Privacy policy

This covers personal data held by FYNN YATES NETWORK DEVELOPERS, which operates FYN Radio. It is written to describe what the system actually stores rather than to cover every eventuality.

What we know about your listeners

While someone is listening to a station, the station's owner can see in their dashboard that listener's IP address, the country it is in, the player they are using and how long they have been listening. That is a live view of who is connected and nothing more. It is refreshed every 30 seconds and gone about a minute and a half after they stop. It is never written to our database, and our streaming servers are set not to log listeners at all.

What we keep is totals. We record how many people were listening and how much audio was sent, and, for each day, how many hours were listened from each country and on each kind of player. The address becomes a country on the streaming server and is not stored. What we keep reads like "Kenya, 31 listening hours on 12 October".

If you run a station, the addresses in that live view are your listeners' personal data. Use them for running your station, not for anything your listeners would not expect.

What we hold about you

Your account

Your name, email address and country. A phone number only if you choose to pay by M-Pesa, which requires one, and with each M-Pesa payment the number its request was sent to. Your password is stored only as a hash that cannot be reversed.

Your stations

The name, display name, genre, description and website you give each station, and its technical settings. Some of these are broadcast in your stream's metadata by design, and are public.

What you upload

Your audio files and playlists. These are yours. We store them so your station can play them and for no other purpose. We do not analyse them, index them or share them.

Billing

Your balance, every charge and payment, and a reference from the payment provider. We never see or store your card number or your mobile money PIN: those go to the provider, not to us.

Station activity

Listener counts over time, listening time by country and by kind of player, what your station was playing, and a log of events such as your encoder connecting and disconnecting, and restarts you requested.

Your own visits to the dashboard

When you sign in we keep a session, which is what keeps you signed in. It holds which account you are and nothing else about you, not your IP address or your browser, and it ends when you sign out or stop using the dashboard. This is about you as a customer, not about your listeners.

Your account's activity

A record of what was done on your account and by whom: signing in, changes to your stations, music, billing and integrations, and anything our support staff did on it. Sign-ins and security changes, such as a new password, also record the IP address and browser they came from. You can see and download it under Account, Activity.

If we suspend your account

When it was suspended, the reason we gave you and which of our staff did it, as the terms describe. The suspension and its lifting also appear in your account's activity.

Security records

To spot and stop attacks on the service: failed sign-ins and refused two-step codes, with the IP address they came from, in your account's activity. And things tried without an account, such as a sign-in to an address that has no account, an API key we never issued or a payment notification that failed its checks: counted by the IP address they came from and the hour. What was typed or sent is never kept. Addresses we block from the service are kept with the reason for as long as the block lasts.

What we do not do

• No advertising, and no advertising network has any access to your stream or to this website
• No advertising or analytics scripts, and nothing that follows you between sites. One third-party script runs here and only on our forms: Cloudflare Turnstile, described below
• No cookie banner, because there is nothing to consent to beyond the cookie that signs you in
• We do not sell or rent personal data to anyone, for any purpose
• We do not use your audio to train anything

Who else processes it

Only the services needed to run the platform, each handling the minimum for its job:

• PayPal, to take card and PayPal payments. They receive your payment details directly
• An M-Pesa payment provider, where M-Pesa is available. They receive your phone number and the amount
• Backblaze B2, which stores your uploaded audio files
• Cloudflare, which provides DNS for station hostnames and serves your media files to our own streaming servers
• An email provider, to deliver the messages we send you
• Cloudflare Turnstile, which checks that a form was filled in by a person. It runs on our sign in, signup, contact and application forms and nowhere else

About Turnstile

Turnstile is how we keep automated submissions off the forms without making you read distorted words or pick out traffic lights. It looks at how the browser behaves, and for most people it resolves without a click.

Cloudflare states that it is not used to track you across sites and does not build an advertising profile from it. It is still a script served by somebody else, which is why it is named here rather than quietly included. It runs only on pages with a form on them, so reading the site never loads it.

Our streaming servers deliberately hold no credentials for any of these. If one of those machines were compromised, the attacker would not gain access to your payment provider, your files or our DNS.

How long we keep it

• Account details: while your account is open, then deleted on request
• Uploaded audio: until you delete it, or until a station is closed, at which point it is permanently deleted. Closure does not happen sooner than 30 days after a station stops, and we email you first
• Detailed listener counts: 13 months, then dropped. Daily summaries are kept longer for your own charts
• Billing records: kept after your account closes, because we are required to keep them. They contain what was charged and when, not payment credentials
• Login sessions: expire on their own and are removed
• Account activity: 90 days on the dashboard, then archived, encrypted, for two years in all, and downloadable by you throughout. Then deleted
• Emails we send you: who each went to, its subject and whether it arrived, for 90 days. Not the email itself
• Things tried without an account: 90 days
• Blocked addresses: until the block ends, then 30 days

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email [email protected] and we will act on it within a month, normally much sooner.

Two things we cannot delete on request. Billing records, because we are required to keep them. And your station's name, which we retain permanently but which is not personal data unless you chose to make it your own name: we keep it so that the address your listeners saved never starts pointing at a different broadcaster.

Security

Traffic to this site and to your dashboard is encrypted, and so is every station stream. Your station's source and admin passwords are stored encrypted rather than in plain text, because you have to be able to read them back to put them into your encoder. Your login password is not stored at all, only a hash of it.

We use the security records above to find attacks and misuse while they are happening: to block an address, to see when an account is being tried, and, where the terms allow it, to suspend an account.

If you believe you have found a security problem, email [email protected]. We would much rather hear from you than not.

Children

The service is not intended for children, and an account holder must be old enough to enter a contract where they live. Plenty of school and youth stations run on here, and those accounts are held by the school or the responsible adult.

Changes

If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top reflects the last substantive change.

Contact

FYNN YATES NETWORK DEVELOPERS, operating FYN Radio. Email [email protected].