Privacy

The short version

• There is no account. You never tell us your name, your email, or your location just to listen.
• Your favorites, your listening history, and everything else the app remembers about you stay on your device. They are never uploaded.
• We collect anonymous playback counts (which station, how long, whether a bulletin played) on our own server. No IP address, no advertising ID, no cross-app tracking.
• Audio streams straight from each podcast's own host, so that host sees your IP address, exactly as it would in any other podcast app. See What podcast hosts see.
• The only place we ask for real personal details is the post a bulletin form, because we have to email you and take a payment — and you must be 18, or the age of legal majority where you live, to use it.

If you just listen

What never leaves your device

The app keeps a small database on your phone for the things that make it yours. None of it is transmitted to us:

• Your favorites. Every show you heart is stored locally. We do not receive them, and we could not tell you what any individual listener has saved. When you export your Faves as OPML, that file is generated on your device and handed to whatever app you choose; it does not pass through us.
• Your listening position, volume, mute state, and cached audio. All local.

What we receive

While you listen, the app sends anonymous product telemetry to our own server (bulletin.staticradio.app/api/event), where it lands in our Cloudflare database. This is a self-hosted pipeline: these events are not sent to Google Analytics, Firebase Analytics, or any third-party analytics product.

• What's in an event: which station you tuned to and how long you stayed, mute and unmute, whether a bulletin was heard, completed, skipped, or tapped, playback errors and sync stalls, and coarse interaction counts like dial spins. Each event carries a timestamp and a rough surface label (mobile, macos, web).
• What's deliberately not in an event: your IP address and user agent are never stored with it. Neither is your name, email, location, contacts, advertising identifier, or any activity in other apps. We do not send favorites or shares.
• One persistent identifier. A random string the app generates on your device the first time it sends telemetry, and keeps in the app's own settings so repeat sessions can be counted as one listener rather than many. It is not your device serial, your Apple or Google account, or an advertising ID, and it is not shared with anyone. Delete the app and it is gone for good.
• Two throwaway identifiers. The live "how many people are listening right now" heartbeat and the bulletin play counter each use a separate random ID that is regenerated every time you open the app. They exist only so a single session can't be double-counted, and they cannot be linked across launches.

Crash reports

None reach us. The app carries no crash-reporting SDK, so when it falls over we get no stack trace, no device model, nothing at all from your phone. Apple and Google may still show us aggregate crash counts in App Store Connect and Play Console, built from data the operating system already collects and not tied to you.

What podcast hosts see

This is the part most worth understanding, and it is true of every podcast app, not just ours. Static Radio does not re-host or proxy audio. When a station plays, your device connects directly to the podcast publisher's own server or CDN to fetch the episode, and to whatever host serves the cover art. Those companies therefore see your IP address and the request your device makes, and they log it under their own privacy policies, which we neither control nor have visibility into. That is how the download shows up in the show's own stats, which is deliberate, because we want the shows we play to get credit for the listening.

We fetch our own schedule file and our own bulletin audio from Cloudflare, which sees the same connection metadata for those requests.

Tips

Tipping is optional and unlocks nothing. On iOS, tips go through Apple's In-App Purchase, so Apple handles the payment end to end; we never see your card details, and we receive no personal information about you from a tip. Elsewhere, the tip link opens a third-party page in your browser, and that service's own privacy policy takes over from there.

If you make a show we broadcast

Static Radio turns public podcast RSS feeds into always-on stations. We hold no personal data about podcast hosts: what we store is what your feed already publishes to the world, namely the feed URL, show title, artwork, episode list, and any funding link in the feed. Episodes stream straight from your own server, so plays land in your stats like any other download, and we never re-host or alter your audio.

If you'd rather not be on the dial, ask us to remove your show. The form takes an email so we can confirm the request and match the exact feed. Those form submissions are emailed to us and are not kept in our database; the email itself is used for nothing but that conversation. Removals are honoured by a person, and the show drops off on the next schedule build. The same applies to suggesting a podcast.

Both of those forms are protected by Cloudflare Turnstile, an anti-bot check that receives your IP address in order to tell a person from a script.

