Privacy Policy

This Privacy Policy explains how Tim Langner, trading as Timedia (“we,” “us,” or “our”), collects, uses, and shares personal data when you use Cellar, our marketing website at https://cellar.fm, related download services (including api.cellar.fm), optional tips, and the Cellar applications for macOS, Windows, Linux, Android, and iOS (together, the “Services”).

Cellar is a client for YouTube Music. It is an independent product and is not affiliated with, or endorsed by, YouTube or Google.

Cellar is free to download and use.

Controller (GDPR / German BDSG)

We do not appoint a separate Data Protection Officer because we are not required to under Art. 37 GDPR.

1. Scope

This policy covers personal data we process as controller. It does not cover Google’s or YouTube’s processing of your YouTube / Google account. When you sign in to YouTube Music inside Cellar, that authentication is with Google; Google’s terms and privacy policy apply to that relationship.

2. Categories of data we process

2.1 Data we typically do not collect

• We do not run a Cellar user-account system that stores your Google password.
• Card / payment numbers never hit our API. Optional tip checkout is handled by Ko-fi, and Patreon pledges by Patreon (see below).
• YouTube Music / Google sign-in credentials primarily remain on your device (and with Google). A minimized subset of session material may be sent to api.cellar.fm solely to resolve playable streams, as described in section 2.5.
• Our pseudonymous app usage statistics (section 2.6) never contain what you play or search for, which playlists, artists or albums you open, or your YouTube account, handle or email address.
• Our error reports (section 2.7) never contain your account, YouTube identifiers, or what you play or search for.

2.2 Optional tips

If you choose to support Cellar (for example by buying a coffee), checkout is handled by Ko-fi at https://ko-fi.com/cellarfm. Ko-fi processes payment details under its own terms and privacy policy. We may receive what we need to thank you and keep accounts, typically including:

• Name or display name, if you provide one
• Email address, if Ko-fi shares it with us
• Tip amount, currency, timestamps, and a supporter message
• Limited payment metadata Ko-fi shares with creators (not full card numbers)

Tips are voluntary. They are not required to use Cellar.

2.3 Support communications

If you email us (e.g. support@cellar.fm), we process the content of your message, your email address, and any attachments you send.

2.4 Website / hosting data

The marketing site is largely static. Hosting / CDN providers (e.g. Vercel or equivalent) may automatically process technical logs such as IP address, user-agent, referrer, timestamps, and request paths, for security, abuse prevention, and reliability.

We also measure how the site is used with Umami, an open-source analytics tool that we host ourselves at stats.cellar.fm on a Hetzner server in Falkenstein, Germany. It sets no cookies, stores nothing on your device, and does not track you across other sites. Your IP address is processed in memory to look up your approximate location (country, region and city, using a database on our own server) and to compute a pseudonymous visitor ID from a salted hash, with a salt that rotates monthly. The IP address is not stored. Umami stores individual events linked to that visitor ID: the page address (including campaign parameters such as UTM tags) and page title, the referrer, browser, operating system, device type, screen size and language, your approximate location (country, region and city), and clicks on Download and Buy me a coffee. We look at the data only as aggregate statistics. See also the Cookie Policy.

2.5 Apps and api.cellar.fm

The Cellar applications talk to api.cellar.fm (our stream-resolution API). Depending on the feature you use, the app may send:

• A minimized set of YouTube Music session cookies / auth headers needed to resolve playable stream URLs
• Technical request metadata that appears in server logs (for example IP address, user-agent, and timestamps)

Purposes: provide playback, prevent abuse, and operate the API. We do not use YouTube session material to build advertising profiles. Payment card data never hits api.cellar.fm; cards for optional tips are processed only by Ko-fi.

To play a track, our server contacts YouTube and Google on your behalf and, when your app sends them, uses your session cookies for that request, so that YouTube treats it as your account. Those requests leave our server through Cloudflare WARP, so YouTube sees a Cloudflare address instead of our server’s. Cloudflare carries that traffic encrypted towards Google and can see connection metadata, such as which Google hosts are contacted. The cookies are kept in memory only, for at most ten minutes per session, and are never written to a log.

2.6 App usage analytics

The Cellar apps send pseudonymous usage statistics to the same self-hosted Umami that we use for the website, at stats.cellar.fm on a Hetzner server in Falkenstein, Germany. This is on by default. You can turn it off at any time in Settings ▸ Privacy ▸ Share anonymous usage stats.

