Privacy

This policy applies to sonny.starks.design, the website of the music project Sonny Chrome. It tells you which data is processed when you use the site, why that is necessary, and what you can do if you do not want it.

In short: fonts, images, audio and the code of the site come from this domain, plus the protection and measurement scripts from Cloudflare (see “Hosting with Cloudflare”). We do not load anything from Google or other content delivery networks. The only third-party provider whose content the site can embed is Spotify — and only after you click “Load Spotify player” in the song window.

Controller

The controller for data processing on this site is Viktor Stark (Starks.Design), Reinhartserstraße 18A, 87437 Kempten, Germany.

Email: info@starks.design · Phone: +49 175 5502447

Sonny Chrome is a project of Viktor Stark. The Imprint (Impressum) is on starks.design.

Hosting with Cloudflare

This site runs on Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Pages). Cloudflare delivers the site and processes data on our behalf while doing so. A data processing agreement under Art. 28 GDPR is in place (Cloudflare Data Processing Addendum). The waitlist sign-up also runs as a function at Cloudflare, and the files of the Art Edition are stored at Cloudflare (R2). For downloads, the same applies as for the server logs.

Server logs

Each time you visit, Cloudflare processes technical connection data, for example your IP address, date and time, the address requested, the page you came from (referrer), browser and operating system details, and the response status. Without this data, Cloudflare could neither deliver the site nor protect it against attacks. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in a stable, secure operation.

Cloudflare stores this data only for as long as operation and security require. We do not keep any logs of our own that contain IP addresses.

Bot protection

Cloudflare uses a small script in the background to check whether a request comes from a human or from a bot (Cloudflare “JavaScript Detections”). For this, Cloudflare sets the cookie “cf_clearance” in your browser. It stores the result of the check, applies to the domain starks.design, and in our measurement expires after one year. It is not used for advertising or reach measurement.

The legal basis for the check is Art. 6(1)(f) GDPR. We consider the cookie strictly necessary under § 25(2) no. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act), because it protects the secure operation of the site against automated access.

Reach measurement

We use Cloudflare Web Analytics. A small script from Cloudflare measures load times and page views, plus the page requested, the referring page, the country, the browser, the operating system and the device type. According to Cloudflare, the measurement works without cookies and without local storage, and Cloudflare does not track individual visitors across sites. According to Cloudflare, the raw data is kept for seven days and only in aggregated form after that. The legal basis is Art. 6(1)(f) GDPR — our interest in learning, with as little data as possible, how fast the site loads and how many people visit it.

Transfer to the USA (Cloudflare)

Cloudflare, Inc. is based in the USA and may process data there. Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023). In addition, standard contractual clauses under Art. 46(2)(c) GDPR apply within the data processing agreement. You can check whether a company is certified in the Data Privacy Framework List. Cloudflare's privacy information: cloudflare.com/privacypolicy.

Waitlist “Good Life Art Edition” and Sonny newsletter

You can sign up on the site to receive the Good Life Art Edition (poster PDF, later gatefold and artbook PDFs for the album) and, occasionally, news from Sonny Chrome (new songs, releases) by email. Both come through the same mailing list. The waitlist is aimed at people aged 16 and over.

How sign-up works

• You enter your email address and tick the box. The box is not pre-ticked.
• You receive an email with a confirmation link (double opt-in). The link is valid for 7 days.
• Only when you confirm your sign-up via the link do we add you to the mailing list. Without confirmation, we do not create a contact. Until then, your details exist only in the signed link in your inbox. If someone enters your address without your knowledge, you receive at most the confirmation email. Your address does not get onto the mailing list that way.

To send the confirmation email, we pass your address to our email service provider Resend. According to Resend, it logs the sending — address, content and delivery status — for 30 days, even if you do not confirm. The emails come from “Sonny Chrome” (sonny@starks.design); replies go to info@starks.design.

What data we store

After you confirm, we store at Resend:

• your email address,
• the time of sign-up and the time of confirmation,
• the language of the site (German or English),
• the version of the consent text you agreed to,
• the assignment to the “Sonny Chrome” mailing list and to the “Sonny Chrome News” topic.

We do not store your IP address in the mailing list. We do not create profiles and do not make automated decisions. Open and click tracking is switched off at Resend for our sender domain. So we cannot see whether you open an email or click a link.

Purpose and legal basis

We use the data to send you the Art Edition and to inform you about news. The legal basis is your consent, Art. 6(1)(a) GDPR. For email marketing, § 7(2) no. 2 UWG (the German Unfair Competition Act) also requires your express consent. Providing your email address is voluntary. Without it, we cannot send you the Art Edition.

We must also be able to prove that and when you consented (Art. 7(1) GDPR). The stored timestamps and the version of the consent text serve this purpose. The legal basis for this is Art. 6(1)(c) and (f) GDPR.

