Privacy policy

Last updated: 26 October 2026

This policy covers the Djlingo app for iPhone, iPad and Android (version 0.1, the test version) and the website djlingo.easystreet.be.

1. Who is responsible

Djlingo is made by Easy Street, the app studio of Robin Claes, Belgium. Robin Claes is the controller of the personal data described in this policy.

Contact for anything about privacy: robin@easystreet.be

2. What stays on your phone

The app keeps one progress file on your phone. It contains:

• which lessons you started and finished, with the date and time;
• your exercise results: the number of attempts, whether your first attempt was right, your best score, when you passed, and whether the app suggested more practice;
• your answers to the two questions at the start (how long you have been DJing, and which DJ software you mainly use) and when you answered them;
• the results of the timing check: the audio delay of your speaker, wired headphones and Bluetooth headphones in milliseconds, stored with your phone's model name (for example “iPhone16,2”), because the delay differs per model;
• when you last reset your progress, if you did.

During timing exercises the app measures when you tap the screen to score the exercise. It keeps the score, not the taps.

The app also stores a few settings on your phone, such as whether backup is on.

Your music library (module 6)

In module 6 you can import the collection file you export from rekordbox, or use Djlingo's practice crate instead. If you import a file, the app reads from it, for each track: the track name, artist, genre, year, length, BPM, the key as written in the file, and rekordbox's track ID. It also reads the name and version of the rekordbox product that made the file. It does not read where your music files are stored, play counts, ratings, comments, cue points or playlists.

The app saves what it read in one file on your phone, with a small summary of the counts. While an import runs, a temporary copy of the file you picked and a small marker file (start time and file size) exist on your phone; both are deleted when the import ends, fails or is cancelled. The app opens only the file you pick in the system file picker.

Your library is never uploaded to us or anyone else, and it is not part of the encrypted backup. On iPhone and iPad the library folder is excluded from iCloud and computer backups; on Android it is excluded from Google backup and device transfer. You can delete it in the app under Your library, “Delete library”, or with “Delete my data”. The app also stores your pitch fader range setting on your phone.

We cannot see any of this unless you use the encrypted backup (section 3), and even then we cannot read it. Your music library is never in that backup. If your phone's own backup is on (iCloud Backup, or Google backup on Android), Apple or Google may include this data in that backup under your Apple or Google account, as they do for most apps. Removing the app deletes the progress file from your phone.

3. The encrypted backup

The backup lets you keep your progress when you reinstall the app or move to a new phone, without an account. It is on by default. You can switch it off in Settings under “Back up progress”.

How it works:

1. The first time the app makes a backup, it creates a random 256-bit secret on your phone.
2. On iPhone and iPad, the app saves this secret in your iCloud Keychain. Apple syncs iCloud Keychain between your devices end-to-end encrypted. On Android, the app saves it with Google Block Store. If your phone has a screen lock and Google backup is on, Google backs the secret up to your Google account end-to-end encrypted; otherwise it stays on the phone, and the backup only helps on that phone.
3. From the secret, the app derives a backup ID, an access token and an encryption key.
4. The app encrypts the whole progress file from section 2 with that key (AES-256-GCM) and sends the encrypted copy, the backup ID and the access token to our server.

The app updates the backup when it starts and when you finish a lesson, and only uploads when your progress has changed.

For each backup, our server stores:

• the backup ID (a random-looking code derived from your secret);
• a hash of the access token, so that only the app that holds the secret can read, replace or delete the backup;
• the encrypted copy of your progress;
• a version number, when the backup was created and last changed, and how many times it was written that day.

What we cannot do: the secret and the encryption key never leave your phone and your Apple or Google account. We cannot decrypt your backup, and it is not linked to your name, email address, Apple ID or Google account. We still treat it as personal data.

4. Your IP address

Like every internet service, our server receives your IP address whenever the app contacts it. We use it in two ways:

• Limits against abuse. When the app uploads a backup, our server computes a keyed hash (HMAC-SHA-256) of your IP address; for an IPv6 address, of its first half (the /64 network). It counts uploads and new backups per hash per day, so that one network cannot flood the server. We do not store your IP address in our database. Each count row holds only the hash, the date and two numbers. Rows from earlier days are deleted when the first new backup of a later day is created: usually within two days, later on a day when nobody creates a new backup. Because we hold the key, we could compute the hash for a known IP address; we do not use the hashes for anything other than these limits.
• Server logs. Our hosting provider, Supabase, keeps request logs that include your IP address for 7 days. We use them only to find faults and abuse.

5. What the app does not do

• No account. The app contains code for an optional sign-in with Apple or Google, but it is switched off in this version.
• No ads and no tracking. The app has no advertising ID and does not track you across apps or websites.
• No analytics. The app does not send usage statistics to us or to anyone else.
• No crash reporting. The app contains the Sentry crash reporting library, but it is switched off in this version and sends nothing.
• No microphone. The iPhone and iPad app contains a description for microphone access, because the audio library it uses includes recording code. Djlingo never switches recording on and never asks for microphone access. The Android app does not request the microphone permission.
• No location, contacts, photos or camera.
• All lesson audio is built into the app; nothing is streamed.

6. Subscriptions

Module 1 is free. The other modules need the full course, a monthly subscription that renews automatically until you cancel it.