The apps send:

• which screens you open and which features you use
• the number of plays and your listening time, in steps of 5 minutes
• the app version, your operating system and its version, the device type, your language and region setting, and your screen size
• whether your YouTube Music account is a free or a premium account (or unknown), as the stream API reports it
• your approximate location (country, region and city), looked up from your IP address in memory

The apps never send what you play or search for, which playlists, artists or albums you open, or your YouTube account, handle or email address.

To count one installation across launches without knowing who you are, the app creates a random install ID and keeps it until you turn the setting off. Turning it off stops all sending and replaces that ID with a new random one, so nothing links your earlier statistics to you afterwards. The IP address is used in memory only and is not stored. Versions of the apps run by the developers from source code, and internal development builds, send nothing.

The legal basis is our legitimate interest in understanding how the apps are used and which features to improve (Art. 6(1)(f) GDPR). You can object at any time by turning the setting off. The data stays on our own server and is not passed to any other recipient. Events older than 25 months are deleted. An installation's technical details (app version, operating system, device type, language and region setting, screen size, approximate location and install ID) are kept while that installation keeps sending statistics, and deleted once its last event is older than 25 months. Encrypted backups of our server, kept on Hetzner storage in Germany, may hold deleted data for up to 12 more months.

2.7 Error reports

The Cellar apps always send crash and error reports to our own server at api.cellar.fm on a Hetzner server in Falkenstein, Germany. A report is sent automatically when the app crashes or hits an error. Sending is not affected by the usage stats setting in section 2.6.

A report contains:

• the app version, your operating system and its version, and the device type
• whether your YouTube Music account is free, premium or unknown
• the error type and its message, with identifiers removed
• the code locations involved
• which part of the app was involved, for example the player or sync
• the type of network you were on (Wi-Fi, cellular or offline)
• the server request ID, if a request to our server failed
• how many times the error happened, and when
• the last lines of the app's own log, with identifiers removed
• a random ID that is new on every launch of the app

Reports are never sent with your account, YouTube identifiers, or what you play or search for. Reports are not linked to your account or to the install ID from section 2.6. The one exception is a bug report you send from the same app launch (see section 2.10): it carries that launch’s random ID and, if you leave Your account name on, your account name, which lets us connect the two. It never carries the install ID. Your IP address is used only in memory to limit how many reports one device can send, and is never stored with the report.

When an error is new, comes back, or happens much more often, our server posts a short alert to a private channel on Discord (Discord Inc., USA). The alert contains the error type, its message with identifiers removed, the code locations, the app versions and how many times it happened. It never contains the app's log lines.

Versions of the apps run by the developers from source code send nothing.

The legal basis is our legitimate interest in keeping the apps working (Art. 6(1)(f) GDPR). Reports on our server are kept for 90 days and then deleted. Encrypted backups of our server, kept on Hetzner storage in Germany, may hold deleted reports for up to 12 more months. Alerts in Discord are kept until we delete them there.

2.8 Applications (local)

The Cellar apps may also store locally on your device: preferences, offline downloads you choose to save, and session-related data needed to talk to YouTube Music. On Android that session material is kept in encrypted on-device storage. Local data stays on your device except for the limited api.cellar.fm traffic described above, or when you voluntarily send material to us (e.g. in a support email).

Android may show a playback notification while a track is playing, and optional voice search uses the system speech recognizer (Cellar does not record microphone audio itself).

2.9 Data kept on api.cellar.fm for synced features

Some features need our server to keep data for your account so that your devices stay in step. Depending on what you use, api.cellar.fm holds:

• Listening history: the tracks you played (title, artist, album, YouTube video ID), when, and for how long
• Resume: your queue, the current track and position, so a second device can pick up where you stopped
• Social: if you use friends, your public YouTube Music name, handle and picture, your friends and requests, what you are listening to now, shares, reactions, listening-party data, your anthem and badges
• Release Radar: the artists you follow and the releases found for them
• Pins and playlist folders
• Library Recents: when you last played or opened playlists, albums, artists and folders (up to the most recent 1000), so your Library is in the same order on every device
• Last.fm and Libre.fm links: if you connect them, the session key the service gave us and the account name
• Sign-in tokens: tokens our server issues to your app so that only your app can read and change your data. They are not your Google credentials.

