Privacy policy

Information on the processing of personal data under Art. 13 GDPR – for the iPhone app Tarilo and for this website tarilo.godlaya.de.

1. Controller

I am a private individual developing Tarilo on my own. There is no data protection officer; none is required.

Part A – The Tarilo app

2. In short

Tarilo does not collect personal data. There is no account, no advertising, no tracking and no server run by the developer. Everything you do in the app stays on your iPhone.

3. What is stored on your device

Subscribed podcasts, episodes, listening progress, queue, downloaded audio, covers, settings and – unless you switch it off – a listening history (up to 24 months) used to compute suggestions (“For Now”). Everything is stored locally in the app; I have no access to it, and the listening history is never transmitted.

To delete: Settings → Listening History, unsubscribe from a podcast, or delete the app.

4. Connections the app makes

• Podcast providers: When you subscribe, refresh, stream or download, the app fetches feeds, audio, covers and chapter or transcript files directly from the servers of the podcast providers or their hosts. They necessarily see your IP address and what you request, and may keep their own statistics. I have no influence on this; the respective provider’s privacy policy applies. Some feeds are only available over unencrypted http; the app tries https first.
• Apple (iTunes Search API, Apple charts): Search, the “Popular” grid and podcast lookup send a request to Apple (itunes.apple.com) containing the search term or podcast identifier and the country (from your device region); Apple also sees your IP address. No personalised results are requested. Apple’s privacy policy applies.
• The app sends nothing else to third parties. No analytics, advertising or crash-reporting SDKs are included.

5. Permissions and system features

• Background audio and background refresh: to keep playing with the screen locked and to fetch new episodes. No data is sent to me.
• Motion (Core Motion), only if you turn on the driving suggestion: the iPhone detects locally whether you are driving and suggests the driving view. Nothing is stored or transmitted.
• CarPlay: the app is shown and controlled in the car through Apple’s CarPlay; Tarilo passes no data to third parties.
• Files app: backup (OPML) and audiobook import use the files and locations you choose (e.g. iCloud Drive, if you pick it – your decision and a service of Apple).
• SoonNotifications: once available, the app shows local notifications about new episodes of podcasts you choose, with your consent. They are generated on the device; there is no push server and nothing is passed on.
• SoonSiri and Shortcuts: voice commands are processed by Apple (Siri), not by Tarilo; Apple’s privacy policy applies. Tarilo only receives the command to run on the device.
• SoonWidget: shows episode, cover and time left from the app’s local storage.

6. “For Now” suggestions (AI feature · on device only)

Suggestions are computed by a learning method – an AI feature – exclusively on your iPhone from the local listening history. None of it is sent to a server. Suggestions are labelled as such in the app, decide nothing for you and can be switched off (Settings → Listening History), where you can also delete the history.

7. Legal basis

I do not process personal data through the app. Where the app connects to podcast providers or Apple, it does so at your request to provide the function you asked for (Art. 6(1)(b) GDPR).

Part B – This website

8. Hosting and server log files

This website runs on a server that I rent from netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany) in a data centre in Nuremberg and operate myself. When you visit, the web server automatically records technically necessary information sent by your browser in server log files: IP address, date and time, requested file, status code, amount of data transferred, browser type and operating system, and, where applicable, the referring page.

This serves to establish the connection, keep the server running and protect it from attacks. The legal basis is my legitimate interest under Art. 6(1)(f) GDPR. Log files are overwritten automatically by rotation after a few days. A daily operating statistic without IP addresses is derived from them (number of requests, response times, errors). I keep IP addresses longer only in the event of a security incident, for as long as needed to investigate it.

9. No cookies, no tracking, no third-party content

This website sets no cookies, stores nothing in your browser, contains no forms, no audience measurement and no advertising. It uses your device’s fonts and loads no fonts, scripts or images from other servers. Links to other sites (e.g. Apple) only open when you click them.

10. Contact by e-mail

If you e-mail me, I process your address and message only to answer your request (Art. 6(1)(b) GDPR, otherwise (f)). I delete them once the request is settled, unless a statutory retention obligation applies.

11. Encryption

This site is transmitted only in encrypted form (TLS, shown by “https://” in the address bar).

12. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). I hold no data about users of the app; towards podcast providers and Apple, these rights apply to them. An informal message to the e-mail address above is enough.

13. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for me is:

14. Changes

If the app or this website changes, I will update this policy and publish the new version here.

Last updated: 17 October 2026