• Apple and Google handle the payment. You subscribe, pay and cancel through the App Store or Google Play, with your Apple ID or Google account. Apple or Google processes your payment details under their own terms and privacy policies. The app never sees your card or bank details, and neither do we.
• RevenueCat checks your subscription. The app uses RevenueCat, a service of RevenueCat, Inc. (United States), to find out whether your subscription is active. The first time the app starts, RevenueCat's code in the app creates a random app user ID (it starts with $RCAnonymousID:). It is not linked to your name, email address, Apple ID or Google account.
• What RevenueCat receives: the app user ID; the purchase and renewal records the App Store or Google Play sends with a purchase (the product, price and currency, purchase and expiry dates, the store transaction ID, the country of your store account); and basic technical information about your device and the app: device model, operating system version, app version, the language and country set on your phone, and your IP address, which RevenueCat uses to deliver the service. RevenueCat does not receive your lesson progress.
• What we see: in RevenueCat's dashboard we can see, per app user ID, whether a subscription is active, its purchase and renewal history and the country of the store account. We use this to give you access to the full course, to answer support questions and to count subscriptions. We cannot link it to you unless you send us a receipt.
• Restore purchases asks the App Store or Google Play for the purchases of the Apple ID or Google account signed in on the phone, and sends them to RevenueCat to check them.

7. Testing through TestFlight

If you test Djlingo through Apple's TestFlight, Apple shares information with us about your testing: your name and email address if we invited you by email, when you installed the app, how often you used it, crash reports, and any feedback and screenshots you send. Apple's privacy policy covers what Apple itself collects. We use this information only to test and improve Djlingo.

8. Why we may process this data (legal bases)

• Encrypted backup: to provide the backup feature of the app you use (GDPR Article 6(1)(b), contract). You can switch it off at any time.
• Subscription status (RevenueCat): to give you the full course you subscribed to and to restore it (Article 6(1)(b), contract), and to meet our accounting and tax obligations for the purchase records (Article 6(1)(c), legal obligation).
• Abuse limits and server logs: our legitimate interest in keeping the backup service available and secure (Article 6(1)(f)).
• TestFlight information: our legitimate interest in testing and improving the app (Article 6(1)(f)).
• Emails you send us: our legitimate interest in answering you (Article 6(1)(f)).

The data in section 2 stays on your phone, and we do not process it.

9. Who processes data for us

• Supabase Inc. (United States) runs our server. Our database is hosted on Amazon Web Services in the EU, in Ireland (region eu-west-1). Supabase uses its own subprocessors, including Amazon Web Services and Cloudflare for the network (Supabase subprocessors, Supabase privacy policy).
• Vercel Inc. (United States) hosts this website.
• RevenueCat, Inc. (United States) checks and records subscription purchases for us (section 6) (RevenueCat privacy policy).

All three work for us under GDPR-compliant data processing agreements.

Apple (iCloud Keychain, TestFlight) and Google (Block Store, Google backup) store the backup secret as part of your own Apple or Google account. We never receive the secret. Apple and Google handle this data under their own privacy policies.

10. Transfers outside the European Economic Area

Your encrypted backup is stored in Ireland. On its way there, a request passes through Cloudflare's network and through Supabase's server code, which Supabase runs in the region nearest to you. If you use the app in Europe, this is normally a region in Europe. If you use it elsewhere, it can be a region outside the European Economic Area, for example in the United States. What passes through is the encrypted backup, the backup ID, the access token and your IP address.

Supabase Inc., Vercel Inc. and RevenueCat, Inc. are based in the United States, and RevenueCat processes subscription data in the United States. Our data processing agreements with them cover these transfers with the safeguards the GDPR requires for them, such as the European Commission's Standard Contractual Clauses.

11. How long we keep data

12. Deleting your data

• Settings, “Delete my data”: deletes from our server every backup this phone can open, switches backup off, resets the progress on this phone and deletes your imported music library.
• Your library, “Delete library”: deletes the imported music library from this phone.
• Settings, “Back up progress” off: deletes from our server every backup this phone can open. Your progress on the phone stays.
• Other devices: if you use Djlingo on several devices with the same iCloud Keychain or Google account, they share one backup. Each device with backup on uploads it again, so switch backup off or use “Delete my data” on each of them.
• The secret: the app does not delete the backup secret from your iCloud Keychain or Google Block Store, because deleting it on one device deletes it on all your devices. The secret on its own contains none of your progress.
• Offline: deletion needs an internet connection. If it fails, the app tells you and backup stays on, so you can try again.
• Automatic deletion: a backup that has not changed for 730 days is deleted.
• Subscription records: “Delete my data” does not cancel your subscription and does not delete purchase records at RevenueCat. Cancel the subscription in your Apple ID or Google Play settings. To have your RevenueCat records deleted, write to us with a receipt from Apple or Google for your subscription; we keep only what tax and accounting law requires.

13. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have your data deleted;
• restrict how we use your data;
• object to processing based on our legitimate interests;
• receive your data in a portable format.

Your progress is visible in the app, and the app deletes your backup for you (section 12). We store the backup without your name, email address or any account, so we cannot find it from an email request alone. If you write to us, we will explain what we can do, and we will answer within one month.

Write to robin@easystreet.be to use any of these rights.

You also have the right to complain to a data protection authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be. You can also complain to the authority in the EU country where you live or work.

14. This website

djlingo.easystreet.be uses no cookies, no analytics and no external fonts or scripts. Vercel processes your IP address to deliver the pages.

15. Changes to this policy

When the app changes how it handles data, we update this policy and the date at the top before the change reaches you.