Privacy: what we keep about you, and for how long

Who we are

AirplayChart is run by CarleonTech, which decides what is collected here and why. In data protection law that makes CarleonTech the controller. To reach us about your data, use the contact form on carleontech.com.

What we collect

Your email address, only if you add one to a station request. We keep the address you typed and the language of the page, and use them to send you at most two emails: one when we start tracking the station, and one when its Spotify playlist is ready.

What you ask for. The station name you type into the request box, or a search that found nothing, is kept with the request so we can look the station up. To find it we may pass that text to a web search and an AI assistant. It names a station, not you.

A scrambled code made from your IP address. Each request stores a keyed hash of the IP address it came from, never the address itself. We use it only to stop one person flooding the queue and to notice when you send the same request twice.

Your email, only if you join the station report waitlist on a station page. We keep the address, the station, the role you chose, the language of the page, when you agreed, and a scrambled code made from your IP address. We use them to email you once when the report is ready and to see which stations want it, and we send nothing else. We delete all of it 180 days after you sign up. To be removed sooner, use the contact form on carleontech.com.

Your name, email and message, only if you use the contact form. They are emailed to our inbox so we can answer you, and are not stored on this site. We keep a scrambled code made from your IP address for one day to stop the form being flooded.

Your account. If you sign in, we keep your email address so we can send you sign-in links, and we count which pages you open behind the sign-in (older plays and comparisons), per day, so we know how the site is used. Signing in sets two cookies: ac_session keeps you signed in for 30 days, and ac_in only tells the page you are signed in.

Server logs. Our web server records each visit: the IP address, the page asked for (search words included), the browser type and the page you came from. We use them to keep the site secure and to fix faults.

API requests. If you use our API, each request is logged with the IP address, the country and the user agent it came from, together with the key used. We use this to run the service and to protect it from abuse.

Cookies. We set no tracking or advertising cookies. If you choose a language we remember it in a cookie called lang, and if you switch between day and night we remember that in your own browser. Both exist only because you chose them.

Why we may use it

Your email address: your consent, which you give by typing it in and can withdraw at any time with the unsubscribe link (GDPR Art. 6(1)(a), LGPD Art. 7, I). The request hash, the server logs and the services below: our legitimate interest in running a site that is secure, works, and cannot be abused (GDPR Art. 6(1)(f), LGPD Art. 7, IX).

Who else sees it

Resend (United States) sends our emails, so it receives your address and the email we send you.

Cloudflare (United States) carries all traffic to this site, so it sees every visit. We also use Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you.

Cloudflare Turnstile checks that the person sending the contact form is not a robot. It runs in your browser on the contact page only.

Spotify. Playlist and song pages embed Spotify's player, which loads from Spotify and falls under Spotify's own privacy policy, cookies included.

Radio stations. When you press play, the audio comes straight from the station's own server, which sees your IP address like any site you visit.

Google Drive. A copy of our database is saved there every night as a backup.

Resend, Cloudflare and Google are in the United States. All three are certified under the EU-U.S. Data Privacy Framework, including its UK extension, which the European Commission accepts as a safe basis for sending personal data there. Resend and Cloudflare also include the EU standard contractual clauses in their data processing terms, so the transfer stays covered even if that framework ends.

How long we keep it

Your email address is erased as soon as we no longer need it: when the last email has gone out, when the request is closed (at the latest 90 days after you asked), or the moment you unsubscribe, whichever comes first. To keep honouring an unsubscribe we keep only a keyed hash of the address, which does not reveal it.

The code made from your IP address is blanked 30 days after your request is finished.

We keep your account until you delete it. You can do that yourself at any time on your account page: it erases your email address, your sessions, your sign-in links, your usage counts and your API keys at once. We keep only a note that an account was deleted and when, with nothing that names you. A sign-in link stops working after 20 minutes or once used, is deleted 30 days after it was sent, and signing out ends that session straight away.

Server logs are deleted after 14 days.

API request logs keep the IP address for 90 days, then the address is deleted. The rest of the row (the key, the route, the time and the result) is kept so we can report on usage. If you delete your account, your keys are deleted and your request rows lose the IP address and user agent at once, so what remains no longer points to you.

The station name you asked for stays with the request, because it describes a station and not a person.

Backups keep one copy for each of the last 7 days and one for each week before that, for 26 weeks. After that a backup is deleted. So an address we have erased can still sit in a backup for up to 26 weeks. Backups are never used to send email, and if we ever restore one, any address whose request had closed or unsubscribed is erased again as soon as the site starts.

Your rights

You can ask to see the data we hold about you, to correct it, to have it erased, or to object to how we use it, and you can withdraw your consent at any time. The unsubscribe link in every email erases your address straight away, with nothing else to do. For anything else, use the contact form on carleontech.com and tell us the address you used and roughly when you used it. We answer within the time the law sets.

If you think we have handled your data wrongly, you can complain to the data protection authority where you live. In Brazil that is the ANPD (Autoridade Nacional de Proteção de Dados).