Privacy

The short version

• There is no account. You never tell us your name, your email, or your location just to listen.
• Your favorites, your listening history, and everything else the app remembers about you stay on your device. They are never uploaded. The one exception is an anonymous tally: when you heart a show for the first time, the app adds one to that show's count, with nothing attached that could tell us who you are.
• We collect anonymous playback counts (which station, how long, whether a bulletin played) on our own server. No IP address, no advertising ID, no cross-app tracking.
• Audio streams straight from each podcast's own host, so that host sees your IP address, exactly as it would in any other podcast app. See What podcast hosts see.
• The only place we ask for real personal details is the post a bulletin form, because we have to email you and take a payment — and you must be 18, or the age of legal majority where you live, to use it.

If you just listen

What never leaves your device

The app keeps a small database on your phone for the things that make it yours. None of it is transmitted to us:

• Your favorites. Every episode you heart is stored locally, and your list of favorites is never sent to us. When you export your Faves as OPML, that file is generated on your device and handed to whatever app you choose; it does not pass through us.
• The heart tally. So we can build a station from the shows people love most, the app sends one tiny message when you heart a show for the first time ("one more listener likes this show") and one when you remove your last heart for it ("one fewer"). That message contains the show's feed address and nothing else: no ID, no device or app details, no episode, no time. Each show is sent on its own, so your shows are never bundled together, and our server keeps only a running number per show, never a record of the messages. We can see that a show has, say, 40 hearts; we cannot see who any of them are, or what any one listener likes.
• Your listening position, volume, mute state, and cached audio. All local.

What we receive

While you listen, the app sends anonymous product telemetry to our own server (bulletin.staticradio.app/api/event), where it lands in our Cloudflare database. This is a self-hosted pipeline: these events are not sent to Google Analytics, Firebase Analytics, or any third-party analytics product.

• What's in an event: which station you tuned to and how long you stayed, mute and unmute, whether a bulletin was heard, completed, skipped, or tapped, playback errors and sync stalls, and coarse interaction counts like dial spins. Each event carries a timestamp and a rough surface label (mobile, macos, web).
• What's deliberately not in an event: your IP address and user agent are never stored with it. Neither is your name, email, location, contacts, advertising identifier, or any activity in other apps. We do not send shares, and favorites leave your device only as the anonymous heart tally described above.
• One persistent identifier. A random string the app generates on your device the first time it sends telemetry, and keeps in the app's own settings so repeat sessions can be counted as one listener rather than many. It is not your device serial, your Apple or Google account, or an advertising ID, and it is not shared with anyone. Delete the app and it is gone for good.
• Two throwaway identifiers. The live "how many people are listening right now" heartbeat and the bulletin play counter each use a separate random ID that is regenerated every time you open the app. They exist only so a single session can't be double-counted, and they cannot be linked across launches.

Crash reports

None reach us. The app carries no crash-reporting SDK, so when it falls over we get no stack trace, no device model, nothing at all from your phone. Apple and Google may still show us aggregate crash counts in App Store Connect and Play Console, built from data the operating system already collects and not tied to you.

What podcast hosts see

This is the part most worth understanding, and it is true of every podcast app, not just ours. Static Radio does not re-host or proxy audio. When a station plays, your device connects directly to the podcast publisher's own server or CDN to fetch the episode, and to whatever host serves the cover art. Those companies therefore see your IP address and the request your device makes, and they log it under their own privacy policies, which we neither control nor have visibility into. That is how the download shows up in the show's own stats, which is deliberate, because we want the shows we play to get credit for the listening.

We fetch our own schedule file and our own bulletin audio from Cloudflare, which sees the same connection metadata for those requests.

Tips

Tipping is optional and unlocks nothing. On iOS, tips go through Apple's In-App Purchase, so Apple handles the payment end to end; we never see your card details, and we receive no personal information about you from a tip. Elsewhere, the tip link opens a third-party page in your browser, and that service's own privacy policy takes over from there.

If you make a show we broadcast

Static Radio turns public podcast RSS feeds into always-on stations. Apart from the optional heads-up emails below, we hold no personal data about podcast hosts: what we store is what your feed already publishes to the world, namely the feed URL, show title, artwork, episode list, and any funding link in the feed. Episodes stream straight from your own server, so plays land in your stats like any other download, and we never re-host or alter your audio.

If you ask us on your show's page to tell you when it's on, we keep the email address and the timezone your browser reports, only to send those heads-ups. Nothing is sent until you confirm by email, every email has a one-click unsubscribe link, and you can unsubscribe any time.

If you'd rather not be on the dial, ask us to remove your show. The form takes an email so we can confirm the request and match the exact feed. Those form submissions are emailed to us and are not kept in our database; the email itself is used for nothing but that conversation. Removals are honored by a person, and the show drops off on the next schedule build. The same applies to suggesting a podcast.

Both of those forms are protected by Cloudflare Turnstile, an anti-bot check that receives your IP address in order to tell a person from a script.

