Privacy policy

namiFM is an independent radio directory. We do not sell user data and do not embed third-party tracking outside what users explicitly consent to via the cookie banner.

What we collect

• Account data if you sign up: email, username, OAuth profile basics. Never sold.
• Anonymous playback telemetry to compute station quality scores. No user identifier in beacons; see /telemetry for details.
• Listening history only if you explicitly opt in under Settings.
• Aggregate search and browse counts. When anyone searches or browses (signed in or not), we record the normalized query or tag/country/page, a coarse country code, and a timestamp. No user ID, no IP, no session, no fingerprint. Individual rows are deleted after 30 days; only daily aggregate totals are kept long-term, and only items reaching at least 5 occurrences in a period are ever shown in admin reports.

How we determine your country

We read a country code (e.g. US, DE) from the request headers added by our reverse proxy and CDN. We do not run IP-based geolocation ourselves and we do not store your IP for this purpose. If the header is missing the country field is recorded as empty.

How we handle network addresses (IP)

• For rate limiting and abuse prevention, we compute a salted hash of your IP combined with a daily-rotating secret. The hash lets us recognize repeated requests within the day; the next day's salt resets the identity. We do not keep your raw IP for this purpose.
• We log the raw IP only when a security event happens: a failed login, a rate-limit threshold being crossed, a DMCA report, or a payment failure. These entries live in our security audit log for 90 days, then are purged.
• We never record the raw IP of normal browsing or playback requests.

Aggregate visitor analytics (Plausible)

We run a self-hosted Plausible instance for aggregate page-view counts. Plausible is cookieless, uses a daily-rotating hash to count unique visitors, and is only loaded after you accept analytics in our cookie banner. If you decline, no Plausible script loads and no data is sent.

Retention summary

Data	Retention
Account data	Until you delete your account
Playback telemetry beacons	30 days, then aggregated
Search / browse events	30 days, then aggregated
Aggregate daily counts	Indefinite (no personal data)
Security audit log (with raw IP)	90 days
Plausible analytics	Indefinite at aggregate level only

What we don't do

• We never proxy or modify station audio. Your browser connects directly to the broadcaster.
• We never sell user data to brokers.
• We do not store per-user search or browse history, and do not build a profile of what individual users look at.
• We do not log the raw IP of normal browsing or playback — only of security-sensitive events.
• We do not use persistent browser fingerprinting.
• We honor Sec-GPC and CCPA opt-out signals globally.