Privacy Policy

Scope

This Privacy Policy applies to this website, christophek.de, including the MPE Insight, MPE Drift and MPE Keys product pages. They run on one domain, use one analytics property, and ask for your cookie choice only once, which is why one policy covers them. For the desktop apps there are separate, more detailed documents: the MPE Insight App Privacy Policy and the MPE Keys App Privacy Policy.

The MPE Insight desktop app collects no usage data. No analytics, no tracking, no advertising SDKs, no user account, and no login.

MPE Keys is a second desktop app built from the same code, carrying the Keyboard, PB / Mod and Grand Staff displays on their own. Everything this policy says about the MPE Insight app applies to it unchanged, including the sections below on what it contacts and what it does not; the only difference is that its update check reads a version file of its own on christophek.de. Modules it does not carry, such as FORGE and its on device depth estimation, are not in that build at all.

Images, videos, camera footage, and MIDI data are processed entirely on your computer and are neither stored nor transmitted. Depth estimation in the FORGE module runs entirely on the device and works offline. A crash report is written to a local text file and is never transmitted; the notice inside the app only shows you where the file is located.

What the app contacts depends on where you obtained it:

• Mac App Store and Steam versions: These versions make no network requests at all. They contain no licence check and no update check, and they do not generate or transmit any device identifier.
• Version purchased directly from this website: Licence and update checks go to my licence server on christophek.de (see below). No usage data is sent.

The MPE Drift plugin contacts my licence server on christophek.de only to activate and confirm its licence, naming its version. It sends no usage data and has no update check. A trial ends after seven days. MIDI data is processed entirely on your computer and is neither stored nor transmitted.

Licence server. It receives the licence key, a device identifier and the product, and passes key and identifier to Lemon Squeezy to verify the licence. To prevent misuse it keeps a pseudonymised IP address for one hour, the order numbers of refunded purchases and a pseudonymised record of free trials per computer, the last two for as long as the product is sold. The apps and the plugin also send their version number; from it the server counts, per day, product and version, how many computers checked in, using an identifier that changes every day, and deletes these counts after 30 days. Without a connection the apps and the plugin keep working for ten days after the last confirmation. Legal basis: Art. 6(1)(b) GDPR for the licence, Art. 6(1)(f) GDPR for preventing misuse.

The processing described below therefore concerns your use of this website, not your use of the app or the plugin.

1. Data Controller

Christophe Kalkau
Johannes-Drach-Str. 55A
97753 Karlstadt, Germany
Email: mail@christophek.de

2. General Information

Protecting your personal data is important to me. This website does not collect data without your knowledge. The following explains which data may be processed when you use this website, and the legal basis for such processing.

3. Hosting & Server Logs

This website and the licence server are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as processor (Art. 28 GDPR). Each time a page or the licence server is accessed, technical access data may be stored automatically, including:

• IP address (anonymised or full, depending on the provider)
• Date and time of access
• Page or resource accessed
• Browser and operating system information

This data is processed solely to ensure the technical operation of the website and is not combined with other data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

4. Google Analytics

With your consent, Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is used. The service uses cookies and similar technologies to collect information about how you use the website.

The following data may be processed:

• Pages visited and time spent on the website
• Source of the visit (referrer)
• Approximate location (country or region, not precise)
• Device and browser information

The IP address is anonymised before transmission. Google may disclose data to third parties; Google is certified under the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time by clicking "Reject" again on this website, or by deleting the cookie_consent entry from your browser storage.

Further information: Google Privacy Policy

5. Newsletter

The MPE Insight, MPE Drift and MPE Keys pages carry the same signup form, and all three feed one single list. When you subscribe, your email address is submitted to FormSubmit (formsubmit.co), a form service that forwards it to me by email. Two further items travel with it: the page you signed up from, which is set automatically, and the areas of interest you may tick on the MPE Insight page. Neither identifies you; they only tell me which tool brought you here and what to write about.

FormSubmit processes this data on my behalf for that purpose only. The addresses are used to send updates on MPE Insight, MPE Drift, MPE Keys and other tools of mine. They are not sold, and they are not passed on for any other purpose. You can withdraw your consent at any time by sending an informal email to mail@christophek.de.

Legal basis: Art. 6(1)(a) GDPR (consent).

6. External Services & Embedded Content

This website uses the following external services. Each entry states when the connection happens, because that is the part that matters: your IP address reaches the provider at that moment, and not before.

Loaded when you open a page

• YouTube video thumbnails (Google Ireland Limited, img.youtube.com). Pages that list videos show the preview image belonging to each video, and that image is fetched from Google's servers when the page is displayed. Your IP address is transmitted to Google at that point. The images are deliberately not copied onto this server: they follow the videos, and a local copy would silently go stale. No cookie is set by this request, and no player is loaded — see below.
• Lemon Squeezy (Lemon Squeezy LLC, assets.lemonsqueezy.com). The checkout script for the purchase overlay is loaded with the page. Lemon Squeezy is the seller of record for direct purchases; payment and invoicing run entirely on their side.

Loaded only when you click

• YouTube player (Google Ireland Limited). The embedded player is not loaded with the page. It is inserted only when you actually start a video, and it uses the youtube-nocookie.com variant, which does not set cookies for advertising purposes on load. Until you click, no connection to the player is made.
• Vimeo player (Vimeo.com, Inc., USA). A few works on the start page are hosted on Vimeo. Their player is inserted only when you start one of them, with the dnt=1 parameter, which tells Vimeo not to track the session. Until you click, no connection to Vimeo is made.
• Steam (Valve Corporation, shared.fastly.steamstatic.com). Some module clips are hosted on Steam's content network and are fetched when you open the corresponding preview, not when the page is displayed.

Not used, although you might expect it

Web fonts are served from this website itself. The Fraunces, Inter, Archivo and IBM Plex Mono typefaces are hosted locally, so displaying a page does not establish any connection to Google Fonts and no IP address is transmitted for that purpose.

The same applies to the animation libraries. GSAP, Lenis and three.js were previously loaded from public content networks (cdnjs, unpkg). Since 2026-08-12 they are hosted on this website, so opening a page no longer contacts those providers at all.

7. Your Rights

Under the GDPR, you have the following rights with regard to me as the data controller:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, please contact: mail@christophek.de

You also have the right to lodge a complaint with the competent data protection supervisory authority. For Bavaria, this is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Changes to This Privacy Policy

This Privacy Policy may be updated if the technical infrastructure or the applicable legal requirements change. The "Last updated" date above indicates the currently applicable version.