Last updated: 2 August 2026 · applies to the Mutual app (Android) and the website mutual.audio
This is a translation for your convenience. Mutual is operated from Germany, and the German version is the legally binding one. Where the two differ, the German text prevails.
ask mikesz
Owner: Maik Foitzik
Schartgasse 1C
50676 Cologne, Germany
Email: hi@mutual.audio
Mutual is an app for organising identified songs into collections – on your own or together with others. We process only the data needed for that, and analytics or advertising data only if you have consented beforehand. Below we explain which data is processed when, for what purpose, and on which legal basis (GDPR). There is also a plain-language overview on our data transparency page.
Mutual uses Firebase Authentication (Google Ireland Ltd.) for sign-in. Depending on the method you choose, we process your Google account identifier (email address, display name, profile picture) or your phone number, plus an internal user ID. Legal basis: Art. 6(1)(b) GDPR (provision of the service).
Your profile name and picture, the collections you create (including name, optional photo and time frame), identified tracks, comments and emoji reactions are stored in Google Cloud Firestore. This content is visible to the members of the respective collection – each track shows who discovered it. Private collections are visible only to you. Legal basis: Art. 6(1)(b) GDPR.
Recognition runs on ShazamKit, a service by Apple Inc. The microphone is activated only while you start a recognition. An acoustic signature (audio fingerprint) is generated from the short recording and transmitted to Apple; we do not store the recording itself. To authenticate with the recognition service, a Cloud Function operated by us (Google, region europe-west1) issues a short-lived access token. Apple's privacy notices apply in addition. Legal basis: Art. 6(1)(b) GDPR.
For identified tracks we show links to Spotify and Apple Music. To resolve the Spotify link, a Cloud Function sends track information (title, artist, ISRC) to the Spotify API – no data about you is transmitted.
Since August 2026 the playlist export (Mutual Pro) works without you signing in to Spotify: when you start an export, a Cloud Function operated by us sends the name of your collection and the tracks it contains to Spotify and creates the playlist on a central Mutual Spotify account. You then receive the link to it. Please note: anyone who has that link can open the playlist, so choose collection names that do not contain sensitive information. The playlist does not appear publicly on the account's profile, and we will delete it on request (an email to hi@mutual.audio is enough). Reason for this change: since 2025 Spotify grants the extended API access needed for a user's own export only to companies with 250,000 or more monthly active users. Legal basis: Art. 6(1)(b) GDPR.
For notifications (e.g. a new track in your collection) we use Firebase Cloud Messaging. A device token is associated with your account for this purpose. You can disable notifications at any time in your Android settings. Legal basis: Art. 6(1)(b) GDPR.
To improve the app we use Google Analytics for Firebase. We record pseudonymous usage events (e.g. screens visited, recognitions started, collections created) and device information. The contents of your collections, your comments and your name are not included. This recording takes place only if you agreed in the consent dialog (Google Consent Mode; before that, all signals are set to "denied"). Legal basis: Art. 6(1)(a) GDPR. You can withdraw consent at any time in the app under Profile → "Privacy settings".
The free version shows an advertising banner via Google AdMob. Scope and personalisation depend on your choice in the consent dialog (Google User Messaging Platform). Device information and advertising IDs may be processed in this context. Legal basis: Art. 6(1)(a) GDPR; withdrawal as described in 3.6. With Mutual Pro, advertising is removed entirely.
The one-time purchase "Mutual Pro" is handled through Google Play; we do not receive any payment data. To manage purchase status we use RevenueCat Inc. (pseudonymous user ID, purchase receipt data). Legal basis: Art. 6(1)(b) GDPR.
We automatically check identified tracks for whether they come from an AI-generated artist, and show the result as a note on the track card. For this, a Cloud Function transmits music metadata only (title, artist, ISRC) – no data about you – to Deezer (Deezer S.A., France) and, if nothing is known there, to Anthropic PBC (USA) for a web search. We cache the results per track and per artist (up to 90 days) so that the same artist is not checked repeatedly. You can switch the feature off at any time in the app under Profile → "AI detection"; no check then takes place. Legal basis: Art. 6(1)(b) GDPR.
Note for artists: where an artist is a natural person, this classification means we process personal data – the legal basis is our legitimate interest in transparency for our users (Art. 6(1)(f) GDPR). The classification is automated and may be incorrect. If you are affected, an informal email to hi@mutual.audio is enough: we will remove or correct the label promptly (Art. 16, 17 and 21 GDPR).
The website is delivered via Cloudflare, Inc. (Cloudflare Pages). When you visit it, technically necessary connection data is processed (IP address, time, resource requested); your approximate location (country) is used solely to route you to the matching language version and is not stored. The website uses no cookies and no tracking. One script library (Lenis) is loaded from the jsDelivr CDN; your IP address is transmitted to that CDN in the process. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, performant delivery).
Service providers used: Google (Firebase/Cloud, AdMob, Play), Apple (ShazamKit), Spotify, Deezer, Anthropic, RevenueCat, Cloudflare, jsDelivr. Some providers process data in the USA. Such transfers are based on adequacy decisions (in particular the EU-US Data Privacy Framework) or EU standard contractual clauses.
We store account and content data until you delete it. You can remove individual tracks, comments and collections directly in the app – and delete your entire account including your profile in the app (Profile → Delete account). Analytics data is deleted automatically by Firebase Analytics after 14 months at the latest.
An informal email to hi@mutual.audio is enough for any request.
We update this policy when the app or the legal situation changes. The current version is always available at mutual.audio/privacy.html.
Shazam is a trademark of Apple Inc. · Spotify is a trademark of Spotify AB · Google Play is a trademark of Google LLC.
Legally binding version: Datenschutzerklärung (Deutsch)