In short
We are the controller within the meaning of the EU General Data Protection Regulation (GDPR) for the processing described here. We have not appointed a data protection officer because we are not legally required to do so.
Tubzer is an alarm clock for Android that plays a YouTube video of your choice when the alarm goes off. It can also suggest videos to wake up to, based on interests you pick and on how you rate videos you have heard. Those suggestions are generated with the help of an AI model and the YouTube search.
We built Tubzer so that it works without any account. We deliberately do not collect names, e-mail addresses, phone numbers, contacts, precise or approximate location, photos, or anything else that identifies you as a person. We only process what the app needs to work and to show the shared statistics that are part of the product. Where we have a choice, we choose the option that stores less.
When you first open Tubzer, the app generates a random user ID (a short string of letters and digits). You can change it later in the app. Please do not use your real name or anything else that identifies you, because the user ID can be shown to other users in a few places (see section 4).
Together with the user ID, the app sends the Android ID of your device (Settings.Secure.ANDROID_ID). On modern Android versions this value is specific to the combination of your device, the app and its signing key, and it is reset when the device is factory-reset. We use it only to recognise your installation again (for example to restore your credits) and to detect abuse. We do not combine it with any other data source, and we cannot derive your identity from it.
To authenticate requests, the app receives an access token from our server that is bound to your user ID. The token is stored on your device.
Purpose: providing the service without an account, keeping your credits and settings, preventing abuse. Legal basis: Art. 6(1)(b) GDPR (performance of the contract with you, i.e. providing the app) and Art. 6(1)(f) GDPR (our legitimate interest in preventing abuse).
Our server stores your credit balance (credits are used for AI-assisted video searches), the interest topics you select in the app (for example "music" or "motivation") and, if you use the "Tubot AI" feature, the prompt state you configured for it. All of this is linked to your user ID only.
Purpose: providing the features you use. Legal basis: Art. 6(1)(b) GDPR.
When an alarm plays, the app reports the event to our server. One event consists of: your user ID, the YouTube video (ID, title, channel name, view count), whether the video was chosen by you or suggested by Tubot AI, the time, the calendar date on your device, your device time zone (for example Europe/Berlin), the country code of the mobile network your phone is registered to (for example de) and your system language (for example de-DE).
The time zone, network country and language are read from the device settings. They do not involve GPS, Wi-Fi scanning or your IP address, they require no Android permission, and they locate you only at country level. We use them to draw the alarm world map (see section 4) and to understand where and when Tubzer is used.
We also record when you leave the alarm screen and how (for example "stopped" or "snoozed"), so we can improve the alarm experience.
Purpose: the community features of Tubzer (statistics, top videos, streaks, world map), video suggestions, understanding usage and improving the app. Legal basis: Art. 6(1)(b) GDPR for the community features that are part of the product, and Art. 6(1)(f) GDPR (our legitimate interest in understanding and improving the service). You can object to the processing based on legitimate interest at any time (see section 9).
Tubzer finds wake-up videos for you in three ways, all of which go through our server:
For the AI step we use the API of OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, and OpenAI, L.L.C., San Francisco, USA). We send OpenAI only the text that is needed to produce search queries: the topic, the rating and video title, or your prompt. We do not send your user ID, device identifier, IP address or any other data about you. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models. Please do not include personal information about yourself or others in prompts.
For the search step we use the YouTube Data API provided by Google. The search is performed by our server with our own API key; your identifiers are not part of the request. Tubzer does not access your YouTube or Google account and does not request any authorisation from it.
Our server keeps a record of the topic searches (topic, number of results, time, your user ID) and of the prompts you set. The topics people search for are aggregated to improve the suggestions for everyone.
Purpose: providing the suggestion features. Legal basis: Art. 6(1)(b) GDPR.
When you set a YouTube link as an alarm or submit a link through the app, the video ID and title are stored with your user ID on our server. Submissions are limited to a small number per day to prevent abuse. Legal basis: Art. 6(1)(b) GDPR.
The alarm sound is a YouTube video that is played inside the app with an embedded YouTube player (an android-youtube-player web view that loads YouTube's IFrame player). When a video plays, your device connects directly to YouTube / Google, and Google receives the data that any visit to YouTube transmits: your IP address, device and browser information, the video you play and the time. Google may set cookies in the app's web view and may use this data in accordance with its own privacy policy, including for its own purposes. Video thumbnails shown in the app are likewise loaded directly from Google's servers.
Tubzer uses YouTube API Services. By using Tubzer you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EEA, Switzerland and the UK) and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Purpose: playing the video you chose as an alarm, which is the core function of the app. Legal basis: Art. 6(1)(b) GDPR. The direct connection to Google is technically necessary to play the video.
Tubzer shows no advertising during normal use. The only ads are rewarded video ads that you can voluntarily watch to receive extra credits when your credits are used up. Nothing is shown unless you tap the "watch a video" button.
Ads are delivered by Google AdMob (Google Ireland Limited / Google LLC, see above). The AdMob software is part of the app and is initialised when the app starts. When an ad is requested, Google receives your IP address, device information (model, operating system, language, screen), app identifier, and the advertising ID of your device, and may use this data to select, deliver and measure ads and to detect fraud. Depending on your region and your choices, Google may use the advertising ID to personalise ads across apps.
You control this: in Android settings under Privacy › Ads you can delete or reset your advertising ID and opt out of ad personalisation. In the EEA, the UK and Switzerland, personalised advertising requires your consent; where no consent has been given, only non-personalised ads may be shown. Google's use of ad data is described at policies.google.com/technologies/ads.
We ourselves receive no personal data from the ad. The app only learns that the ad was completed and then credits your balance.
