Privacy Policy

1. Who is responsible

PlayerAudio is a community project. The people operating its account platform and website handle the personal data described in this notice. Contact the project about privacy, access or deletion at:

Independent community hosts are responsible for the processing they determine on their own servers. This notice describes our platform and client-related processing, not every host’s practices.

2. Data we process and why

Account and profile

Email address, verification status, display name, username, optional biography and avatar, account identifiers and timestamps. We also record the Terms and privacy-notice versions presented, agreement time and minimum-age confirmation at signup. We use these to create your account, maintain your profile and help friends find you.

Authentication and security

Password hashes, session tokens and expiry information, session IP addresses and browser/device user agents; passkey public credentials and counters; approved-device public keys and certificates, names and revocation records; hashed desktop-resume credentials and short-lived proof challenges; verification/reset records and rate-limit information. If you enable authenticator-based two-factor authentication, its secret and backup codes are stored encrypted. We use these to authenticate you and prevent abuse. Passkey private keys and biometric templates are not sent to us.

Social and community information

Friend invitations, friendship status, conversation membership, identifiers and message ordering/timing information. The platform keeps a private history of reported community visits, including server identifiers, first/last visits and an aggregated count. Short-lived presence leases support online status for accepted friends.

Encrypted data and files

Encrypted direct messages, device-generation information, encrypted recovery bundles and personal history archives support delivery, recovery and synchronization. The platform is not designed to possess chat decryption keys. The client encrypts chat attachments before uploading them. The platform stores private encrypted file objects for direct messages; independent community hosts store community attachments. File services also process routing information and file sizes. Avatars are public profile images, not encrypted message content.

Reports and moderation

If you submit a report, we receive your account identifier, the reported account or server, category, description, conversation/server identifiers and submission time. A user report includes up to three readable message excerpts from the reported person, which you review before sending. Reports do not upload conversation keys or attached files. Authorized platform administrators can read these excerpts and record review decisions. Account restrictions record a user-facing message, expiry where applicable and internal audit reasons.

Requests and correspondence

Hosting infrastructure processes IP addresses, request times, URLs, device/browser information and security signals to deliver and protect the website, APIs and downloads. If you contact us, we process your address, message and the evidence you provide to respond and resolve the request. Account emails are sent through our email provider.

Most account data comes from you or your devices. Friend requests and messages also come from other users; community records come from hosts and client-reported visits. Administrative audit records identify administrator actions, including profile corrections, session revocations, release publishing and server verification, with reasons and timestamps.

3. Purposes and legal bases

We process information needed to supply your requested account, authentication, messaging and synchronization features to perform our agreement with you (GDPR Article 6(1)(b)). Optional profile fields are processed when you choose to use those features.

Security, abuse prevention, limited operational records and handling complaints rely on our legitimate interests in a secure, reliable service and protecting users (Article 6(1)(f)), subject to your rights and interests. Where a specific legal duty requires processing or disclosure, Article 6(1)(c) applies. If we introduce a feature requiring consent, we will request it separately and explain withdrawal; accepting the Terms is not consent to every use of personal data.

Required account information is necessary to register or use the relevant feature. Without it, we may be unable to provide that feature. Optional profile information can be omitted or removed.

4. Who receives information

Your username, display name and avatar are visible in relevant social/community contexts; anyone with a current avatar URL can retrieve that image. Messages are delivered to conversation participants, who may keep or share their own copies. Accepted friends can see your available online status. Community hosts receive information needed to authenticate and serve your connection, such as your public identity and connection metadata.

Cloudflare provides Worker hosting, D1 account/database storage, Durable Object message services, R2 object storage, network delivery and security. Resend delivers verification, password-reset and account-security emails and processes recipient addresses, email content and delivery information. Ordinary encrypted-chat delivery does not send plaintext chat messages to these providers. When a user submits message excerpts as report evidence, those excerpts are readable by authorized administrators and processed by Cloudflare as part of hosting and database storage. Report evidence is not sent through Resend by this feature. Email verification/reset links themselves are sensitive account data.

We may disclose the minimum necessary information to competent authorities when legally required, or to professional advisers and service providers where necessary for a justified legal or operational purpose. We do not sell personal data or use chat content for advertising. No advertising trackers or third-party marketing analytics are embedded in the current account platform.

