Privacy Policy

This Privacy Policy explains how Tim Langner, trading as Timedia (“we,” “us,” or “our”), collects, uses, and shares personal data when you use Cellar, our marketing website at https://cellar.fm, related download services (including api.cellar.fm), optional donations, and the Cellar desktop application for macOS and Windows (together, the “Services”).

Cellar is a desktop client for YouTube Music. It is an independent product and is not affiliated with, or endorsed by, YouTube or Google.

Cellar is free to download and use.

Controller (GDPR / German BDSG)

We do not appoint a separate Data Protection Officer because we are not required to under Art. 37 GDPR.

1. Scope

This policy covers personal data we process as controller. It does not cover Google’s or YouTube’s processing of your YouTube / Google account. When you sign in to YouTube Music inside Cellar, that authentication is with Google; Google’s terms and privacy policy apply to that relationship.

2. Categories of data we process

2.1 Data we typically do not collect

• We do not run a Cellar user-account system that stores your Google password.
• Card / payment numbers never hit our API. Optional donation checkout is handled by Ko-fi (see below).
• YouTube Music / Google sign-in credentials primarily remain on your device (and with Google). A minimized subset of session material may be sent to api.cellar.fm solely to resolve playable streams, as described in section 2.5.

2.2 Optional donations

If you choose to support Cellar (for example by buying a coffee), checkout is handled by Ko-fi at https://ko-fi.com/cellarfm. Ko-fi processes payment details under its own terms and privacy policy. We may receive what we need to thank you and keep accounts, typically including:

• Name or display name, if you provide one
• Email address, if Ko-fi shares it with us
• Donation amount, currency, timestamps, and a supporter message
• Limited payment metadata Ko-fi shares with creators (not full card numbers)

Donations are voluntary. They are not required to use Cellar.

2.3 Support communications

If you email us (e.g. support@cellar.fm), we process the content of your message, your email address, and any attachments you send.

2.4 Website / hosting data

The marketing site is largely static. Hosting / CDN providers (e.g. Vercel or equivalent) may automatically process technical logs such as IP address, user-agent, referrer, timestamps, and request paths, for security, abuse prevention, and reliability. If optional analytics are enabled, they are described in the Cookie Policy and only run where consent is required and given.

2.5 Desktop app and api.cellar.fm

The Cellar desktop application talks to api.cellar.fm (our stream-resolution API). Depending on the feature you use, the app may send:

• A minimized set of YouTube Music session cookies / auth headers needed to resolve playable stream URLs
• Technical request metadata that appears in server logs (for example IP address, user-agent, and timestamps)

Purposes: provide playback, prevent abuse, and operate the API. We do not use YouTube session material to build advertising profiles. Payment card data never hits api.cellar.fm; cards for optional donations are processed only by Ko-fi.

2.6 Desktop application (local)

The Cellar app may also store locally on your device: preferences and session-related data needed to talk to YouTube Music. Local data stays on your device except for the limited api.cellar.fm traffic described above, or when you voluntarily send material to us (e.g. in a support email).

2.7 Cookies

See the Cookie Policy.

3. Purposes and legal bases (GDPR Art. 6)

We do not sell your personal information, and we do not use YouTube Music session material for advertising profiles.

4. Processors and recipients

• Ko-fi: optional donation checkout (card data stays with Ko-fi / its payment partners)
• Hetzner Cloud: infrastructure hosting for api.cellar.fm
• Vercel (or equivalent): hosting / CDN for the marketing site at https://cellar.fm
• GitHub: desktop downloads and update manifests from the public releases repository

Some providers may process data outside the EEA; transfers rely on Standard Contractual Clauses and/or adequacy mechanisms where required.

5. Retention

• Donation / accounting records: as needed for bookkeeping / tax (often up to 10 years for booking-relevant German records where applicable).
• Support emails: typically up to 24 months after the last message, unless a dispute requires longer retention.
• api.cellar.fm and website server logs: days to a few weeks, unless needed for a security investigation. Stream-resolution requests are processed to provide playback; we do not retain YouTube session material to build profiles.
• Local app data: controlled by you on your device.

6. Rights (EEA / UK / CH)

Where applicable, you may request:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Objection to processing
• Withdrawal of consent where processing is based on consent

Contact support@cellar.fm. You may also lodge a complaint with a supervisory authority (for example LfD Niedersachsen, or your local authority).

7. U.S. privacy (including California)

Depending on your use of the Services, we may process:

• Identifiers (email, IP address, technical identifiers)
• Commercial information (optional donation data)
• Internet / technical activity (api.cellar.fm and website logs; analytics if enabled)

We do not sell personal information or share it for cross-context behavioral advertising under CCPA / CPRA. Subject to applicable law, you may have rights to know / access, delete, correct, and opt out of sale / sharing (not applicable where we do not sell or share). Requests: support@cellar.fm. If consent tooling that honors Global Privacy Control (GPC) is deployed, we will honor GPC signals through that tooling.

8. Children

The Services are not directed to children under 16 (or under 13 in the U.S.).

9. Security

We apply reasonable technical and organizational measures appropriate for a small software business. No method of transmission or storage is 100% secure.

10. Changes

We will update the date on this page when the policy changes. Material changes may be noted on the site.

11. Contact