Privacy policy

Last updated: 3 November 2026

This policy covers the Djlingo app for iPhone and Android and the website djlingo.app.

The short version

• You do not need an account. The app has no sign-in.
• Your lesson progress is stored on your phone.
• If backup is on, the app sends an encrypted copy of your progress to our server. It is encrypted on your phone with a key we never receive, so we cannot read it.
• The app has no ads and no tracking. It sends anonymous usage statistics, such as which lessons are started and finished, with a random ID that is new each time the app starts. Crash reports contain no personal data.
• Module 1 is free. The full course is a one-time purchase through the App Store or Google Play. Our purchase provider, RevenueCat, gives your phone a random app user ID that is not linked to your name, and keeps the record of a purchase under that ID.
• The app never uses your microphone.
• You can delete your data in the app: Settings, then “Delete my data”.

1. Who is responsible

Djlingo is a product of Claes Consultants, Belgium, published under the Easy Street name. Claes Consultants is the controller of the personal data described in this policy.

Contact for anything about privacy: hello@easystreet.be

2. What stays on your phone

The app keeps one progress file on your phone. It contains:

• which lessons you started and finished, with the date and time;
• your exercise results: the number of attempts, whether your first attempt was right, your best score, when you passed, and whether the app suggested more practice;
• your answers to the two questions at the start (how long you have been DJing, and which DJ software you mainly use) and when you answered them;
• the results of the timing check: the audio delay of your speaker, wired headphones and Bluetooth headphones in milliseconds, each with the date and time it was measured, stored with your phone’s model name (for example “iPhone16,2” or “Pixel 9”), because the delay differs per model;
• for a lesson you have not finished, the step where you stopped and the steps you already did, so you can continue there;
• when the app last showed you the full course offer on its own, and when you last closed the offer without buying;
• when you finished the whole course, if you did;
• when you last reset your progress, if you did.

The whole progress file, including the timing check results, is part of the encrypted backup (section 3).

During timing exercises the app measures when you tap the screen to score the exercise. It keeps the score, not the taps.

The app also stores a few settings on your phone, such as whether backup is on. These settings are not part of the backup.

We cannot see any of this unless you use the encrypted backup (section 3), and even then we cannot read it. If iCloud Backup is on for your iPhone, Apple may include this data in that backup under your Apple account, as it does for most apps. On Android, if Google backup is on, Android may include it in the backup of your phone under your Google account in the same way. Removing the app deletes the progress file from your phone.

Earlier test versions of the app could import a rekordbox collection file. The current version deletes any imported collection, and the settings that went with it, from your phone when it starts.

3. The encrypted backup

The backup lets you keep your progress when you reinstall the app or move to a new phone, without an account. It is on by default. You can switch it off in Settings under “Back up progress”.

How it works:

1. The first time the app makes a backup, it creates a random 256-bit secret on your phone.
2. On iPhone, the app saves this secret in your iCloud Keychain. Apple syncs iCloud Keychain between your devices end-to-end encrypted. On Android, the app saves it with Google Play services (Block Store) on your phone. If your phone has a screen lock and Google backup is on, Google also backs it up to your Google account, end-to-end encrypted, so it can be restored on a new Android phone; otherwise it stays on this phone.
3. From the secret, the app derives a backup ID, an access token and an encryption key.
4. The app encrypts the whole progress file from section 2 with that key (AES-256-GCM) and sends the encrypted copy, the backup ID and the access token to our server.

The app updates the backup when it starts and when you finish a lesson, and only uploads when your progress has changed.

For each backup, our server stores:

• the backup ID (a random-looking code derived from your secret);
• a hash of the access token, so that only the app that holds the secret can read, replace or delete the backup;
• the encrypted copy of your progress;
• a version number, when the backup was created and last changed, and how many times it was written that day.

What we cannot do: the secret and the encryption key never leave your phone, except in your iCloud Keychain or in Google’s end-to-end encrypted backup. We cannot decrypt your backup. The backup is not linked to your name, email address, Apple ID or Google account. We still treat it as personal data.

4. No account

The app has no sign-in and no accounts. We do not ask for your name, email address, Apple ID or Google account. If a later version adds sign-in, it will be optional, and we will update this policy before that version is released.