If you post a bulletin

The post a bulletin form is where we collect the most, because we have to reach you and take a payment. Our Terms require you to be at least 18 (or the age of legal majority where you live) to use this form. You give us:

• Your email address, to confirm receipt, send the approval or rejection, email you after each scheduled play, and send a final wrap-up when all plays have occurred.
• A sender name, shown on the public schedule and on the player while your bulletin airs. This one is public.
• Your audio file and cover image, plus optional link URL and button text if you choose to include them. Audio and images are stored in Cloudflare R2; the rest sits in our database.
• Scheduling preferences (target timezone, time of day, and whether you want bonus plays), used only to place your spot.
• Payment, handled by Stripe. We never see or store card numbers; Stripe returns a session ID and a payment intent reference. We do pass your email and the booking metadata (station, date, package) to Stripe so the receipt makes sense, along with the website's analytics identifiers (described under "The website") so a finished payment can be matched to the visit it came from.
• If you tick the newsletter box, we keep your email for that as well. If you leave it unticked, your email is used only for the messages about your own bulletin and is not added to any list. You can ask us to drop it at any time.

While your bulletin is on air we count anonymous plays and taps so we can tell you how it did. Those counts use the same throwaway per-launch identifier described above, so they measure sessions, not people.

The website

• Google Analytics (GA4). The public website (not the mobile app) sends aggregated events: page views, which buttons and links you tap (such as the app store badges, Patreon, or "post a bulletin"), which form steps you completed, whether a promo code worked, and whether a purchase finished or was refunded. We use them to see whether the form is broken for some class of visitor and which parts of the site lead people to the app. Events carry ids and choices (station, package, step), never your email, name, or anything you typed, and links that carry private details (receipt links, email addresses) have those parts removed before they're sent. A first-party browser storage entry (sr_cid) and Google's standard _ga cookie stitch a visit together. Any cookie blocker stops the browser's events, and Google's opt-out add-on works too. The outcome of a bulletin checkout (paid, failed, abandoned, refunded) is reported by our server rather than your browser, so it is counted either way; it carries the order's amount, package and station, plus the sr_cid identifier if your browser had one.
• Sentry. When error monitoring is switched on, a page error or a server-side exception sends Sentry a stack trace so we can fix it. Captured URLs have their query strings stripped before sending, so form values don't ride along. No audio, no card data, no email bodies.
• Rate limiting. Our server briefly holds your IP address in memory to stop abuse of the checkout, admin, and reporting endpoints. It is never written to the database and disappears within minutes.

Who we share with

We share data only with the providers we use to run the service. They act as our processors: no marketing, no resale, no data brokers.

• Cloudflare: hosts the website and server, stores bulletin audio and images in R2, runs our database, and provides the Turnstile anti-bot check.
• Stripe: processes bulletin payments.
• Resend: sends our transactional email (confirmations, approvals, daily summaries).
• Google: the Firebase Realtime Database that holds the live listener-count heartbeats, and Google Analytics on the website only.
• Apple: handles In-App Purchase tips on iOS.
• Sentry: error monitoring, when enabled.
• Podcast publishers and their CDNs, not our processors, but your device contacts them directly to stream audio and artwork. See What podcast hosts see.

We will also disclose data if the law genuinely requires it. If the project is ever transferred to someone else, we'll say so here before anything moves.

How long we keep things

• Playback telemetry: 90 days. A scheduled job deletes anything older, every day, automatically.
• Internal admin and email logs: 90 days, pruned by the same job.
• Listener-count heartbeats: seconds. Entries older than 75 seconds are deleted outright; only an anonymous per-station number survives.
• Bulletin records (audio, image, scheduling rows, play counts): kept while the project operates, so we can answer receipt and billing questions later. Ask us and we'll delete yours.
• Heart tally: one running number per show, kept while the project operates. There is no record of who added to it.
• Heads-up sign-ups (a host's email and timezone): kept until you unsubscribe or ask us to delete them.
• Website analytics: retained in Google's systems under that property's retention setting, up to 14 months.

Things we deliberately don't do

• No advertising identifiers, retargeting pixels, or ad-network SDKs.
• No selling, renting, or licensing of your data. Ever, to anyone.
• No profile building beyond the aggregate counts described above.
• No access to your contacts, calendar, photos, microphone, or precise location. The app never asks for those permissions. The only audio we ever receive is a file you deliberately upload to the post a bulletin form.
• No tracking you across other apps or websites.

Your choices and your rights

• Stop the telemetry entirely by deleting the app. The persistent anonymous ID lives in the app's own storage and goes with it.
• Block the website analytics with any cookie blocker or Google's opt-out add-on. Checkout outcomes are still counted by our server, as described under "The website".
• Ask what we hold and ask us to delete it. Wherever you live, email us and we'll do it: access, correction, deletion, or a copy of your data. If you booked a bulletin, tell us the email you booked with so we can find the record. Everything else we hold is anonymous, which means that with no account and no identifier tied to you, we usually cannot connect a request to a specific row.
• If you are in the UK, EU, or EEA: we process bulletin data to perform our contract with you, and product telemetry, security, and error monitoring on the basis of our legitimate interest in keeping a free service working. You may object to that processing, and you may complain to your local data protection authority.
• If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we never have.

Children

Static Radio isn't directed at children, and we don't knowingly collect personal information from anyone under 13. If you believe a child has sent us something (most plausibly through the bulletin form), email us and we'll delete it.

Where data lives

We're based in Chicago, and our providers operate globally. If you use Static Radio from outside the United States, the limited data described above will be processed in the US and other countries where those providers run.

Changes

When this policy changes we update the date at the top of the page. If a change is significant (new category of data, new processor, a genuinely different purpose), we'll call it out here rather than quietly reword a paragraph.

Contact

Privacy questions, deletion requests, or just curious? Email hello@staticradio.app. We read every message.

For anything else, the support page has the human channel.