Privacy Policy.
How personal data is processed when you visit RealSynth.NET or use the contact form.
User accounts and freeware downloads
Registration requires your name, email address and password. Your email must be confirmed before downloading freeware. Address and telephone number are optional; they are not needed for free downloads. Passwords are stored as adaptive password hashes, not in plain text. We process these details to create and administer accounts, authenticate users, prevent misuse and enable downloads (Article 6(1)(b) and, for security measures where applicable, Article 6(1)(f) GDPR). A technically necessary secure session cookie is used for login. Abuse prevention uses short-lived HMAC-protected rate-limit identifiers based on the request source or account email, stored in our database for up to two days; the raw address is not stored in that rate-limit table. These checks help protect login, registration, password reset, forms and visitor statistics. No marketing subscription is included in registration. Account and licence/download history are retained while the account is active, subject to applicable legal retention duties and deletion requests. Contact us to request deletion, access or correction. Confirmation and reset emails are sent via the configured hosting mail service. No payment details are processed by this website version.
Two-factor authentication: If enabled, the website stores an authenticator setup secret encrypted using a server-side application key, the last accepted one-time-code time step and hashed single-use recovery codes in the MariaDB database. The authenticator QR code is generated locally in your browser without an external QR service. The verification code is checked when you sign in; no code is sent to any third party by this website. Two-factor authentication is mandatory for administrative access and optional for standard user accounts. Authentication attempt limits and a necessary login-session cookie help protect the service. If you lose both the authenticator and recovery codes, contact the operator for a manual identity-verified recovery procedure; changing your password does not automatically disable two-factor authentication.
Before launch: verify actual server log retention, processing agreements, email delivery, access controls, data-subject request procedures and legal retention periods with the hosting provider.
Last updated: November 1, 2026
1. Data controller
RealSynth.NET — Alexander Filipionek
Schragmüllerstr. 43
44357 Dortmund
Germany
Email: alex@realsynth.net
Contact form: Service & Support
2. Web hosting and server access data
Hosting provider: IONOS SE (IONOS Webhosting), Germany. RealSynth.NET is hosted with IONOS. When you access the website, the hosting infrastructure processes technical connection data needed to deliver requested pages and protect the service. This may include your IP address, date and time of access, requested URL, browser and device details, referrer information and server response information, depending on the hosting configuration.
Purpose: website delivery, stable operation, troubleshooting and protection from attacks. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in secure and reliable operation). Hosting is performed through the named provider as a processor where applicable. Storage: technical access logs are deleted when no longer needed for operation or security, subject to actual provider settings and exceptional longer retention to investigate abuse or meet legal obligations. Exact hosting log settings and retention periods must be verified by the site operator in the hosting account.
3. Cookies and local storage
The website does not use analytics cookies, marketing cookies, external trackers or third-party advertising services. It does not embed Google Fonts, social plugins or third-party media.
When you open the contact form, the server creates a session to protect the form against forged requests and repeated submissions. A technically necessary session cookie named RS_CONTACT contains a random session identifier; the form's anti-forgery token and basic rate-limit status are kept on the server. The cookie is not used for marketing or analytics and normally expires when your browser session ends. Server-side session cleanup depends on the PHP hosting configuration.
Legal basis: Article 6(1)(f) GDPR for form protection, and Section 25(2) TDDDG for access to the strictly necessary session cookie. This required cookie does not depend on optional tracking consent. We do not set a non-essential cookie-consent banner because the provided website has no non-essential cookies.
4. Interactive browser synthesizer
The interactive synthesizer on the Home page uses browser-native Web Audio and Canvas APIs to generate sound and display its waveform on your device. Playing notes, changing octaves or adjusting controls does not transmit musical notes, sound or settings to our server. The demo does not request microphone access, set cookies or contact third-party services. Standard server access data is processed when the browser retrieves the synth HTML file, as explained in the hosting section above.
Sidechanger media: The Sidechanger freeware listing includes a screenshot and an MP4 introduction video stored on this website. Playback starts only after the visitor chooses it. Requests for the video or screenshot may appear in ordinary hosting access logs, as described in section 2. The media does not require third-party tracking scripts or additional website cookies.
5. Contact form and email enquiries
If you send us an enquiry through the contact form, we process the information you enter: name, email address, enquiry topic and message. These fields are required so we can identify, understand and respond to your request. The form does not intentionally collect your IP address in the message content, and it does not use third-party CAPTCHA services.
The message is sent to alex@realsynth.net via authenticated SMTP through the configured IONOS email infrastructure and handled in our mailbox. Data may be processed by the web hosting and email infrastructure providers involved in transmission and storage. We do not use these messages for newsletters or advertising.