5. Your IP address

Like every internet service, our server receives your IP address whenever the app contacts it. We use it in two ways:

• Limits against abuse. When the app uploads a backup, our server computes a keyed hash (HMAC-SHA-256) of your IP address; for an IPv6 address, of its first half (the /64 network). It counts uploads and new backups per hash per day, so that one network cannot flood the server. We do not store your IP address in our database. Each count row holds only the hash, the date and two numbers. Rows from earlier days are deleted when the first new backup of a later day is created: usually within two days, later on a day when nobody creates a new backup. Because we hold the key, we could compute the hash for a known IP address; we do not use the hashes for anything other than these limits.
• Usage statistics. When the app sends usage statistics, our server compares your IP address with the published address ranges of Google’s test devices, so that test traffic can be left out of our figures. The comparison happens in memory; the IP address is not stored with the events.
• Server logs. Our hosting provider, Supabase, keeps request logs that include your IP address for 7 days. We use them only to find faults and abuse.

6. What the app does not do

• No account. The app works without an account and has no sign-in.
• No ads and no tracking. The app does not use the advertising identifier and does not track you across apps or websites.
• Anonymous usage statistics. The app sends us events about how it is used: the app was opened (and whether for the first time), an onboarding screen was shown, onboarding was finished, a lesson was started, left or finished, an exercise was finished, a module was finished, a “coming soon” module was viewed, the timing check was finished, backup was switched on or off, “Delete my data” was used, the full course offer was shown, a purchase of the full course was started or completed, and the offer was closed without buying. The events about lessons and exercises say which lesson and which kind of step they are about, whether the exercise was passed and after how many attempts, how far you got in a lesson you left, how long a finished lesson took and whether you were doing it again. The timing check event says how the check ended and, if it measured a delay, the delay in milliseconds. The “Delete my data” event says whether the backups could be deleted. The events about the full course offer say which of two versions of the offer you saw, where in the app you opened it, whether it showed a launch price next to the regular price, and whether you had finished Module 1; they do not contain the price, a receipt or the store’s transaction ID. Each event carries a random ID that the app creates in memory each time it starts and never stores, a random session ID, the app version, the platform (iOS or Android), the language and country set on your phone, and whether the app is a test version (TestFlight, App Review, a simulator or emulator, or an Android app installed from outside Google Play). Events from different app starts cannot be connected to each other or to you. The events contain no name, email address, IP address, RevenueCat ID or backup ID. The only things the app stores for this are a yes/no flag on your phone that it has been opened before, and which of the two versions of the full course offer it shows; the app picks that version at random the first time it starts and keeps it, and “Delete my data” does not change it. We use the events to see which lessons work and where people stop, and which version of the full course offer works better, and not for advertising.
• Crash reports without personal data. When the app crashes or hits an error, it sends a crash report to Sentry. A crash report contains the error, where in the app’s code it happened, the app version, the phone model and the iOS or Android version. It does not contain your name, email address, IP address or lesson progress, and the text of buttons you tapped is removed before it is sent.
• No microphone. The iPhone app contains a description for microphone access, because the audio library it uses includes recording code. Djlingo never switches recording on and never asks for microphone access. The Android app does not request the microphone permission.
• No location, contacts, photos or camera.
• All lesson audio is built into the app; nothing is streamed.

7. Purchases and RevenueCat

Module 1 is free. The full course is a one-time purchase through the App Store or Google Play; it is not a subscription. It opens Modules 2 and 3 now, and Modules 4 to 7, which are marked “Coming soon”, when they are released.

• RevenueCat. The app uses RevenueCat, a service of RevenueCat, Inc. (United States), to process and check purchases. It starts when the app starts. On first start it gives your phone a random app user ID (it starts with $RCAnonymousID:). This ID is not linked to your name, email address, Apple ID or Google account.
• What RevenueCat receives: the random app user ID; basic technical information about your phone and the app: phone model, iOS or Android version, app version, the language and country set on your phone; the country of your App Store or Google Play account; and your IP address, which RevenueCat uses to deliver the service. If you buy the full course or tap “Restore purchases”, RevenueCat also receives the purchase details from Apple or Google: the product, the price and currency, the date and the store’s transaction ID. It keeps them under the random app user ID. RevenueCat does not receive your lesson progress.
• What we see: in RevenueCat’s dashboard we can see the random app user IDs, when they were last seen, and the purchase details of the IDs that bought the full course. We cannot link them to a person.
• Payments: Apple or Google handles the payment under their own terms and privacy policies. The app never sees your card or bank details, and neither do we.

8. Testing through TestFlight and Google Play

If you test Djlingo through Apple’s TestFlight, Apple shares information with us about your testing: your name and email address if we invited you by email, when you installed the app, how often you used it, crash reports, and any feedback and screenshots you send. Apple’s privacy policy covers what Apple itself collects. We use this information only to test and improve Djlingo.

If you test Djlingo through a Google Play test track, Google shares information with us about your testing: the email address you joined the test with if we invited you by email, installs, crash and performance reports, and any feedback you send through Google Play. Google’s privacy policy covers what Google itself collects. We use this information only to test and improve Djlingo.

