Privacy Policy

Controller

HMZ craftsmanship GmbH
Zurich, Switzerland
Contact: bedo@hmz.swiss

What we collect

Nothing on its own. We do not run servers for the app and receive no data from you. No analytics, advertising or crash-reporting services are built in. Data only reaches us if you request beta access yourself (see below).

What stays on your device

• Settings such as skin, tape effects and the selected music source.
• If you connect Spotify: the access tokens for your Spotify account.
• Your phone's device name is read locally only, to recognise it in the Spotify device list.
• The hinge sensor is evaluated locally only, to detect whether the device is folded or unfolded.
• If you allow the MP3 jack access to music and audio: titles, artists, albums and covers of your music files. They are only read and played on the device, never uploaded or transmitted to us or third parties.

You can delete this data by clearing the app data in Android settings or by uninstalling the app (on the iPhone: by deleting the app).

Spotify (optional)

If you choose the “Spotify” source, you sign in directly with Spotify (Spotify AB, Sweden). The app then talks directly from your device to the Spotify API to show your playlists and albums, control playback, read the current track and its cover, and set the volume. Spotify's privacy policy applies. We do not see this data. You can revoke access at any time under “Apps” in your Spotify account.

Without Spotify, the app plays built-in demo tapes; no data is transmitted for that.

YouTube Music (optional)

If you choose the "YT MUSIC" source, you sign in with your Google account (Google LLC / Google Ireland Ltd.). The app requests a single, read-only permission: https://www.googleapis.com/auth/youtube.readonly. It never writes, changes or deletes anything in your Google or YouTube account.

• Data accessed: the list of your own YouTube playlists (including "Liked Music") with their title, thumbnail image and number of songs, and the video IDs of the songs in a playlist you insert. The app reads this through the YouTube Data API v3 (playlists.list with mine=true and playlistItems.list). No other Google user data (such as e-mail, contacts or watch history) is accessed. We do not create aggregated or anonymised data from it.
• Data use: solely to show your playlists as cassettes on the shelf and to start the inserted playlist in the official YouTube Music app. It is not used for advertising, analytics, profiling, credit or lending decisions, or to train AI/ML models.
• Data transfer: the data travels only between your device and Google. It is not sent to HMZ (we run no servers for the app) and is not shared with, sold to or transferred to any third party, advertiser or data broker.
• Data protection: all requests use encrypted HTTPS connections to Google. Sign-in runs through Google's own authorisation screen on Android; the app never sees your Google password. The access token is managed by Google Play services and held only in the app's memory while it runs.
• Retention and deletion: playlist data is kept only in the app's memory and is discarded when the app is closed. On the device the app stores only a flag that you are connected. Choosing "Disconnect YouTube Music" in the app menu removes the access token from the app and deletes this flag. To revoke the permission at Google itself, go tomyaccount.google.com/connections, or remove everything by clearing the app data or uninstalling the app. To ask about your data, write tobedo@hmz.swiss.

The app uses YouTube API Services. The YouTube Terms of Serviceand the Google Privacy Policy apply. The app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Requesting beta access (optional)

If you tap “Request beta access”, the app opens your own mail app with a prepared message to bedo@hmz.swiss. It contains the email address of your Spotify or Google account, which you enter yourself, the requested service, device model, Android version, app version and language. Nothing is sent until you tap send in your mail app. We only use this information to approve your account with Spotify or Google for the beta and to reply to you, and delete it when the beta ends or on request.

iPhone version (App Store)

The iPhone app follows the same principles: no account with us, no ads, no analytics, no tracking, and no data is sent to us. In detail:

• Apple Music (optional): if you connect Apple Music, iOS asks for access to your media library. The app then reads the names and artwork of your playlists and albums via Apple's MusicKit and plays them with the system music player. This happens between your device and Apple; Apple's privacy policy applies. We receive none of this data. You can revoke access at any time in iOS Settings › Privacy & Security › Media & Apple Music.
• Your own music: audio files you place in the app's folder (Files app › On My iPhone › Bionic Tape) or import are read and played on the device only. Titles, artists and covers are read from the files and cached locally; nothing is uploaded.
• Volume wheel: sets the iPhone's system volume locally.
• Hinge (iPhone Duo): evaluated locally only, to detect whether the device is folded or unfolded.
• Settings such as skin and tape effects are stored on the device only.
• Purchase: the app is sold through the App Store. Payment is handled entirely by Apple; we only receive anonymous, aggregated sales reports from Apple.

The iPhone app requests no permissions other than access to your media library (only if you connect Apple Music). You can delete all data by deleting the app.

Feedback, beta programme and waitlist (optional)

You can send us feedback, join the beta programme (for example via TestFlight) or sign up for the waitlist and news about updates and new services. This is always voluntary and only happens if you actively do it – for example by writing an email from the app or our website or by entering your email address.

We then process your email address, your message and, if you send it from the app, technical details such as device model, operating system and app version. We use this only to answer your feedback, to invite you to the beta programme and to inform you about Bionic Tape updates. We do not pass the data on to third parties and do not use it for advertising. You can unsubscribe at any time with a short email tobedo@hmz.swiss or via the link in our emails; we then delete your data. If you take part in TestFlight, Apple's TestFlight terms and privacy policy also apply.

Permissions (Android)

Internet (for Spotify and cover images) and vibration (for the feel of the keys). For the PLAYER jack you can additionally grant notification access: Android only lets apps control other players' media through it. Bionic Tape uses it solely to read which track is playing in which player and to send play/pause/skip. The content of your notifications is never read, stored or transmitted; you can revoke the access at any time in Android settings. For the MP3 jack you can grant access to music and audio (up to Android 12: storage access); the app uses it only to read and play your music files. For playback in the background it uses a media foreground service with a notification. The app does not use any other permissions such as location, contacts, microphone or camera.

Security

The connections to Spotify and Google are encrypted (HTTPS). Sign-in uses the standard OAuth flow with PKCE; you only ever enter your Spotify password at Spotify.

Children

The app is not specifically aimed at children and does not collect data from children.

Your rights

You have the statutory rights of access, rectification, erasure, restriction, data portability and objection. Since we hold no data about you, you can delete it directly on your device. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the competent authority in the EU.

Changes

If the app changes, we will update this policy. The date at the top applies.