Your listening choices and privacy
Favourites and explicit planner choices stay on your device by default. The playback service checks coarse network country without GPS or precise location, and does not create a listening history.
Playback territory
Coarse network country is checked for direct playback. Unknown or untrusted country does not grant playback. Short-lived signed handoffs contain station and policy identifiers, country and expiry; no raw IP or account identifier.
What stays on your device
Your favourites, planner entries, volume, timer and display preferences remain local. Automatic listening-duration history is disabled.
Operational requests
Web requests still reach the hosting provider. This module keeps no raw IP or listening-event log; its abuse counter uses a rotating hash and expires after 60 seconds. Existing hosting and estate service-protection logs are governed separately.
Aggregate API counts
FM keeps seven UTC days of namespace request totals, error counts and broad caller classes. These counters contain no station IDs, queries, tokens, IPs or account identifiers. Anonymous handoff-use hashes contain only a use counter and expiry; expired entries are removed on the next redemption or hourly cleanup, subject to WordPress scheduled-task delivery.
External services
Opening an official player connects you to that broadcaster. Approved direct playback connects your browser to a Radio Browser resolver and then the broadcaster. Their privacy terms apply to those requests.
Accounts and sponsorship
No account is needed for listening options. Optional account sync is not enabled by this upgrade. Disclosed machine sponsorship is response metadata and does not enter broadcaster audio or the rights decision.
Broadcaster requests
If you submit the broadcaster request form, the contact address, station and details you provide are stored privately for operator review. The daily cleanup removes requests older than 90 days. No listening history is attached.