Your songs are saved to your account, so they follow you across devices. We store your audio on our servers and keep a local copy on your phone for playback.
We store your display name, email, and login info. Audio in your songs is uploaded so you and the people you make music with can hear it. Nobody else can access it.
We use TelemetryDeck for anonymous analytics. No personal data, no tracking, no ads. You can turn it off in settings.
You can delete your account and all your data from the app anytime, or email us at hello@davidcibis.com.
We don’t sell your data and we don’t use it for advertising.
You need to be at least 14 to create an account.
The data controller responsible for processing your personal data is:
David Cibis
Carretera de Caldes 52, Casa 2
08420 Can Duran, Canovelles, Barcelona, Spain
NIE: Y8331867Q
Email: hello@davidcibis.com
We are not required to appoint a Data Protection Officer under Art. 37 GDPR or Art. 34 LOPDGDD. Our activities do not fall within any of the mandatory sectors listed in Art. 34 LOPDGDD, and we do not carry out large-scale processing or systematic monitoring of individuals. For all data protection inquiries, please contact us at the email address above.
2.1 Data Stored Locally on Your Device
The App stores project files and audio recordings locally as a working cache. This data is also synced to our servers (see Section 2.3).
Audio files are protected with the .completeUnlessOpen file protection level. All local data is removed when you uninstall the App.
2.2 Account Data
An account is required to use Ronda. When you create an account, we collect and store the following data on our servers:
Passwords are never stored in plaintext. They are hashed using the scrypt algorithm before storage.
2.3 Project and Audio Data
Your projects and audio recordings are stored on our servers so they are available across your devices. When you collaborate, this data is also shared with other project members. The following data is processed on our servers:
All collaborators in a project can see your display name, avatar, and which recordings you contributed.
2.4 Moderation and Safety Data
2.5 Feedback Data
2.6 Analytics Data
We use TelemetryDeck, a privacy-first analytics provider, to understand how the App is used in aggregate. TelemetryDeck does not collect IP addresses and does not perform device fingerprinting. User identifiers are double-hashed before transmission, making it impossible to trace analytics data back to individual users.
You can opt out of analytics at any time through the toggle in the App’s settings. Your opt-out preference is stored locally on your device and takes effect immediately.
2.7 Push Notification Data
If you enable push notifications, we store your Apple Push Notification service (APNs) device token on our servers to deliver collaboration activity alerts. You can disable push notifications at any time through iOS Settings.
2.8 Data We Do Not Collect
We do not collect: location data, contacts, calendar data, photos or camera roll access (the camera is used only for QR code scanning), Apple Identifier for Advertisers (IDFA), device vendor ID, hardware serial numbers, or browsing history. IP addresses are not stored by the App. Our infrastructure providers may log IP addresses in accordance with their own privacy policies (see Section 5).
We process your personal data exclusively for the following purposes:
We do not use your data for advertising, profiling, automated decision-making, or any purpose not described in this policy. We do not sell your data to third parties.
We rely on the following legal bases under Art. 6(1) GDPR, as further specified by the LOPDGDD:
(a) Consent (Art. 6(1)(a)): For push notifications. You can withdraw consent at any time by disabling notifications in iOS Settings.
(b) Contractual necessity (Art. 6(1)(b)): For processing that is necessary to provide the App’s features you have requested, including account management, authentication, audio hosting, and collaboration synchronization. Even though the App is free, accepting our Terms creates a valid contract.
(f) Legitimate interest (Art. 6(1)(f)): For analytics (with opt-out), moderation and safety, feedback processing, and record-keeping. Our legitimate interest is in improving the App, ensuring user safety, and maintaining operational stability. We have conducted a balancing test and concluded that these interests do not override your rights, particularly given the minimal and non-sensitive nature of the data involved, the use of privacy-preserving analytics (TelemetryDeck), and your ability to opt out.
We use the following third-party services to operate the App. Each processes data on our behalf under a Data Processing Agreement as required by Art. 28 GDPR.
We do not share your data with any other third parties unless required by law.
Your data is primarily stored on servers located in the United States operated by Vercel, Cloudflare, and Neon. As the Operator is based in Spain and subject to GDPR, international transfers require an adequate level of protection.