This data is stored under an account key that is derived from your YouTube handle or channel ID by a one-way hash. api.cellar.fm does not store your Google email address for these features (a bug report you send does include it, see section 2.10). The key is not your name, but it is a stable identifier, so we treat all of it as personal data.

If you connect Last.fm or Libre.fm, our server sends the track you are playing (title, artist, album, length) and play times to that service as now playing and scrobbles. See their own privacy policies.

Retention of synced data: your listening history and the other data in this section are kept until you delete them. We may set a fixed maximum period for old listening history. If we do, we will state it here before it takes effect.

2.10 Bug reports

If you use Report a bug or Report a problem in an app, the report goes to our server and from there into a private Notion workspace (Notion Labs, Inc., USA). You see what is attached on the last step and choose whether to send it.

A report contains:

• what you wrote: what happened, the steps, the kind of problem, when it happened and how often
• the app version, your operating system and its version, and the device model
• a snapshot of the app and device at that moment: the type of network you were on, the screen you were on, your playback settings, which integrations are connected, whether your YouTube Music account is free or premium, and basics such as language, free storage and battery saver
• the song that was playing and your queue, if something played in the last 10 minutes. You can switch this off on the last step.
• the IDs, paths, status codes and timings of the last requests the app made to our server, and the types of the last errors the app hit
• a random ID for that app launch, which lets us find the automatic error reports from the same launch (section 2.7)
• the app’s own local log, the whole file and not only the last lines, with session secrets removed. The log includes the IDs of the songs the app played or loaded in the time it covers, also when Now playing and queue is switched off.
• a screenshot of the app, taken when you open the reporter, and any others you add. You can remove each one before sending.
• if you were signed in and leave Your account name on, your YouTube name, handle and email address as the app knows them. Switching it off sends no name, handle or email address. A report made while signed out contains none of those account details.

Reports are kept until we delete them. We use an AI assistant (Anthropic, USA) to help read and triage reports: the content of a report is sent to Anthropic for that purpose, and the assistant may read the attached log and screenshots. The legal basis is our legitimate interest in fixing faults (Art. 6(1)(f) GDPR).

2.11 Patreon early access (mobile apps)

Before they are public, the iOS and Android apps are available to supporters on Patreon (Patreon, Inc., USA). Patreon handles your pledge and payment under its own terms and privacy policy. It may share with us, as it does with every creator, what is needed to run a membership, such as your membership status and tier, and your name and email address if Patreon provides them. The apps and Cellar’s server do not receive anything from Patreon about you.

On iPhone the app is installed with SideStore, which runs on your device. You sign in to Patreon inside SideStore so that it can show you the app. Cellar’s server does not receive your Patreon login, and SideStore’s own handling of your Apple ID and Patreon account is covered by its terms and by Apple’s and Patreon’s. On Android the file is attached to a Patreon post.

Each request an app makes to api.cellar.fm names the app, its version and how it was installed (for example SideStore or Patreon), so that we can retire builds that are too old.

2.12 Cookies

See the Cookie Policy.

3. Purposes and legal bases (GDPR Art. 6)

We do not sell your personal information, and we do not use YouTube Music session material for advertising profiles.

4. Processors and recipients

• Ko-fi: optional tip checkout (card data stays with Ko-fi / its payment partners)
• Patreon (Patreon, Inc., USA): pledges and early access to the mobile apps (section 2.11)
• Notion (Notion Labs, Inc., USA): bug reports you send (section 2.10)
• Anthropic (USA): AI-assisted triage of bug reports (section 2.10)
• Cloudflare (Cloudflare, Inc., USA): WARP, through which our server’s requests to YouTube and Google leave (section 2.5)
• Google / YouTube: our server makes requests to YouTube and Google for playback and library data, using your session cookies when your app sends them (section 2.5). Google acts under its own privacy policy.
• Last.fm and Libre.fm: only if you connect them, to record what you play (section 2.9)
• Hetzner Cloud: infrastructure hosting for api.cellar.fm (including app error reports) and for our self-hosted Umami website and app usage analytics at stats.cellar.fm, plus encrypted backups of that server on Hetzner storage in Germany
• Discord (Discord Inc., USA): a private channel that receives short alerts about app errors
• Vercel (or equivalent): hosting / CDN for the marketing site at https://cellar.fm
• GitHub: desktop downloads and update manifests from the public releases repository

Website and app usage analytics data stays on our own server and in its encrypted backups on Hetzner storage in Germany, and is not passed to any other recipient. Error reports stay there too; only the short alerts described in section 2.7 go to Discord.