Recipients

The recipients of your data are Resend (email delivery and management of the mailing list) and Cloudflare (hosting, see above). Both work on our behalf. We do not sell addresses and do not pass them on to third parties for advertising.

Resend is operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. A data processing agreement under Art. 28 GDPR is in place with Resend (Data Processing Addendum). Resend's privacy information: resend.com/legal/privacy-policy.

Transfer to the USA (Resend)

According to Resend, it stores data in the USA. The transfer is based on the adequacy decision of the EU Commission of 10 July 2023: Resend is certified under the EU-U.S. Data Privacy Framework. In addition, standard contractual clauses under Art. 46(2)(c) GDPR apply within the data processing agreement. You can get a copy of the clauses on request at info@starks.design.

Storage period

• Confirmation email (sending log at Resend): 30 days.
• Mailing list: until you unsubscribe.
• After you unsubscribe, we keep only the proof: address, timestamps, version of the consent text and unsubscribe note. This lets us show that you had consented and that you unsubscribed. We delete it three years after the end of the year in which you unsubscribed (regular limitation period, §§ 195, 199 BGB, the German Civil Code).

Unsubscribing and withdrawing consent

You can withdraw your consent at any time with effect for the future. Every email from us contains an unsubscribe link; it leads to a page run by Resend. Alternatively, write to info@starks.design. Processing that took place until then remains lawful (Art. 7(3) GDPR).

Spotify player in the song window

In the song window, we first show only a placeholder. Only when you click “Load Spotify player” do we load the player from Spotify (open.spotify.com). As long as you do not click, nothing is loaded from Spotify.

With the click, your browser connects to servers of Spotify and to further servers that Spotify uses for the player. In doing so, Spotify receives at least your IP address, details about your browser and device, and the information that you visited this page. The player also sets cookies from Spotify (in our measurement on 29 September 2026: “sp_t” with a lifetime of one year and “sp_landing” with a lifetime of one day).

The legal basis is your consent by clicking: Art. 6(1)(a) GDPR and § 25(1) TDDDG. We do not store your choice. You can withdraw your consent at any time: close the song window and we remove the player again. You can delete Spotify cookies that have already been set in your browser settings.

Spotify decides what happens to the data. According to Spotify's privacy policy, Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden, is responsible for users in Germany. Spotify may also transfer data to countries outside the EU; according to Spotify, it relies on adequacy decisions or standard contractual clauses for this. More in Spotify's privacy policy.

You do not want to load the player? Then do not click the button. You can still listen to the songs: in the Chrome FM player on the site (the audio files come from this domain) or via the platform links in the “Listen” section.

Local storage in your browser

The site remembers three settings in your browser's local storage (localStorage, not a cookie):

• “sonny-lang”: the language you chose (German or English),
• “cfm-mini”: whether the Chrome FM player is shown small or large,
• “cfm-lyr-z”: the font size of the lyrics.

The values are stored only when you change the setting yourself: with the language switch, the size button of the player or the text zoom buttons. They contain no identifier, do not leave your browser, and go neither to us nor to third parties. The legal basis is § 25(2) no. 2 TDDDG: storing them is necessary so that the site can show your explicit choice again on your next visit. You can delete the values at any time by removing the website data for sonny.starks.design in your browser.

Links to other platforms

The site links to Spotify, Apple Music, Instagram and DistroKid. These are plain links. As long as you do not click them, no data is transferred to these providers. With the click, you leave our site, and the privacy information of the respective provider applies.

Contact by email

If you write to us, we process your name, email address and the content of your message only to reply to you. This applies to emails to info@starks.design and to replies to emails from Sonny Chrome. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Our mailbox is operated by Heinlein Hosting GmbH (mailbox.org), Schwedter Straße 8/9A, 10119 Berlin, Germany; the data is processed in Germany. We delete the correspondence once your enquiry is dealt with, at the latest after three years, unless a legal retention obligation prevents this.

Your rights

Under the GDPR you have these rights:

• access to the data we store about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure of your data, unless a proof or retention obligation prevents it (Art. 17),
• restriction of processing (Art. 18),
• receiving your data in a common format (Art. 20),
• withdrawal of consent with effect for the future (Art. 7(3)).

Write to us for this at info@starks.design. An informal email is enough.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR (server logs, bot protection, reach measurement, contact by email), you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can also object to marketing emails at any time (Art. 21(2) GDPR) — the easiest way is the unsubscribe link in the email.

Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority if you believe we are processing your data unlawfully (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany. The BayLDA accepts complaints through its online form (in German). You can also contact any other supervisory authority, for example the one where you live.

Changes to this policy

If the site or the law changes, we will update this policy. The version published here applies.

Last updated: 29 September 2026