftungsbeschränkt) (“Morav IT”, “we”)

Carl-Zeiss-Straße 8, 21465 Reinbek, Germany

Represented by: Yusuf Haidaryar (Managing Director)

Email: info@morav-it.de

Morav IT has not appointed a data protection officer because there is no legal obligation to do so (Art. 37 GDPR, Section 38 BDSG). Please send data protection questions to info@morav-it.de.

3. Processing on your device

  1. Songs, lyrics and cover art. Your inputs (topic, style, names, age and any other details you write into the text), the generated lyrics, songs, versions and cover art are processed and stored only on your iPhone. Morav IT has no access to them. They remain stored until you delete them in the App or remove the App. Whether they are included in your iCloud or device backup depends on your Apple settings.

  2. Apple Intelligence (Foundation Models) and Image Playground. For lyrics and cover art the App uses Apple’s on-device AI models. The App passes only the necessary information to the on-device interface. Whether and how Apple processes data is governed by Apple’s privacy information on Apple Intelligence.

  3. Translation. For translations the App uses Apple’s on-device Translation framework. iOS downloads the required language packs from Apple.

  4. Live Activity. While a song is being created, the App shows progress on the Lock Screen and in the Dynamic Island. The display is updated only on the device; no push notifications are sent via servers.

  5. Sharing and downloading. When you share a song or save it to Files, the App opens the iOS features. You decide where the file goes; the recipient you choose (such as a messenger or social network) is responsible for its own processing. The file’s metadata contains the AI marking and the Song Peak ID with creation time and App version (section 3.7).

  6. Settings. The App stores on the device whether you completed the first start, which version of the Terms of Use and this Privacy Policy you accepted and when (including the confirmation of your responsibility), and some settings. The legal basis is Art. 6(1)(b) GDPR; access to your device is strictly necessary under section 25(2) no. 2 TDDDG.

  7. Song Peak ID (proof of origin). On first start the App creates a random identifier on your iPhone, the “Song Peak ID” (for example SP-7K3M-Q9XA-2D4F). It is not derived from characteristics of your device or person (no fingerprinting) and is not the advertising ID. The App stores it in your iPhone’s keychain, for this device only and without iCloud sync; it therefore persists if you delete and reinstall the App on the same device. Every generated song stores the ID together with the creation time and App version. Every file you download or share (audio and video) contains this information in its metadata, next to the notice “AI-generated with Song Peak”. You find your ID under “Settings > Legal”.

    • Purpose: proof of the origin of generated songs (that and when a song was created with Song Peak on a particular device) and defending against, investigating and pursuing infringements, for example if a song is passed off as someone else’s work or Morav IT faces claims because of a song.
    • Legal basis: Art. 6(1)(f) GDPR. The legitimate interest of Morav IT and of users lies in proof of origin and in defending against and pursuing infringements; in addition, the information supports the marking of AI-generated content (Art. 50 AI Act). Storing the ID in the keychain is strictly necessary for the feature you use, creating and sharing marked songs (section 25(2) no. 2 TDDDG).
    • Storage location and recipients: The ID is stored only on your device. Morav IT does not receive it automatically; the App does not send it to any server. It leaves your device only in files you share or export yourself. Anyone who receives such a file (for example friends, platforms and their users) can see the ID, the creation time and the App version in the metadata. Morav IT cannot link an ID to a person unless you contact us with it yourself, for example to prove that a song is yours.
    • Retention: The ID stays in the keychain until you reset your iPhone or iOS removes the entry; in songs until you delete the song. In shared files it remains as long as the file exists; Morav IT has no influence on this.
    • Objection: You can object to the processing under Art. 21 GDPR (section 11).

Unless stated otherwise above, the legal basis for processing on the device is Art. 6(1)(b) GDPR (performance of the user agreement).

4. Advertising with Google AdMob and consent (Google UMP)

  1. In the free tier the App shows ads via Google AdMob, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). With Song Peak Plus no ads are loaded.
  2. Consent. At first start the App asks for your consent via Google’s User Messaging Platform (UMP) (under the Transparency and Consent Framework, TCF). Your choice is stored on the device and sent to Google. You can change or withdraw it at any time under “Settings > Privacy > Privacy Settings”, where Google offers the form in your country.
  3. Data processed. When loading and showing ads, Google processes in particular: IP address, device type and settings, operating system, language, approximate location derived from the IP address, app identifier, advertising identifiers (your iPhone’s advertising ID only with your permission under section 5), interactions with ads and diagnostic data of the ads SDK.
  4. Purposes. Serving ads, frequency capping, fraud prevention, ad measurement and, only with consent, personalised advertising.
  5. Legal basis. For personalised ads and access to information on your device: your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). If you decline, Google shows only non-personalised or limited ads; the legal basis for this is Morav IT's legitimate interest in funding the free tier (Art. 6(1)(f) GDPR); where information is stored on or read from your device for this, Google asks for your consent through the consent form (Section 25(1) TDDDG). Storing your consent decision is based on Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent).
  6. Third country. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, Art. 45 GDPR); standard contractual clauses apply in addition.
  7. Responsibility. Google processes the data for advertising as a separate controller under Google's Controller-Controller Data Protection Terms. More: policies.google.com/privacy and policies.google.com/technologies/partner-sites.
  8. Retention. Morav IT stores no advertising data. Your consent remains stored on the device until you change it or delete the App. Google determines how long it stores data.