Purpose: financing the free use of the app; giving you a way to obtain credits without paying. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, expressed by choosing to watch an ad; for the technical initialisation of the ad component, Art. 6(1)(f) GDPR.
You can buy credits inside the app. Purchases are processed entirely by Google Play under Google's terms and privacy policy. Google handles your payment details, invoicing and refunds. We do not receive your name, address, e-mail address or payment information. Our server only receives the updated credit balance for your user ID. If you buy credits, your user ID is added to a list of supporters that can be displayed in the app (see section 4).
Legal basis: Art. 6(1)(b) GDPR.
From time to time the app may ask whether you would like to rate it. This dialog is provided by Google Play (In-App Review API) and handled by Google under its privacy policy. We do not see your rating other than as part of the public Play Store reviews.
Whenever the app talks to our server, your device transmits its IP address. The IP address is needed to deliver the response and is used in memory to limit the number of requests per address (protection against abuse). Our server software writes technical logs for troubleshooting and security; these can contain the IP address, the request path, the time, a technical user-agent string and the user ID. We do not use IP addresses to determine your location and we do not store them with your alarm data. Logs are kept only as long as they are needed for security analysis and troubleshooting and are then deleted.
Our server is a virtual machine rented from netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, and is located in a data centre in the European Union. netcup acts as our processor on the basis of a data processing agreement and has no access to the data stored in our database for its own purposes. We make compressed database backups once a month, stored on the same server; backup copies are kept for a limited period (currently up to twelve months) and are used only to restore the service.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in operating a secure and reliable service) and Art. 32 GDPR.
Tubzer requests a number of Android permissions that are needed to behave like an alarm clock, not to collect data about you: scheduling exact alarms, showing the alarm over the lock screen, running as a foreground service and keeping the device awake while the alarm rings, vibrating, playing media, starting after a reboot, posting notifications, asking to be excluded from battery optimisation, and network access. None of these grant us access to your location, contacts, files, microphone, camera or call data. The app also declares the AD_ID permission, which is required by Google for the rewarded ads described in section 3.7.
Your alarms, alarm settings, theme, a local copy of your credit balance, the access token, the videos you picked and similar settings are stored locally on your phone and are removed when you uninstall the app or clear its data.
Part of Tubzer is a shared, anonymous picture of what the community wakes up to. The following is visible to other users of the app and to visitors of our website:
Because video titles are public and are not linked to a person, a video you chose can appear in these lists.
Our website is a set of static pages served from the same server described in section 3.10 (netcup, EU). When you visit, your browser transmits the usual connection data (IP address, requested page, time, browser information). The web server processes this data to deliver the page; it does not keep an access log for tubzerapp.de.
i.ytimg.com). When these images load, Google receives your IP address and browser information. The statistics and map data themselves come from our own server.Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in providing a website securely and in measuring the reach of our own links).
We share data only with the service providers needed to run Tubzer, and only to the extent described above:
| Recipient | Role | Location and safeguard |
|---|---|---|
| Google (Google Ireland Ltd. / Google LLC) | YouTube player and thumbnails, YouTube Data API, AdMob rewarded ads, Google Play distribution, billing and in-app review | Ireland and USA. Google LLC is certified under the EU-US Data Privacy Framework; Google also offers EU standard contractual clauses. |
| OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.) | Turning topics, ratings and prompts into search queries | Ireland and USA. Only non-identifying text is sent. Transfers are covered by EU standard contractual clauses in OpenAI's data processing addendum. |
| netcup GmbH | Hosting of server, database and website | Germany / EU, data processing agreement. |
We do not sell personal data and we do not share it with data brokers or advertising networks beyond the rewarded-ad case you choose yourself. We disclose data to authorities only where we are legally obliged to.
| Data | Retention |
|---|---|
| User ID, device identifier, credits, interests, Tubot prompt state | Until you ask us to delete them (see Delete your data). Records of installations that have shown no activity for 24 months are deleted in periodic clean-ups. |
| Alarm events, topic searches, submitted links | Kept for the statistics; deleted together with your user ID on request. Aggregated statistics that no longer contain any user ID may be kept. |
| Server logs containing IP addresses | Only as long as needed for security and troubleshooting, then deleted. |
| Database backups | Up to twelve months, then deleted. Data removed from the live database disappears from backups when those backups expire. |
| Data held by Google and OpenAI | According to their own policies; we have no control over it. |
Under the GDPR you have the right to access the personal data we hold about you, to have it rectified or erased, to have its processing restricted, to receive it in a portable format (data portability), to object to processing that is based on our legitimate interests, and to withdraw consent at any time with effect for the future.
Because we do not know who you are, we can only act on a request if you tell us your user ID (shown in the app). This is the only way for us to find your data; we will not ask you for anything else and we will not be able to identify you from your name or e-mail address alone (Art. 11 GDPR). See Delete your data for the simplest way to request deletion.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany, www.datenschutz.sachsen.de. You may also contact the authority of your place of residence.
Tubzer is not directed at children under 16. We do not knowingly process personal data of children, and the app does not ask for any information that would reveal a user's age. If you believe a child has used Tubzer and you want the related records removed, contact us with the user ID and we will delete them.
All communication between the app, the website and our server is encrypted (HTTPS). Access to the server and database is restricted to the controller. Requests to the server are authenticated with signed tokens and rate-limited. No method of transmission or storage is completely secure, which is one more reason why we keep the data we hold to a minimum.
We will update this policy when the app or the law changes. The current version is always available at tubzerapp.de/legal/privacy/ and the date at the top tells you when it was last changed. If a change materially affects how your data is used, we will point it out in the app.
Questions about privacy, requests to access or delete data, or anything else: support@tubzer.de. Postal address: see section 1 or the imprint.