If you post a bulletin

The post a bulletin form is where we collect the most, because we have to reach you and take a payment. Our Terms require you to be at least 18 (or the age of legal majority where you live) to use this form. You give us:

• Your email address, to confirm receipt, send the approval or rejection, email you after each scheduled play, and send a final wrap-up when all plays have occurred.
• A sender name, shown on the public schedule and on the player while your bulletin airs. This one is public.
• Your audio file and cover image, plus optional link URL and button text if you choose to include them. Audio and images are stored in Cloudflare R2; the rest sits in our database.
• Scheduling preferences (target timezone, time of day, and whether you want bonus plays), used only to place your spot.
• Payment, handled by Stripe. We never see or store card numbers; Stripe returns a session ID and a payment intent reference. We do pass your email and the booking metadata (station, date, package) to Stripe so the receipt makes sense.
• If you tick the newsletter box, we keep your email for that as well. If you leave it unticked, your email is used only for the messages about your own bulletin and is not added to any list. You can ask us to drop it at any time.

While your bulletin is on air we count anonymous plays and taps so we can tell you how it did. Those counts use the same throwaway per-launch identifier described above, so they measure sessions, not people.

The website

• Google Analytics (GA4). The public website (not the mobile app) sends aggregated events: page views, which form steps you completed, whether a purchase finished. We use them to see whether the form is broken for some class of visitor. A first-party browser storage entry (sr_cid) and Google's standard _ga cookie stitch a visit together. Any cookie blocker stops it, and Google's opt-out add-on works too.
• Sentry. When error monitoring is switched on, a page error or a server-side exception sends Sentry a stack trace so we can fix it. Captured URLs have their query strings stripped before sending, so form values don't ride along. No audio, no card data, no email bodies.
• Rate limiting. Our server briefly holds your IP address in memory to stop abuse of the checkout, admin, and reporting endpoints. It is never written to the database and disappears within minutes.

Who we share with

We share data only with the providers we use to run the service. They act as our processors: no marketing, no resale, no data brokers.

• Cloudflare: hosts the website and server, stores bulletin audio and images in R2, runs our database, and provides the Turnstile anti-bot check.
• Stripe: processes bulletin payments.
• Resend: sends our transactional email (confirmations, approvals, daily summaries).
• Google: the Firebase Realtime Database that holds the live listener-count heartbeats, and Google Analytics on the website only.
• Apple: handles In-App Purchase tips on iOS.
• Sentry: error monitoring, when enabled.
• Podcast publishers and their CDNs, not our processors, but your device contacts them directly to stream audio and artwork. See What podcast hosts see.

We will also disclose data if the law genuinely requires it. If the project is ever transferred to someone else, we'll say so here before anything moves.

How long we keep things

• Playback telemetry: 90 days. A scheduled job deletes anything older, every day, automatically.
• Internal admin and email logs: 90 days, pruned by the same job.
• Listener-count heartbeats: seconds. Entries older than 75 seconds are deleted outright; only an anonymous per-station number survives.
• Bulletin records (audio, image, scheduling rows, play counts): kept while the project operates, so we can answer receipt and billing questions later. Ask us and we'll delete yours.
• Website analytics: retained in Google's systems under that property's retention setting, up to 14 months.

Things we deliberately don't do

• No advertising identifiers, retargeting pixels, or ad-network SDKs.
• No selling, renting, or licensing of your data. Ever, to anyone.
• No profile building beyond the aggregate counts described above.
• No access to your contacts, calendar, photos, microphone, or precise location. The app never asks for those permissions. The only audio we ever receive is a file you deliberately upload to the post a bulletin form.
• No tracking you across other apps or websites.

Your choices and your rights

• Stop the telemetry entirely by deleting the app. The persistent anonymous ID lives in the app's own storage and goes with it.
• Block the website analytics with any cookie blocker or Google's opt-out add-on.
• Ask what we hold and ask us to delete it. Wherever you live, email us and we'll do it: access, correction, deletion, or a copy of your data. If you booked a bulletin, tell us the email you booked with so we can find the record. Everything else we hold is anonymous, which means that with no account and no identifier tied to you, we usually cannot connect a request to a specific row.
• If you are in the UK, EU, or EEA: we process bulletin data to perform our contract with you, and product telemetry, security, and error monitoring on the basis of our legitimate interest in keeping a free service working. You may object to that processing, and you may complain to your local data protection authority.
• If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we never have.

Children

Static Radio isn't directed at children, and we don't knowingly collect personal information from anyone under 13. If you believe a child has sent us something (most plausibly through the bulletin form), email us and we'll delete it.

Where data lives

We're based in Chicago, and our providers operate globally. If you use Static Radio from outside the United States, the limited data described above will be processed in the US and other countries where those providers run.

Changes

When this policy changes we update the date at the top of the page. If a change is significant (new category of data, new processor, a genuinely different purpose), we'll call it out here rather than quietly reword a paragraph.

Contact

Privacy questions, deletion requests, or just curious? Email hello@staticradio.app. We read every message.

For anything else, the support page has the human channel.