Privacy Policy

Hitify respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your data when you use our service.

The controller of your personal data is Klappe Development (trading as Hitify), owned by Dennis Klappe, Boersenserf 10, 3871RK Hoevelaken, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 71434577. Contact for anything about privacy: dennis@hitify.app.

We collect the following data: • Spotify account information (name, email) when you connect to Spotify • Email address when creating a pack (optional) • Usage data such as scanned cards and created packs • Technical data such as browser type and IP address

When you upload a photo for personalized cards, it is securely stored on our protected servers. Your photos are used exclusively for processing your order and generating your cards. Photos are not shared with third parties and are only accessible for order fulfillment.

We use your data for: • Providing our service (creating packs, scanning cards) • Improving our service • Communication about your orders • Preventing abuse

When you connect to Spotify, we gain access to your public profile and playlists. We do not store Spotify passwords and have no access to your Spotify account other than what is necessary for importing playlists. You can revoke this access at any time through your Spotify account settings.

We use Google Analytics 4 (GA4) to analyze website usage. GA4 collects anonymized data about your visit, such as pages viewed, session duration, and language preferences. This information helps us improve the website. You can decline analytics cookies via our cookie banner or your browser settings.

We use functional cookies that are necessary for the website to function. These cookies remember your session and preferences. We also use analytical cookies (Google Analytics) for website analysis. See our cookie policy for more details.

We do not share your data with third parties, except when necessary to provide our service (e.g., payment processors) or when legally required.

We take appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse.

You have the right to: • Request access to your personal data • Request correction of inaccurate data • Request deletion of your data • Object to processing of your data Contact us at dennis@hitify.app for privacy-related questions.

The Hitify scanner apps for iPhone, iPad and Android need no account, no login and no purchase. When you scan a card, the app sends the following to hitify.app: • the code printed in the card's QR code (for a QR code we do not recognise, the text of that code) • the language you chose in the app • a random scan session ID: a random number generated on your device when you first open the app. It is not your advertising ID, not a hardware ID and not linked to your name or email address • the app version, device type and operating system version (in the user agent) Our server also sees your IP address, as every server does. We use this data to find the song or party card, to count which kinds of cards are scanned and from which country, to limit the number of requests, and to prevent automated copying of our card database. The camera is used only on your device to read the QR code. No camera image is stored or sent to us. The apps contain no analytics or advertising SDKs, do not use an advertising ID, do not track you across other apps or websites, and we do not sell data. Song previews: our server looks up where a short preview of the song can be found. Your phone then streams the preview from the music service you chose in the settings (Spotify, Tidal, Apple Music or Deezer). That service can see your IP address, as with any stream. If you choose Apple Music, the app asks for access to Apple Music and plays through MusicKit with your own subscription, under Apple's terms and privacy policy. If you send an appeal from the app after a temporary block, we receive the email address and the message you type, and we use them only to answer you.

• Scan record (type of card, device class, operating system, country): kept for statistics, with no IP-based identifier once the next item has been removed • Keyed hash of your IP address on the scan record: deleted after 90 days • Short-lived request counters that contain your IP address or scan session ID: between 60 seconds and 24 hours • Temporary block after an unusually high number of different cards scanned in one hour (this stores your plain IP address, user agent and country, and your appeal if you send one): the block lasts 24 hours and the record is deleted after 30 days by an automated job • Text of a QR code we do not recognise: sent to us by email without your IP address or scan session ID, and kept in our mailbox until we have dealt with it The legal basis is our legitimate interest in running and protecting the service (GDPR article 6(1)(f)); for an appeal it is your request. Our service providers Cloudflare (hosting and network) and EmailIt (email delivery) process data on our behalf.

The apps have no accounts, so there is nothing to sign in to or delete in the app itself. Deleting the app removes the scan session ID from your device. Because the scan session ID is random and not linked to your identity, we may ask you for the approximate time of your scan to find a record. You have the right to access, correct and delete your personal data, to restrict or object to processing, and to data portability. Send your request to dennis@hitify.app. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your own country.

We may update this privacy policy from time to time. The most recent version is always available on this page.