5. Apple’s tracking prompt (App Tracking Transparency)

After Google’s consent prompt, iOS asks once whether the App may track you across apps and websites owned by other companies. Only if you allow it does the ads SDK receive your device’s advertising identifier (IDFA). You can revoke this at any time in iOS Settings under “Privacy & Security > Tracking”. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Apple’s SKAdNetwork, which works without a personal identifier, may also be used to measure ads.

6. Purchases via Apple (StoreKit)

You buy Song Peak Plus via Apple’s in-app purchase. Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) handles purchase and payment under its own responsibility. The App receives from Apple only the information which subscription is active and until when (transaction data) and checks this on the device. Morav IT receives no payment data. Through App Store Connect, Morav IT receives only aggregated sales and usage reports from Apple. The legal basis is Art. 6(1)(b) GDPR.

7. App Store and crash reports

Downloading the App takes place via Apple’s App Store under Apple’s responsibility. If you have agreed in iOS to share analytics with app developers, Apple provides Morav IT with anonymised crash and performance reports. The legal basis is the consent you gave to Apple or Art. 6(1)(f) GDPR (fixing errors).

8. Contact

If you email us, we process your email address, your name and the content of your message to answer your request (Art. 6(1)(b) GDPR where related to the contract, otherwise point (f)). We delete the data once the request is settled unless statutory retention obligations (e.g. under the German Commercial Code or Fiscal Code, up to 6 or 10 years) require longer storage.

9. Upcoming features

The following features are planned. This section applies only once they are available in the App; the App will then point this out and ask for consent where needed.

  1. Downloading the music models. The App downloads the AI models for songs from a server of Morav IT or its service provider Hetzner Online GmbH, data centre in Germany. IP address, time, requested file and device identifier are processed in server logs to deliver the files and prevent abuse (Art. 6(1)(b) and (f) GDPR). Logs are deleted after 7 days.
  2. Morav IT account. With a voluntary account (sign-in by email code) you can back up your profile and your own voices. Email address, display name, profile picture, interface language and, if you turn it on, backups of your voices are processed. The data are stored on an Appwrite server of Morav IT at Hetzner Online GmbH, data centre in Germany, accessible only to you and encrypted. The legal basis is Art. 6(1)(b) GDPR, for voice data section 9.3. You can delete your account completely in the App; the data are then also removed from backups within 30 days. Songs stay on your device even with an account.
  3. Your own voice. You can record (about 45 to 60 seconds) or upload a recording of your voice. From it the App learns a voice model on your iPhone so that songs are sung in your voice. Voice recordings and voice models may qualify as biometric data and thus as a special category of personal data under Art. 9 GDPR. We therefore process them only with your explicit consent (Art. 9(2)(a) GDPR), which you give separately before recording. Recording and model stay on your device; they reach Morav IT (account) only if you additionally and expressly turn on the backup. We do not use voice data to identify persons or to train general models. You can withdraw consent at any time in Settings; we then delete recording and model on the device and, if backed up, on the server. If you upload another person’s voice, you confirm that this person has expressly consented.

10. No automated decisions, no disclosure

Morav IT does not carry out automated decision-making, including profiling, under Art. 22 GDPR. Morav IT does not sell data and discloses it only to the recipients named here or where required by law.

11. Your rights

You have the right to

As Morav IT does not know the content on your device, the easiest way to exercise erasure and portability for it is yourself: delete songs in the App and export them with “Download”. For everything else, an email to info@morav-it.de is enough.

12. Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence. The authority competent for Morav IT is: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD, the data protection authority of Schleswig-Holstein), Holstenstraße 98, 24103 Kiel, Germany, mail@datenschutzzentrum.de.

13. Obligation to provide data, children

You are not obliged to provide personal data. The App works just as well without consent to personalised ads. The App is not directed at children under 16; consent from users under 16 requires the consent of their parents or guardians (Art. 8 GDPR).

14. Changes

We update this Privacy Policy when the App or the law changes. If a change requires your consent, the App shows the new version before further use.

Version 2, as of 13 October 2026.