Privacy Policy for Coripo

Last updated: 29 August 2026

Controller

Frank Merl
Web & App Entwicklung
Seeholzenstr. 2b
82166 Gräfelfing
Germany

Email: apps@frankmerl.de

No data protection officer has been appointed, nor is one required by law.

What the app processes

Your content — songs, sheet music, recordings, setlists, tags and instruments — is stored on your device. If an iCloud account is set up, Apple mirrors that content to the private area of your iCloud account so it appears on your other devices. The developer has no access to it.

Settings such as font sizes, appearance or the selected key deliberately stay on the individual device and are never transmitted.

Credentials for a self-hosted Navidrome server: the address and user name are kept in the device’s settings, the password in the device’s keychain.

The app is fully functional without an iCloud account; your content then stays on that one device.

Permissions

All permissions are optional. Declining one removes exactly the matching feature; the rest of the app keeps working.

Outgoing connections

Coripo only connects where you point it:

• iCloud — if you use iCloud, to sync your own content between your devices.
• Apple Music — when you search there or play a linked track. Only the track identifier is stored, never the music itself.
• Your Navidrome server — if you have set one up. The user name, your search terms and an authentication token are transmitted. Your password never leaves the device in clear text: each request carries a one-time value derived from it.
• Song sources on the web — when you use the web search. Coripo ships with four addresses (ultimate-guitar.com, chordie.com, chords-and-tabs.net, ukutabs.com); you can add more of your own. None of them is contacted before you have agreed: ahead of the first search the four are shown to you, each with a link to its terms, and only the checkbox below releases them. You can switch them off individually in the settings at any time. Connections happen while you search, view a sheet, or open one of the sites yourself; your search term is transmitted. Pages are loaded as in a browser, with what a browser sends: including your session if you have signed in there. Coripo is not affiliated with these sites and neither distributes nor licenses any content; their terms of use are your responsibility.
• A link’s page — when you add a link in a song’s info. Coripo then opens that one address to read the name of the page, and only while no name is set; typing the name yourself triggers nothing. It loads as in a browser, like the song sources above.
• Searching for a link — when you choose “Add Link” in a song’s info and tap one of the targets. Coripo opens the results page of YouTube, Google or one of your song sources in the built-in browser; the search term in the field is transmitted (title and artist of the song are suggested). From there you browse as in any browser — Coripo reads nothing from those pages, it keeps the address and the name of the page you take. The address bar there doubles as a search field: anything that is not an address goes to Google.
• Sharing, saving, printing — only when you trigger it, and only to the destination you choose.
• App Store — when you tap “Rate Coripo” in the app. Once the planned in-app purchase exists, also when unlocking the full set of features. Nothing you have created in Coripo is transmitted.

Recordings, microphone and camera data are never uploaded.

What Apple collects

Apple — not the developer — is responsible for app distribution, the planned in-app purchase, iCloud, TestFlight and Apple Music.

An in-app purchase is planned; there is none at present. Once it arrives, the developer still never sees payment details: the purchase runs through your Apple account, and all the developer sees are aggregated sales figures in which no one is identifiable. Whether the full set of features is unlocked is then checked with Apple, not with a server of the developer’s, as there is none.

If you have agreed in your system settings to share data with app developers, the developer receives aggregated, anonymised statistics and crash reports from Apple. No individual is identifiable in them, and they contain none of your library content.

If you take part in a beta version via TestFlight, the developer knows your email address, because taking part requires an invitation. It is used solely for distributing test versions and is not passed on.

Apple’s privacy policy applies: apple.com/legal/privacy

Legal bases

Using the app itself involves no processing of personal data by the developer. Where a legal basis is required:

• Contact by email — Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry); for matters concerning the purchase of the app, Art. 6(1)(b) GDPR.
• TestFlight participation — Art. 6(1)(b) GDPR (carrying out the beta participation you requested).

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority.

As the developer holds no data about you, most of these rights have nothing to act on — your content is yours. You can delete it yourself at any time:

• Individual items: delete them inside the app.
• Everything on the device: delete the app. That includes whatever the app’s browser has stored, such as a sign-in on a song source.
• Everything in iCloud: System Settings → Apple Account → iCloud → Manage → Coripo.
• Navidrome credentials: remove the server in the app’s settings; the keychain entry is deleted with it.

Retention

The developer stores no usage data, so no retention periods apply. Emails are kept for as long as handling your enquiry requires.

Children

Coripo is rated 4+. The app collects no data, shows no advertising, and has no chat or community features.

At present the app is entirely free and contains no in-app purchases. The plan is for the free version to manage a limited number of songs, with a one-time in-app purchase unlocking the full set of features; no subscription is intended. Apple would then handle the purchase, with Apple’s protection for purchases made by children (Family Sharing, “Ask to Buy”).

Changes

If what the app does changes, this policy is updated. The version published here, with the date given above, is the one that applies.

Contact

Privacy questions: apps@frankmerl.de