Transfer mechanism: We rely on the EU-U.S. Data Privacy Framework (DPF) adequacy decision adopted by the European Commission on July 10, 2023. Vercel, Cloudflare, Neon, and Resend are certified under the DPF, which provides an adequate level of data protection recognized by the European Commission.
As an additional safeguard, our Data Processing Agreements with these providers also incorporate the EU Standard Contractual Clauses (SCCs) as a fallback transfer mechanism. You may verify DPF certification status at dataprivacyframework.gov.
TelemetryDeck is based in Germany and processes analytics data within the European Union. No international transfer is involved for analytics.
We retain your data only as long as necessary for the purposes described in this policy. Specific retention periods are:
In accordance with Art. 32 LOPDGDD, when you request deletion of your data, we may retain it in a blocked state for the period during which liability may arise from the processing, after which it will be permanently destroyed.
Under GDPR and the LOPDGDD, you have the following rights regarding your personal data:
Right of access (Art. 15 GDPR): You may request a copy of all personal data we hold about you.
Right to rectification (Art. 16 GDPR): You may request correction of inaccurate personal data. You can update your display name and avatar directly in the App.
Right to erasure (Art. 17 GDPR): You may request deletion of your personal data. You can delete your account directly through the App, which triggers cascading deletion as described in Section 7. For data that cannot be deleted through the App (e.g., user reports where you are the reporter), contact us. In accordance with Art. 32 LOPDGDD, deleted data may be retained in a blocked state for the legally required period.
Right to restriction of processing (Art. 18 GDPR): You may request that we restrict processing of your data under certain circumstances, such as while we verify the accuracy of contested data.
Right to data portability (Art. 20 GDPR): You may request your personal data in a structured, commonly used, machine-readable format. You can export your projects from the App in the .ronda package format, which includes your audio recordings in standard MPEG-4 AAC format and project metadata. For a complete data export (including account data and collaboration metadata), contact us and we will provide your data in JSON and standard audio formats within 30 days.
Right to object (Art. 21 GDPR): You may object to processing based on legitimate interest at any time. For analytics, you can exercise this right immediately by using the opt-out toggle in the App’s settings. For other processing based on legitimate interest, contact us and we will cease processing unless we demonstrate compelling grounds that override your interests.
Right to withdraw consent (Art. 7(3) GDPR): Where we process data based on consent (push notifications), you may withdraw consent at any time without affecting the lawfulness of prior processing. Disable push notifications in iOS Settings.
Right not to be subject to automated decisions (Art. 22 GDPR): We do not carry out automated individual decision-making or profiling that produces legal effects or similarly significant effects on you.
Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
https://www.aepd.es
You may also contact any EU supervisory authority in your country of habitual residence.
To exercise any of these rights, contact us at hello@davidcibis.com. We will respond within 30 days of receiving your request. If we need additional time due to the complexity or volume of requests, we will inform you within the initial 30-day period and may extend by an additional 60 days.
We will verify your identity before processing any request. For account holders, we may ask you to submit the request from the email address associated with your account. We do not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.
We implement appropriate technical and organizational measures to protect your data:
.completeUnlessOpen protection level.While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
The App is not directed at children. You must be at least 14 years old to create an account, in accordance with Article 7 of the LOPDGDD.
We do not knowingly collect personal data from anyone under 14. If we become aware that a user under 14 has created an account or provided personal data without verified parental consent, we will take steps to delete that data and terminate the account promptly.
If you are a parent or guardian and believe your child has provided personal data to us, please contact us at hello@davidcibis.com.
We will update this age threshold if required by changes to applicable law.
The Ronda website at https://onronda.com does not use cookies for tracking or advertising purposes. If any technically necessary cookies are used (e.g., for session management), they are limited to what is strictly required for the website to function and do not require consent under Article 22.2 of the LSSI-CE.
The website does not employ any third-party tracking, advertising pixels, or social media plugins.
In accordance with Apple’s requirements, the App includes a privacy manifest (PrivacyInfo.xcprivacy) declaring:
We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the App’s features. We will notify you of material changes at least 30 days in advance via email or in-app notification. The “Last Updated” date at the top of this page will be revised accordingly.
We encourage you to review this Privacy Policy periodically. Your continued use of the App after the effective date of any changes constitutes your acknowledgement of the updated policy.
If you have any questions about this Privacy Policy or our data practices, please contact us at:
David Cibis
Email: hello@davidcibis.com
Website: https://onronda.com