Effective date: 16 September 2026

Sing Song Radio is an internet radio station. You can listen on this website and in the Sing Song Radio mobile app for Android and iOS. This policy explains, in plain words, what data is processed when you do, why, for how long, and what your rights are. It applies to the website singsongradio.com, to the mobile app, and to the public API the app uses.

The short version

• No accounts. There is nothing to register for or log in to. We never ask you for a name, e-mail address or password just to listen.
• No advertising trackers, no selling of data. We do not use advertising networks, social-media pixels or data brokers, and we never sell or rent data about you.
• The app contains no third-party analytics or advertising SDKs. It talks only to our own servers.
• Like every website, our server processes your IP address and browser/app identifier to deliver the stream, keep the service secure and count audience size. That is the main personal data we handle.
• Google Analytics runs only if you click "Accept" in the cookie banner. Rejecting it, or ignoring the banner, means it never loads.

1. Who is responsible for your data (controller)

Sing Song Radio
plac Wolności 6, 61-738 Poznań, Poland
E-mail: [email protected]
Telephone: +48 61 224 88 19

Write to that address or e-mail for any question about this policy or about your data, including to exercise the rights listed in section 8.

2. What we process, and why

2.1 Listening to the station (website and app)

When you press play, your browser or the app asks our server every few seconds what is on air and then streams the audio from our server. Each of those requests carries your IP address and a technical description of your browser or app (the "user agent"). We use this to:

• deliver the audio to your device;
• keep everybody's playback in sync with the station clock;
• protect the service against abuse, for example by limiting how many requests one address may make per minute;
• see how many people are listening.

Legal basis: our legitimate interest in running a working, secure radio service (GDPR Art. 6(1)(f)).

When nothing of ours is on air (no songs, show or live broadcast scheduled), the player falls back to a partner stream hosted by Zeno Media (stream.zenolive.com). While that plays, your device fetches the audio directly from Zeno, so Zeno sees your IP address and user agent for that connection under its own privacy policy. Nothing else about you is sent to Zeno, and we receive no data back from it.

2.2 Server logs

Our web server writes standard access logs (IP address, time, requested URL, response code, user agent, referring page) for every request. They are used only for security, troubleshooting and aggregate statistics. Legal basis: legitimate interest (Art. 6(1)(f)).

2.3 Advertising spots

The station plays short audio spots for local advertisers. To tell an advertiser how many times a spot was heard, we record one "impression" per device per airing. For that we store the airing, the time, your IP address, your user agent and a one-way hash (SHA-256) of either your browser session ID (website) or your IP address plus user agent (app). The hash exists only to avoid counting the same listener twice. Advertisers receive counts only - never IP addresses or any other data about individual listeners. Legal basis: legitimate interest in measuring our own advertising (Art. 6(1)(f)).

2.4 Polls

If you vote in a poll, we store your choice together with your IP address, solely to allow one vote per address. Legal basis: legitimate interest in fair polls (Art. 6(1)(f)).

2.5 Contact form

If you write to us through the contact form (website or app), we store the name, e-mail address, subject and message you enter as a support ticket so that we can answer you. Legal basis: taking steps at your request (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)). Please do not put sensitive personal data in a message.

2.6 Google Analytics (optional, consent only)

The website can use Google Analytics to understand which pages are popular. It is switched off until you click Accept in the cookie banner. If you do, Google sets analytics cookies (for example _ga) and receives information about your visit, including a truncated IP address, under Google's own terms. You can withdraw consent at any time through the Cookie settings link in the footer; the analytics script then stops loading. Legal basis: your consent (Art. 6(1)(a)). The mobile app does not contain Google Analytics or any other analytics.

2.7 Error reports

If something goes wrong on the server, a technical error report is written with the URL, the error message, the IP address and user agent of the request that triggered it. It is used only to fix the fault. Legal basis: legitimate interest (Art. 6(1)(f)).

3. Cookies and similar storage

The website uses only these cookies:

• Session cookie (sing_song_radio_session) - strictly necessary; keeps your visit together and protects the contact and poll forms against forgery. Expires 2 hours after your last request.
• CSRF token (XSRF-TOKEN) - strictly necessary; the security token that goes with the session cookie. Expires 2 hours after your last request.
• Cookie choice (ssr_cookie_consent) - remembers whether you accepted or rejected optional cookies, so we do not ask again. Kept for 6 months.
• Google Analytics (_ga, _ga_*) - optional, set only after you click Accept. Lifetime up to two years, set by Google.

