Carlos the Composer is a small experiment: you hear a piano piece and guess whether a human or an AI wrote it. We process as little data as possible. There are no accounts, no advertising and no tracking cookies. We count page views with GoatCounter, a privacy-friendly statistics service; apart from that there is no embedded third-party content (no external fonts, videos or other scripts).
1. Controller
Linki Tools, Brühlstr. 35, 90542 Eckental, Germany
Email: p@ocmatos.com
2. What we process
- Technical data when you visit. Your browser sends, among other things, your IP address and the page it asks for to our server. We use the IP address only in memory, to limit how many requests are made in a period and so prevent abuse, for at most 24 hours. It is not stored in a database or in log files.
- Cookie “carlos_voter”. A random identifier with no information about you, valid for one year. It lets us remember which pieces you have already voted on and match your vote to the piece we showed you. Voting is not possible without it.
- Page-view statistics (GoatCounter). Our pages load a small script from GoatCounter (gc.zgo.at) and report each page view to carlos-composer.goatcounter.com, so your browser sends your IP address and the usual request data to GoatCounter. According to GoatCounter, it sets no cookies and does not store IP addresses; it records the page, the referrer, the browser and operating system, the screen size and a country derived from the address, and produces aggregate figures from them. See GoatCounter’s privacy policy. We use the figures to see how often the experiment is visited.
- Your vote. Your guess (human or AI), whether you liked the piece, and the time, stored together with the random identifier from the cookie. We also keep for a few days which piece we showed you.
The stats page shows totals only, never individual votes.
3. Legal bases
Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in running the service, protecting against abuse and manipulation of the results, evaluating the votes and knowing how often the pages are visited. The cookie is technically necessary to provide the service you asked for (§ 25(2) no. 2 TDDDG); no consent is needed for it, which is why there is no cookie banner.
4. Hosting and recipients
The server is run by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data processing under Art. 28 GDPR). Regular backups of the database are stored with Dropbox. Page-view statistics are provided by GoatCounter (goatcounter.com). DNS for the domain is provided by Cloudflare; your page views do not pass through Cloudflare. We do not share data beyond this.
5. Retention
Votes are kept for as long as the experiment runs, because they are the basis of the published statistics. The record of which piece was shown to you is deleted after a few days, and IP addresses leave memory after at most 24 hours. The cookie expires after one year or when you delete it. GoatCounter keeps its aggregate statistics for as long as we use the service.
6. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). Write to us at p@ocmatos.com. Because we cannot identify you, we need the value of your “carlos_voter” cookie to do so; without it we cannot tell which votes are yours (Art. 11 GDPR). You can also complain to a data protection authority, for example the Bavarian State Office for Data Protection Supervision.
7. Security and changes
Transmission is encrypted with HTTPS. We update this policy when the service changes; the version published here applies.