Legal

Privacy Policy

Last updated: September 6, 2026

VRC Downbeat is a free, open-source app for playing music together online. It is built to work without accounts, without tracking and without collecting personal data wherever possible. This page explains exactly what data is processed when you visit this website, use the app or connect to the official Downbeat Server — and what is deliberately not collected.

Who is responsible

Responsible for this website, the app and the official Downbeat Server (“controller” under the EU General Data Protection Regulation, GDPR):

Maik Neugebauer (independent open-source developer)
Email: [email protected]

The short version

No user accounts, no cookies, no analytics, no ads, no trackers — on the website and in the app.
Jam sessions are end-to-end encrypted; the relay server only forwards ciphertext and cannot read chat, audio or files.
The relay never logs IP addresses. The main website log contains no IP addresses either.
Only anonymous daily aggregate statistics are kept (e.g. “3 rooms opened today”).
Data is hosted in Germany (Hetzner); Cloudflare is used as CDN in front of the website.

1. Visiting this website

No cookies, no tracking

vrcdownbeat.org is a static site. It sets no cookies, runs no analytics and embeds no third-party trackers. Fonts are self-hosted — your browser does not contact Google or any other font service.

Access logs

Requests to vrcdownbeat.org are written to a reduced web-server log that contains the time, HTTP status, request method, requested path and a two-letter country code (provided by Cloudflare). This log deliberately contains no IP addresses and no browser details. Other endpoints on the same server (for example the live-streaming subdomain) keep standard web-server logs including the IP address, used solely to keep the service secure and to diagnose abuse. All web-server logs are deleted automatically after 14 days.

Cloudflare (CDN)

The website is delivered through Cloudflare, which acts as a reverse proxy and therefore technically processes your IP address to deliver the page and to fend off attacks. Cloudflare acts as our processor under its Data Processing Addendum; transfers to the US are covered by the EU-US Data Privacy Framework and standard contractual clauses.

Hosting

The server behind it is operated by Hetzner Online GmbH in Germany under a data processing agreement (Art. 28 GDPR).

Microsoft Store

The recommended way to get the app is the Microsoft Store. Installation and updates are handled by Microsoft under the Microsoft Privacy Statement.

2. Using the app

No telemetry

The app sends no telemetry, crash reports or usage data. Your settings, song library, downloads and recordings stay in local files on your PC (by default in Music\VRC Downbeat in your user folder; you can choose another folder in Settings › General). The app also writes a small diagnostic log per run into its own folder on your PC (%APPDATA%\BandJam\trace) so you can look up what happened when something goes wrong; it is never sent anywhere and you can delete it at any time. The app contains no advertising and no third-party SDKs.

Sessions via the official Downbeat Server (room codes)

When you host or join a room through the official relay, the app transmits: your chosen display name, the room code, your app version and — for private rooms — a SHA-256 hash of the room password (the password itself never leaves the host’s PC and the hash is never written to logs).

Everything inside the session — chat, songs, jam audio, voice, recordings — is end-to-end encrypted between musicians and host (X25519 key exchange, XChaCha20-Poly1305). The relay only forwards encrypted bytes; it cannot read them and stores none of them. As with any internet connection, the relay technically sees the IP addresses of connected devices in order to route traffic, but they are held in memory only and are never written to logs.

The relay keeps an event log for operations and abuse prevention: rooms opened and closed (with room code and the host’s chosen display name), musicians connecting and disconnecting (with duration and transferred data volume). These event logs contain no IP addresses and are deleted automatically after 30 days.

Direct-IP sessions

If you host on your own PC instead, the connection is made directly between you and your musicians — no relay is involved and nothing is processed on our servers. The same end-to-end encryption applies. Note that in this mode the people you invite connect to the IP address you share with them yourself.

Optional features that contact third parties

These run only when you actively use them:

Show public IP (host mode): queries api.ipify.org so the app can display your public address to you.
Test Port: asks check-host.net to probe your chosen port from outside, which transmits your public IP address and port to that service.
Get VB-CABLE: opens the official vb-audio.com download page in your browser. The app itself downloads and installs nothing.

Live streaming (invitation only)

Hosts with a streaming invitation can broadcast their mix as a public MP3 stream. For this we store an account consisting of a user name and a SHA-256 hash of the stream key — nothing else. Anything you broadcast is publicly reachable via the listener link while you stream; nothing is recorded on the server. The streaming endpoint keeps standard web-server logs (see above, deleted after 14 days).

3. Anonymous statistics

To understand whether the project is being used, a script aggregates daily totals: rooms opened, session hours, transferred data volume, website downloads per country, live-stream listener hours. These are plain numbers per day — no IP addresses, names, room codes or any other personal data — and are kept indefinitely as the project’s usage history.

4. Microsoft Store

If you install VRC Downbeat from the Microsoft Store, Microsoft processes data related to the store itself (download, installation, automatic updates) under the Microsoft Privacy Statement. The app you receive is identical and contains no additional data collection.

5. Legal bases

Where the GDPR applies, processing is based on Art. 6(1)(b) GDPR (providing the service you request — relaying your session, delivering the website and downloads, operating your streaming account) and Art. 6(1)(f) GDPR (legitimate interest in keeping the service secure, preventing abuse and keeping anonymous usage statistics).

6. Sharing of data

Data is shared only with the processors named above (Hetzner, Cloudflare) and only for the purposes described. It is never sold, rented out or used for advertising.

7. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77). To exercise your rights, email [email protected]. Note that for most of the data described above (e.g. relay event logs) we cannot link entries to you as a person — which also means there is usually nothing personal to hand over or delete.

8. Changes

This policy will be updated when the app or the services change. The current version is always available at vrcdownbeat.org/privacy.html.