Privacy Policy

This Privacy Policy explains what personal information RadioThat (we, us, our) collects when you use our website, apps, and services (the Service), how we use and share it, and the choices and rights you have. It is maintained by the RadioThat team as app-owned editable content and is not an independent certification.

By using the Service you agree to this Policy and our Terms of Service. For questions or requests, email privacy@radiothat.com.

1. Information we collect

Information you give us. When you create an account we collect your email address and display name. If you sign in with Google, we receive the basic profile fields Google returns (name, email, avatar URL, and a stable Google account identifier). If you subscribe to Premium, our payment processor collects and processes your billing details; we receive limited metadata (subscription status, plan, renewal date, last four digits of the card) but never your full card number.

Information from your use of the Service. As you listen, we record the stations you build and their genre weights, the tracks played to you, the length of each listening session, whether a track was completed or skipped, and the votes you cast (with the vote weight in effect at the time). This activity is what powers ranking, retirement, and the shared genre pools.

Device and technical information. We automatically receive information sent by your browser or device: IP address, approximate location derived from IP, user agent, device and browser type, language, referring/exit pages, timestamps, and error logs.

Cookies and similar technologies. See section 5 below.

Voice control (optional). If you turn on voice control in your profile, holding the mic button in the player records a short audio clip from your device microphone and sends it to our AI transcription provider so we can turn it into a text command (like "skip" or "play Jazz Café"). We do not store the audio or the transcript, we do not associate them with your account beyond executing the command, and voice control stays off until you turn it on. You can turn it off at any time from your profile.

Communications. If you contact us (email or the contact form), we keep a record of the correspondence and any details you share.

2. How we use information

We use the information we collect to:

• operate the Service — authenticate you, remember your stations, serve the 70/30 Proven-to-Challenger mix, enforce skip and vote limits, and record play history so we do not repeat tracks;
• compute community scores, standing labels, and lifecycle decisions (promotion, retirement) on our servers;
• process payments and manage your Premium subscription;
• send you service, account, security, billing, and legal messages, and — only with your consent where required — product updates;
• maintain the safety and integrity of the Service, including detecting and preventing fraud, abuse, and vote manipulation;
• debug, secure, and improve the Service, including analyzing aggregate listening patterns to tune ranking, generation, and pool health;
• comply with legal obligations and enforce our Terms.

We do not use your listening or voting history to build advertising profiles, we do not sell your personal information, and we do not share it for advertising of any kind. Aggregate signals from the crowd — never individual profiles — shape what gets made next; that is the only "secondary" use of your activity. Where required (e.g., under the EU/UK GDPR), our legal bases are: performance of our contract with you, our legitimate interests in operating and improving the Service, your consent (where we ask for it), and compliance with legal obligations.

3. How we share information

We share personal information only in the following circumstances:

• Subprocessors. Vendors who process data on our behalf under written contracts and confidentiality obligations. Current subprocessors:
  • Backend platform — managed Postgres, authentication, storage, and edge functions that host the Service;
  • Stripe, Inc. — payment processing for Premium subscriptions;
  • Google LLC — optional Google sign-in (only if you use it);
  • Our AI music provider — generates tracks server-side; we do not send your identity in generation calls;
  • Our AI transcription provider — turns your voice-control audio into a text command when you use push-to-talk; audio and transcripts are transient and not retained by us;
  • Email delivery — sends transactional email (account, security, and billing messages);
  • Error and performance logging — limited technical logs used to keep the Service on air.
• Legal reasons. When we believe in good faith that disclosure is necessary to comply with law, valid legal process, or a lawful government request, or to protect the rights, property, or safety of RadioThat, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality safeguards; we will notify you of any change in control that materially affects your data.
• With your direction. When you ask us to share information or make it public inside the Service (for example, a Tastemaker badge visible to other listeners).

We never sell your personal information for money, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

4. Where your information is stored

RadioThat is operated from the United States and our subprocessors may process data in the U.S., the EU, and other countries where they operate. Where required, we rely on appropriate transfer mechanisms (such as the EU Standard Contractual Clauses) for international transfers. Everything but public track audio sits behind row-level security so that only you — and, where necessary, our service role — can read your rows. Audio is served from a public read-only bucket.

5. Cookies and similar technologies

We use a small number of strictly necessary cookies and browser storage entries to keep you signed in, remember your preferences, and secure the Service. We do not use third-party advertising cookies. If you disable strictly necessary cookies the Service may not work. For more detail, see our Cookie Notice.

6. Data retention

We keep personal information for as long as your account is active, and afterward for the shortest period needed to comply with our legal obligations, resolve disputes, and enforce our agreements. Broadly:

• account and profile data — for the life of your account, then deleted or anonymized within 30 days of account closure;
• listening and play history tied to your account — deleted or anonymized within 30 days of account closure;
• votes — when you delete your account, your votes are detached from your identity but the anonymous vote counts remain part of the station's history, because they belong to the crowd's shared record and can no longer be traced back to you;
• billing records — retained for the period required by tax and accounting law (typically up to seven years);
• security and error logs — typically 30–90 days;
• retired tracks — stay in our archive but are never served again.

Deleting your account. You can delete your account at any time from your profile or by emailing privacy@radiothat.com. Your personal data goes with it on the schedule above; the crowd's anonymous vote record stays.

7. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, row-level security in our database, restricted service-role access, secret management for API keys, and least-privilege access controls for the team. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct or update inaccurate information;
• delete your personal information ("right to be forgotten");
• receive a copy of your information in a portable format;
• object to or restrict certain processing, or withdraw consent where processing is based on consent;
• appeal a decision we make about a privacy request;
• lodge a complaint with your local data protection authority.

You can update your profile, rename or delete stations, and change or remove votes at any time from inside the app. To exercise any of the rights above, email privacy@radiothat.com from the address on your account. We will verify your request and respond within the timeframe required by applicable law (typically within 30 days). We will not discriminate against you for exercising a privacy right.

Notice to California residents (CCPA/CPRA). The categories of personal information described in section 1 correspond to CCPA categories of identifiers, commercial information, internet/network activity, geolocation (approximate), audio/electronic information, and inferences. We use and disclose those categories for the business and commercial purposes described in section 2. We do not sell or share personal information for cross-context behavioral advertising.

9. Children

RadioThat is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Third-party links and integrations

The Service may link to third-party sites or integrate with third-party services (like Stripe or Google). Their privacy practices are governed by their own policies, which we encourage you to read.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we will update the date at the top and, for material changes, give reasonable notice through the Service or by email before the changes take effect.

12. Contact us

For privacy questions or to exercise your rights, email privacy@radiothat.com, or use our contact form.