5. Hosting and international processing

The production database and private object storage are configured for EU storage. This is not a claim that every request, support operation or provider record stays exclusively in the EU. Cloudflare operates a global network and Resend and their subprocessors may process information outside the EEA, including in the United States.

International processing requires an applicable legal transfer mechanism, such as an adequacy decision or standard contractual clauses with any necessary supplementary safeguards. The providers describe their contractual safeguards and subprocessors in Cloudflare’s data processing addendum and Resend’s data processing addendum. Contact us to request information or a copy of the safeguards applicable to your data.

6. Cookies and local storage

PlayerAudio uses necessary first-party authentication and security cookies for sessions, verification, passkey challenges and enabled two-factor flows. The browser account session has a 30-day validity period and may be renewed through use. Shorter-lived challenge cookies and, where enabled, trusted-device cookies have separate lifetimes. These are used to provide the sign-in and security features you request; we do not set advertising cookies.

Browser session storage temporarily carries a desktop-device approval request and pending email-change link across the account flow. The Windows client stores device keys, preferences and local message history in its Windows-protected encrypted profile. The browser client preview keeps identity/history in memory for that session. Removing cookies or local profiles can sign you out or remove access to locally stored history.

Necessary storage is used for requested functionality under § 25(2) TDDDG where applicable. We would seek consent before adding non-essential tracking that requires it.

7. Retention and deletion

Account/profile records, friendships, device records, reported community history and encrypted message/history data are retained to support the account and its conversations until removed through supported controls or a verified deletion/closure request is processed, subject to a specific continuing legal or security need. The current preview has no automatic expiry policy for message history or community visit records. Reports, submitted message excerpts and moderation audit records support review, appeals and abuse prevention; they have no automated expiry in the current implementation. Contact us to request deletion. We assess any continuing security or legal need before retaining them after a deletion request.

Session access expires after 30 days unless renewed; verification links after one hour; password-reset links after 30 minutes; device approval requests after ten minutes. Presence leases expire after 75 seconds without renewal. These are validity periods, not a promise that every related database record is physically deleted at that exact moment. Desktop-resume credentials are capped at 30 days and cannot outlive the approving browser session; their proof challenges last up to two minutes. Revocation and agreement records may remain necessary to prevent reuse or establish contractual rights and legal claims.

Replacing or removing an avatar schedules deletion of the previous object. Removing a friendship blocks further conversation access but does not delete existing copies from participants’ devices. Expired security/rate-limit records are cleaned through the relevant service flows; we do not promise a universal automated deletion schedule that the preview does not implement.

Provider delivery/security records and recovery copies follow the applicable service configuration and provider retention terms. Resend currently describes 30-day email/log retention for its standard Free, Pro and Scale plans, with different enterprise options; its retention information explains the distinction. We assess deletion requests across active stores and applicable provider recovery mechanisms rather than treating token expiry as erasure.

When deletion is requested, we assess which data can be erased and which, if any, must temporarily remain for a legal obligation, security investigation or legal claim. We explain relevant exceptions. We cannot recall recipients’ copies or independently controlled community data. You can contact those operators separately.

8. Your choices and rights

Use account settings to edit your profile, remove your avatar, manage friendships and revoke sessions/devices. For access, correction, deletion, restriction, portability or an objection to processing based on legitimate interests, email our privacy address. You may also withdraw any separately given consent without affecting earlier lawful processing. Rights are subject to their applicable legal conditions.

We may ask for proportionate proof of identity and normally respond within one month; if the law permits an extension, we will explain it. Do not include your password or recovery keys. There is currently no automated full-account deletion or data-export button; requests are handled through our contact address.

You may complain to a data protection supervisory authority, including in your place of residence or work.

9. Security, age and updates

We use transport encryption, account authentication, access controls and client-side encryption for supported conversations. Encryption does not protect a compromised endpoint or prevent a recipient from copying content. No security measure eliminates all risk. Platform application observability logging is disabled in the production configuration; infrastructure and necessary security processing still take place.

PlayerAudio is intended for people aged 16 and over. We do not ask for a date of birth at registration; we record your confirmation that you meet the minimum age. Contact us if you believe a younger child has supplied data. We do not use automated profiling to make decisions with legal or similarly significant effects; technical authentication and abuse-prevention limits still apply.

We will update this notice when our processing changes and identify the revised version. Material changes will be communicated through an appropriate account or service notice. New processing requiring consent will be presented separately.