Purpose: receive and respond to your enquiry. Legal basis: Article 6(1)(f) GDPR for general enquiries; Article 6(1)(b) GDPR where the enquiry involves steps you request before entering into a contract. Storage: correspondence is removed once the matter has been resolved and no further legitimate purpose for retaining it remains, unless statutory retention obligations or the need to establish, exercise or defend legal claims require longer storage. We review messages for deletion when no longer necessary. Please do not submit sensitive personal information.
6. Free downloads, download counter and payments
RealSynth.NET V1.1.0, Kombinuid V1.2.0 (VST3 instruments) and Sidechanger V1.4.6 (VST3 effect) are free ZIP downloads offered to registered users with confirmed email addresses. Users may claim these free products through a zero-price licence process (EUR 0.00); no payment provider or card processing is involved. Future paid listings remain placeholders.
All three ZIP downloads are delivered through our own download.php endpoint after account authentication and verification that the relevant free licence exists. Accepted download requests are counted in our MariaDB database in aggregate per product and individually for each user and licensed product. The individual download statistics include the account identifier, product identifier, request count and latest request time. Counts reflect accepted requests, not necessarily completed file transfers. Historic aggregate download counts can be imported or corrected by an administrator; historic requests cannot be attributed to specific users without prior records.
Purpose: to provide the free ZIP and display overall download interest. Legal basis: Article 6(1)(f) GDPR for the necessary delivery and any associated technical server-access records and our interest in reliable aggregate download statistics and for account-linked download counts to provide licence history and prevent abuse. Account-linked download tracking is part of the service for logged-in users; the technically necessary login cookie is described in the account section. No separate analytics cookie is set by the counter. Ordinary hosting server logs may separately record download requests as described in section 2.
The historical plugin archive is informational and its discontinued instruments are no longer supported. This notice must be reviewed when purchases, payment systems or additional tracking are introduced.
7. Optional RealSynth.NET newsletter
You may voluntarily subscribe to RealSynth.NET email news, plugin announcements and offers through our newsletter form. Members can subscribe using their verified account email; non-members can subscribe using only an email address. Registration for an account or a free licence does not automatically subscribe you. We require a separate explicit consent and a confirmation email (double opt-in) before sending campaign emails. The purpose, controller identity and ability to unsubscribe are displayed during sign-up. The legal basis for newsletter sending and consent records is Article 6(1)(a) GDPR; proof of consent and abuse-prevention records may also be retained where legitimately necessary under Article 6(1)(f) GDPR.
We store the email address, whether you joined from a member account or as a guest, consent wording, opt-in request and confirmation dates, current subscription status and, if applicable, the linked account identifier. Temporary confirmation-token hashes expire after 48 hours. Campaign records include recipient status, timestamps and whether the configured IONOS SMTP server accepted an email or rejected the attempt. To preserve the hourly SMTP sending limit after a newsletter is deleted, a separate short-lived log keeps only internal delivery-log identifiers and send times, without newsletter content or email addresses. Entries older than two hours are removed on a subsequent newsletter send or administration visit. SMTP acceptance does not prove delivery or reading. There are no newsletter tracking pixels, personalised click-tracking links or external newsletter analytics services in this version. Summary statistics are available to the administrator.
Public newsletter archive: We may publish selected previous newsletter subjects and message texts on our public archive after an administrator has expressly approved each issue. This archive is readable without a newsletter subscription. Subscriber addresses, unsubscribe tokens, audience lists and individual send records are not published. The administrator is instructed to check each newsletter for personal or confidential information before publication.
Every newsletter includes a personal unsubscribe link; withdrawal does not affect your account or free licences. An unsubscribe request takes effect for future mailings, and recipient records are kept only insofar as needed to document the consent and opt-out, avoid unwanted repeated mail, resolve disputes or meet legal obligations; you may contact alex@realsynth.net to request erasure where applicable. Email sending uses the configured IONOS mailbox infrastructure. The administrator triggers small batches manually and must respect the provider's limits.
8. Your rights
Under the applicable GDPR provisions, you may have the right to request access to personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21). You also have the right to lodge a complaint with a data protection supervisory authority.
If we rely on our legitimate interests under Article 6(1)(f) GDPR, you may object to that processing under Article 21 GDPR on grounds relating to your particular situation. Requests can be sent to alex@realsynth.net.
The competent supervisory authority for North Rhine-Westphalia is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
9. Data security and changes
The public website should be operated exclusively over HTTPS. The contact form uses server-side input validation, an anti-forgery token, a hidden spam-trap field and a basic submission limit. Email transmission and storage are subject to the configuration of the hosting and email services. This notice will be revised when the site's functionality or data processing changes.