The website does not use local storage, fingerprinting or any other tracking technology. You can listen, browse and use every page without answering the cookie banner; the small bar at the bottom of the page simply stays until you choose. The mobile app uses no cookies at all and keeps its own settings (for example volume) on your phone only. For full details see the Cookie Policy.

4. Who else sees the data (recipients and processors)

• Our hosting provider - runs the server in the European Union on our behalf and stores the logs and database described above.
• Cloudflare, Inc. - sits in front of our website and API as a content-delivery and security network. Every request passes through Cloudflare, which processes your IP address and request headers to block attacks and speed up delivery. Cloudflare acts as our processor under its Data Processing Addendum, which includes the EU Standard Contractual Clauses for any transfer outside the EU/EEA. Cloudflare also asks browsers to report failed connections to it (Network Error Logging); such a report contains the address that failed and no content.
• Google LLC - only if you accepted analytics cookies (section 2.6). In addition, if our own copy of the website font fails to load in your browser, the browser fetches the font from Google Fonts as a fallback; Google then sees your IP address for that request. On a normal visit the font is served from our own server and nothing is sent to Google.
• Zeno Media LLC - hosts the partner stream your device plays when nothing of ours is on air (section 2.1). Zeno sees the IP address and user agent of that connection; we do not receive data from Zeno.
• Google Play and the Apple App Store - if you install the mobile app, the store you use processes the download, updates and any store review under its own privacy policy. We receive only aggregate install statistics from the stores, never data about an individual listener.
• Public authorities - only where the law obliges us.

The footer links to our Facebook and YouTube pages. They are ordinary links, nothing from those networks is embedded in our pages, so nothing is sent to them until you decide to follow a link.

We never sell, rent or share personal data with advertisers, data brokers or social networks. The song descriptions on the site are generated from song titles and artist names only; no listener data is involved.

5. Transfers outside the EU/EEA

Our servers are in the EU. Cloudflare, Google and Zeno Media may process data in other countries, including the United States; they rely on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

6. How long we keep data

• Server access logs: no longer than 12 months.
• Advertising impressions: the IP address and user agent are kept no longer than 12 months; aggregated counts are kept for as long as the advertising reports are needed.
• Poll votes: the IP address is kept for the life of the poll and deleted with it.
• Contact form tickets: until your enquiry is closed, then up to 24 months in case of follow-up questions.
• Error reports: deleted once the fault is fixed, and in any case within 12 months.
• Analytics data (only with consent): as configured in Google Analytics, at most 14 months.

7. The mobile app in particular

• The app has no sign-up, no login and no user profile.
• It sends requests only to our own servers (singsongradio.com) - and, only while nothing of ours is on air, to the partner stream named in section 2.1. The data in those requests is the same as for the website: IP address, app identifier, and - if you use them - your poll vote or contact message.
• It contains no advertising SDK, no analytics SDK, no crash-reporting SDK and no social-media SDK.
• It does not ask for your location, contacts, camera, microphone or photos.
• It does not send push notifications and does not collect a device token.
• Audio may keep playing in the background; that uses only your phone's own media controls.

For the app-store "Data safety" and "App Privacy" declarations this means: data collected - approximate identifiers in the form of IP address and user agent (device or other IDs), used for app functionality, analytics of audience size, and fraud prevention/security; not linked to your identity; not used for tracking; not shared with third parties for advertising.

8. Your rights

Under the GDPR you have the right to:

• ask what personal data we hold about you and receive a copy (access);
• have inaccurate data corrected (rectification);
• have data deleted where there is no longer a reason to keep it (erasure);
• have processing restricted while a question is settled;
• object to processing based on legitimate interest;
• withdraw consent at any time (for analytics cookies: footer > Cookie settings), without affecting processing that happened before;
• receive data you gave us in a machine-readable form (portability), where applicable.

To exercise any of them, e-mail [email protected]. Because we have no accounts, we may need your IP address or the details you entered in a form to find data that relates to you. We answer within one month.

You also have the right to complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You may also complain to the authority of the EU country where you live.

9. Children

Listening to the radio is open to everyone and we do not knowingly collect personal data from children. We do not offer accounts, and the contact form should not be used by children under 16 without a parent's or guardian's agreement.

10. Security

The website and API are served over HTTPS only. Access to the administration area is limited to our own staff with hardened logins, rate limiting and a bot check (Cloudflare Turnstile) on the admin login page. Personal data is stored on the server only, not in third-party tools.

11. Changes to this policy

When something changes, we update this page and the effective date at the top. Material changes will be mentioned on the website. The current version is always at singsongradio.com/policy/privacy-policy.