Privacy Policy

Last updated 11 October 2026.

1. Who is responsible

The controller under the GDPR is Artur Tkachenko, trading as Climb that App, Schützenstraße 29, 83646 Bad Tölz, Germany. Email: hello@thunderyak.com. We aren’t required to appoint a data protection officer.

2. The ThunderYak app

2.1 On your iPhone and in your iCloud

The gear you add, your saved tones and favourites, and app preferences (such as hints you’ve seen) are stored on your iPhone. If you’re signed in to iCloud, your gear and saved tones sync through your private iCloud database, which Apple operates for you and we can’t read. This data doesn’t reach our server, except as described in 2.4.

2.2 Installation identifier, App Attest and DeviceCheck

When you first use features that need our server, the app creates a key with Apple’s App Attest service. Its key ID is a random identifier for this installation. Every request to our server is signed with it, so we can tell that it comes from a genuine copy of ThunderYak.

We store the key ID, its public key, a security counter and when the installation was first and last seen. We use it to stop abuse, enforce fair-use limits, count your free songs and know whether ThunderYak Pro is active. To keep the free-song count when you reinstall, we also use Apple’s DeviceCheck, which stores two bits per device at Apple; we never receive a device identifier from it.

Legal basis: Art. 6(1)(b) GDPR (providing the app you asked for) and Art. 6(1)(f) GDPR (our legitimate interest in preventing fraud and abuse and keeping the service affordable).

2.3 Searching and researching songs

When you search, your search text is sent to our server to find matching songs. We don’t store your searches.

When you open a song that hasn’t been researched yet, our server researches it. For that, we send only the song’s title, artist and recording details to Anthropic’s Claude model, which searches the web. The result is stored as shared song research, not linked to you.

Legal basis: Art. 6(1)(b) GDPR.

2.4 Settings for your gear

When you ask for your settings, the app sends the song and your current rig (guitar, amp, pedals or multi-effects, as catalogue entries) to our server. Our server sends the song’s research and your rig to OpenAI to generate the settings, without your installation identifier or any other identifier. OpenAI is instructed not to store the request (store: false) and may keep it for up to 30 days only to detect abuse.

The settings are cached on our server for that song and that combination of gear, so the next guitarist with the same rig gets them instantly. The cache isn’t linked to you.

Legal basis: Art. 6(1)(b) GDPR.

2.5 Free songs, limits and ThunderYak Pro

Linked to your installation identifier, we store how many research and settings requests you started each day, how many free songs you’ve used and which songs they were (so opening the same song again stays free).

ThunderYak Pro is bought through Apple. We use RevenueCat to manage subscriptions: the app gives RevenueCat your installation identifier as an anonymous customer ID, and RevenueCat receives your purchase information from Apple. We store only whether Pro is active and until when. We never see your name, Apple Account or payment details.

Legal basis: Art. 6(1)(b) GDPR.

2.6 Notifications

If you allow notifications, the app sends us its push token so we can tell you when research or settings you asked for are ready. While you wait, we store which song you’re waiting for, for at most one day. Apple’s Push Notification service delivers the message. The trial reminder before a free trial ends is scheduled on your iPhone and doesn’t involve our server.

Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw it anytime in your iPhone’s Settings under Notifications.

2.7 Cover art

Your iPhone loads album covers directly from the Cover Art Archive, run by MetaBrainz and the Internet Archive, which therefore receive your IP address.

Legal basis: Art. 6(1)(f) GDPR (showing songs recognisably without running our own image service).

2.8 Links

Links to sources, Songsterr or YouTube open in your browser only when you tap them. Those sites’ own privacy policies apply.

2.9 What we don’t do

No advertising, no tracking across apps or websites, no analytics or crash-reporting tools, and no sale of data.

3. This website

3.1 Hosting and server logs

This website is hosted on Cloudflare Pages. When you visit thunderyak.com, Cloudflare processes your IP address, the time, the page requested and your browser’s user agent to deliver the page and protect it against attacks. We don’t keep access logs ourselves. Legal basis: Art. 6(1)(f) GDPR (delivering a secure website).

3.2 Contact form and email

If you use the contact form, we store your email address, your name if you give it, the topic and your message on our server, and send them to our support inbox through Resend, with your address as the reply address. We don’t store your IP address. Messages are deleted automatically 12 months after you send them. If you email us directly, your email stays in our mailbox for as long as we need it to help you. Legal basis: Art. 6(1)(b) GDPR for questions about the app, otherwise Art. 6(1)(f) GDPR (answering the people who write to us).

3.3 No cookies

This website sets no cookies and loads no external fonts, scripts or trackers.

4. Who processes data for us

We work with these providers, bound by data processing agreements where the GDPR requires them:

The Cover Art Archive (see 2.7) isn’t our processor; it receives your IP address as an independent service.

5. Transfers outside the EU

Some providers are in the USA. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers rely on the European Commission’s adequacy decision (Art. 45 GDPR); otherwise on the Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy.

6. How long we keep data

Our server deletes these automatically once a day:

• Installation record, the free songs it used and its push token: 12 months after the app last contacted us.
• Daily usage counts: after 30 days.
• Pro status: 12 months after Pro ends (a lifetime purchase is kept).
• Push token: when Apple reports it invalid, or after 12 months without use. The song you’re waiting for: after one day.
• Contact form messages: 12 months after you send them.

Apple keeps DeviceCheck’s two bits for your device under Apple’s own terms. Shared song research and cached settings contain no personal data and are kept.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). Where we rely on consent, you can withdraw it at any time with effect for the future.

Right to object (Art. 21 GDPR): where we process data based on legitimate interests, you can object at any time for reasons arising from your particular situation.

ThunderYak has no accounts, and our server holds nothing that tells us which installation is yours. Under Art. 11 GDPR we therefore can’t find, hand over or delete the records of one particular installation on request, unless you give us information that lets us identify them. Your gear and saved tones are on your iPhone and in your iCloud, where you can see and delete them yourself. Deleting the app removes its installation key, so nothing left on our server can be linked to you, and those records are deleted on the schedule in section 6.

To use your rights, write to hello@thunderyak.com or use the contact form with the topic Privacy request.

You can also complain to a data protection authority, for example ours: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Children

ThunderYak isn’t directed at children under 16.

9. Changes

We’ll update this policy when ThunderYak changes. The date at the top shows the current version.