Privacy Policy

Last updated: 27.06.2026

1. Controller

PHYbio Establishment, Im Fetzer 45a, FL-9494 Schaan, Liechtenstein.
Email: info@phybio.com · Web: www.phybio.com

2. Data we process

Account: your email address (sign-in/enrolment and to provide your licensed content).
Device & licence: a device identifier, platform and app version; a cryptographic key is generated in your device's secure hardware and never leaves the device. Used for content licensing (DRM) and the per-account device limit.
Telemetry (Android only): a "heartbeat" (device id, app version, platform) so we know which version is in use. No commands are sent back.
Diagnostics (consent only): technical device data (model, OS, performance) is sent only if you explicitly agree and is not linked to your identity.
Your own files: imported audio files are processed locally and not uploaded.
Server logs: when streaming or fetching licences, our server processes connection data such as IP address and timestamp.
Trial anti-abuse: After you delete your account we store only a salted one-way hash (HMAC) of your email address – not the address itself – to prevent a renewed free trial. Legal basis: legitimate interest (Art. 6(1)(f) GDPR; retention after deletion under Art. 17(3)). The hash is automatically deleted after 12 months and used solely for this purpose. You may object (Art. 21).

3. Purposes & legal bases (Art. 6 GDPR)

Performance of a contract (b): account, licensing, playback. Legitimate interests (f): content protection/DRM and abuse prevention, telemetry, server logs. Consent (a): hardware diagnostics (revocable at any time).

4. App permissions

Camera, photos/library and microphone are not actively used; they are only declared by an embedded file-import component and accessed only if you actively choose such a function. Internet is used for sign-in, licensing, streaming and updates. File access (sideload/Android variant only) reads your own audio from folders you choose; the Google Play variant uses the system file picker without broad storage access. Background audio keeps playback running when the screen is off.

5. Recipients

Our hosting provider (data centre in Germany/EU, Art. 28 GDPR) and Apple/Google for delivering the app. We do not sell your data or use it for advertising.

6. International transfers

Data sent to Apple/Google may be processed outside the EEA (notably the USA) under appropriate safeguards (incl. EU Standard Contractual Clauses). Our own server is in the EU.

7. Retention

Account/licence data for as long as your account exists or as needed to provide the content; server logs only briefly; the trial hash for up to 12 months to prevent abuse. We delete data once the purpose no longer applies, unless legal retention periods require otherwise.

8. Your rights

Access, rectification, erasure, restriction, data portability and objection; you may withdraw consent at any time (info@phybio.com). You may also lodge a complaint with a supervisory authority – in Liechtenstein the Data Protection Authority, or your local authority in the EU.

9. Children

The app is not directed at children under 16.

10. Changes & language

We update this policy when the app or legal requirements change. The German version is authoritative; translations are provided for convenience.