9. Why we may process this data (legal bases)

• Encrypted backup: to provide the backup feature of the app you use (GDPR Article 6(1)(b), contract). You can switch it off at any time.
• RevenueCat app user ID and device information: to make the app work with the App Store and Google Play purchase systems (Article 6(1)(b), contract).
• Anonymous usage statistics: our legitimate interest in improving the lessons and the app (Article 6(1)(f)).
• Crash reports: our legitimate interest in finding and fixing errors in the app (Article 6(1)(f)).
• Abuse limits and server logs: our legitimate interest in keeping the backup service available and secure (Article 6(1)(f)).
• Testing information from TestFlight and Google Play: our legitimate interest in testing and improving the app (Article 6(1)(f)).
• Emails you send us: our legitimate interest in answering you (Article 6(1)(f)).

The data in section 2 stays on your phone, and we do not process it.

10. Who processes data for us

• Supabase Inc. (United States) runs our server, including the database for encrypted backups. Our database is hosted on Amazon Web Services in the EU, in Ireland (region eu-west-1). Supabase uses its own subprocessors, including Amazon Web Services and Cloudflare for the network (Supabase subprocessors, Supabase privacy policy).
• RevenueCat, Inc. (United States) handles the app user ID and purchase records for us (section 7) (RevenueCat privacy policy).
• Functional Software, Inc. (Sentry) (United States) receives crash reports for us. Our Sentry data is stored in the EU, in Germany (Sentry privacy policy).
• Vercel Inc. (United States) hosts this website.

All four work for us under GDPR-compliant data processing agreements.

Apple handles iCloud Keychain, iCloud Backup and TestFlight as part of your own Apple account, under its own privacy policy. Google handles Block Store, Android backup and Google Play test tracks as part of your own Google account, under its own privacy policy. We never receive the backup secret.

11. Transfers outside the European Economic Area

Your encrypted backup is stored in Ireland. On its way there, a request passes through Cloudflare’s network and through Supabase’s server code, which Supabase runs in the region nearest to you. If you use the app in Europe, this is normally a region in Europe. If you use it elsewhere, it can be a region outside the European Economic Area, for example in the United States. What passes through is the encrypted backup, the backup ID, the access token and your IP address.

Supabase Inc., RevenueCat, Inc., Functional Software, Inc. (Sentry) and Vercel Inc. are based in the United States, and RevenueCat processes its data in the United States. Our data processing agreements with them cover these transfers with the safeguards the GDPR requires for them, such as the European Commission’s Standard Contractual Clauses.

12. How long we keep data

13. Deleting your data

• Settings, “Delete my data”: deletes from our server every backup this phone can open, switches backup off and resets the progress on this phone.
• Settings, “Back up progress” off: deletes from our server every backup this phone can open. Your progress on the phone stays.
• Other devices: if you use Djlingo on several iPhones with the same iCloud Keychain, or on several Android phones restored from the same Google backup, they share one backup. Each phone with backup on uploads it again, so switch backup off or use “Delete my data” on each of them.
• The secret: the app does not delete the backup secret from your iCloud Keychain or from Google Play services, because deleting it on one device can delete it on all your devices. The secret on its own contains none of your progress.
• Offline: the progress on your phone is deleted straight away. If the backup on our server cannot be deleted because you are offline, the app tells you and deletes it the next time it is online.
• Automatic deletion: a backup that has not changed for 730 days is deleted.
• RevenueCat: “Delete my data” does not delete the random app user ID or a purchase record at RevenueCat. Write to us if you want them deleted. Your purchase stays with your App Store or Google Play account, so you can still restore it with “Restore purchases”.

14. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have your data deleted;
• restrict how we use your data;
• object to processing based on our legitimate interests;
• receive your data in a portable format.

Your progress is visible in the app, and the app deletes your backup for you (section 13). We store the backup without your name or email address, so we cannot find it from an email request alone. If you write to us, we will explain what we can do, and we will answer within one month.

Write to hello@easystreet.be to use any of these rights.

You also have the right to complain to a data protection authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be. You can also complain to the authority in the EU country where you live or work.

15. Children

Djlingo is a general music course, not an app made for children. It works without an account and does not ask anyone for their name, email address or age. The data it handles is the same for every user and is described above. Users under 16 should use Djlingo with the permission of a parent or guardian (see the Terms of Use). A parent or guardian can delete a child’s data in the app as described in section 13, or write to us.

16. This website

djlingo.app uses no cookies, no analytics and no external fonts or scripts. Vercel processes your IP address to deliver the pages.

17. Changes to this policy

When the app changes how it handles data, we update this policy and the date at the top before the change reaches you.