If you connect Discord on a phone, Cellar sends the track you are playing to Discord to show it in your Discord status. This goes from your phone to Discord directly; our resolver is not involved. You can disconnect in Settings or at discord.com ▸ Authorized Apps.

Some providers may process data outside the EEA; transfers rely on Standard Contractual Clauses and/or adequacy mechanisms where required.

5. Retention

• Tip / accounting records: as needed for bookkeeping / tax (often up to 10 years for booking-relevant German records where applicable).
• Synced data on api.cellar.fm (section 2.9): kept until you delete it in the app or ask us to (section 6). Deleted listening history is purged 30 days after the deletion. A fixed maximum period for old listening history is still to be set and will be stated here.
• Bug reports: kept in our Notion workspace until we delete them.
• Support emails: typically up to 24 months after the last message, unless a dispute requires longer retention.
• api.cellar.fm and website server logs: days to a few weeks, unless needed for a security investigation. Stream-resolution requests are processed to provide playback; we do not retain YouTube session material to build profiles.
• Website and app usage analytics: events older than 25 months are deleted. An app installation's technical details are kept while it keeps sending statistics and deleted once its last event is older than 25 months. The app install ID stays on your device until you turn the setting off. Encrypted backups of our server, kept on Hetzner storage in Germany, may hold deleted analytics data for up to 12 more months.
• Error reports: kept on our server for 90 days, then deleted. Encrypted backups of our server, kept on Hetzner storage in Germany, may hold deleted reports for up to 12 more months. Alerts about errors in our private Discord channel are not covered by the 90 days; they are kept until we delete them there.
• Local app data: controlled by you on your device.

6. Deleting Cellar-held data

Cellar does not create a separate Cellar login. You sign in with the Google / YouTube account you already have. You can still ask us to delete the data Cellar holds:

• In the iOS app: Settings, then Delete my Cellar data
• In the Android app: Settings, then Delete Cellar data
• In the desktop app: Settings, Account, then Delete my Cellar data
• Without the app: follow the steps on Account deletion, or email support@cellar.fm with your YouTube handle or channel ID

That request covers everything in section 2.9 (listening history, resume snapshots, social data, Release Radar, pins, folders, Library Recents, Last.fm and Libre.fm links and your sign-in tokens) and local session / download data. Bug reports you sent stay in our Notion workspace until you ask us to delete them by email. It does not delete your Google or YouTube account, library, playlists, or likes. Those stay with Google.

Deleted listening history, whether one play or all of it, is hidden immediately and purged from api.cellar.fm 30 days after the deletion. Until then we keep it only so that a play still being sent from another of your devices cannot bring it back, and so that a deletion made by mistake can be undone.

7. Rights (EEA / UK / CH)

Where applicable, you may request:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Objection to processing
• Withdrawal of consent where processing is based on consent

Contact support@cellar.fm. For access and portability there is no self-service export yet: email us your YouTube handle or channel ID and the words “Data export”, and we send you what api.cellar.fm holds for you as a JSON file, normally within 30 days. Before we hand out or delete data we may ask you for something that shows the request comes from the account holder. You may also lodge a complaint with a supervisory authority (for example LfD Niedersachsen, or your local authority).

8. U.S. privacy (including California)

Depending on your use of the Services, we may process:

• Identifiers (email, IP address, technical identifiers)
• Commercial information (optional tip data)
• Internet / technical activity (api.cellar.fm and website logs; pseudonymous website and app usage analytics events from our self-hosted Umami)

We do not sell personal information or share it for cross-context behavioral advertising under CCPA / CPRA. Subject to applicable law, you may have rights to know / access, delete, correct, and opt out of sale / sharing (not applicable where we do not sell or share). Requests: support@cellar.fm. If consent tooling that honors Global Privacy Control (GPC) is deployed, we will honor GPC signals through that tooling.

9. Children

The Services are not directed to children under 16 (or under 13 in the U.S.).

10. Security

We apply reasonable technical and organizational measures appropriate for a small software business. No method of transmission or storage is 100% secure.

11. Changes

We will update the date on this page when the policy changes. Material changes may be noted on the site.

12. Contact