Privacy policy
This site gets by on very little data. What is processed, why and for how long is set out here — without a parade of paragraph numbers.
Controller and Scope
This privacy policy applies to two separate offerings: the website radio-432.com and our app "Radio 432" for iPhone, iPad and Apple TV. The sections on the website concern only your visit to this site. If you use the app, the section "Data processing in the Radio 432 app" applies to you.
Responsible for the data processing within the meaning of Art. 4 No. 7 GDPR is:
AI Mechanic – Inhaber: Matthias Schunk
Dresdener Straße 12
71679 Asperg, Deutschland
kontakt@radio-432.com
Full provider details in the Legal notice.
Where to contact us: Please direct requests concerning your rights under Art. 15 to 22 GDPR to kontakt@radio-432.com. support@radio-432.com is the address for technical questions about the app; any privacy requests received there are forwarded internally.
If you write to us by email (e.g. via the feedback button), we process your email address, your name if provided, and the content of your message in order to respond to your request. The legal basis is our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR); if your enquiry relates to a contract with us, it is Art. 6(1)(b) GDPR. We delete the message once the matter has been resolved, as a rule within six months, unless a statutory retention obligation applies. Our email mailbox is operated by mailbox.org (Berlin, data centres in Germany). An email is not end-to-end encrypted in transit. Clicking the button stores nothing on our server; your email program opens on your device.
No data protection officer has been appointed; the statutory requirements for such an appointment are not met (Art. 37 GDPR, Section 38 BDSG).
Hosting and delivery
This website consists of static pages with no database of its own. It is delivered via Cloudflare's network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). In doing so, Cloudflare processes technically necessary connection data such as your IP address, the time of the request, the address requested, and information about your browser and operating system. A website cannot be delivered without this processing.
The legal basis is our legitimate interest in secure and available operation (Art. 6(1)(f) GDPR).
In the process, data is also transferred to the USA (a third country). Cloudflare acts here as our processor (Art. 28 GDPR) and bases this transfer on the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of these guarantees on request from the address given in the imprint.
Own server for the form and account deletion
Two functions are not delivered via Cloudflare Pages but by a server of our own: the form for the notification list and the page for deleting an account. This server can only be reached through a Cloudflare tunnel; requests therefore also run via Cloudflare, and the information on the transfer to the USA in the preceding paragraph applies accordingly.
This creates technical access logs with the time, requested address, the server's response, amount of data transferred, referring page (referrer), and information about browser and operating system. Your IP address is not included in these logs.
To fend off automated mass requests, your IP address is briefly held in our server’s memory — for about one minute — and compared with the number of requests. If a request is rejected because of too many requests, we store nothing about it; the information disappears after this time, at the latest when the service is restarted.
The logs are not deleted after a fixed period but are continuously overwritten once a defined volume is reached.
These logs contain no visitor IP address, because our server only sees the internal address of the tunnel program in our own network, not yours. The tunnel program does not write a log entry per request. Cloudflare itself sees your IP address, as described above. Because our logs contain no IP address, we do not set a fixed deletion period for them.
Embedded demo player
This website embeds a demo player. It is delivered by our own server; the same provider is responsible as for this website. The player is not loaded automatically: you will first see only the “Try it right now” field with the “Start demo” button. Only when you click “Start demo” does your browser load the player from demo.radio-432.com; before that, no connection to it is made. You do not need an account for the player, and we do not create a user profile. As soon as the player loads, your browser establishes connections, which technically requires transmitting your IP address.
a) Retrieving the player and the station list
The player and a fixed station list compiled by us are loaded from our server. Our server has Cloudflare (Cloudflare, Inc., USA) upstream as our processor (Art. 28 GDPR). In the process, data may reach the USA; Cloudflare bases this on the EU-US Data Privacy Framework and, if this does not apply, on the European Commission's standard contractual clauses (Art. 45, Art. 46(2)(c) GDPR). You can request a copy of the guarantees from us.
b) Station search
You transmit your search term to our server, which then queries the public station directory radio-browser.info. radio-browser.info receives the search term and the address of our server, not your IP address.
c) Listening to the radio
Your browser loads the audio directly from the respective station's server; the station learns your IP address in the process, as with an ordinary website visit. Our server is not involved in this and does not store the audio.
d) Track display
While you are listening to a station, our server briefly connects to its stream approximately every 15 seconds to read out the title and artist of the current track. The audio itself is not stored in the process and is not passed on to you — only the title and artist as text. The station learns the address of our server in the process, not yours.
e) Pitch
You can shift the pitch during playback in your browser (e.g. to 432 Hz). This happens exclusively on your device; no altered copy is stored or transmitted to us.
f) Station logos and cover images
Your browser loads station logos directly from the respective station's website. If a logo is missing, it is queried from Google's favicon service (www.google.com/s2/favicons); the player searches for cover images via Apple's public search (itunes.apple.com). In doing so, Google or Apple learns your IP address. The Google service is provided from the USA; we cannot reliably determine whether the European Commission's adequacy decision covers it, and there is no separate contract with guarantees under Art. 46 GDPR. These providers are themselves responsible for their own processing.
g) Logs and protection against misuse
Our server logs the time, the requested address (including your search term in the case of station search), the response, the data volume and the browser information, but not your IP address. The logs are limited by size; how far back they reach depends on the number of requests. To ward off excessive requests, our server briefly evaluates requests per IP address in memory; this evaluation is not written to disk and is discarded at the latest when the service is restarted.
h) Storage in your browser
As soon as you play a station, the player stores two pieces of information in the local storage (localStorage) of your browser: whether you have already dismissed the installation notice, and, for each station you have played, the pitch measured there. This information remains on your device and is not transmitted to us. The player does not set cookies.
We ourselves determine the favorites list of the demo player; you cannot change, save or delete it.
Legal basis for a) to h): our legitimate interest in showing you, at your request, a functioning preview of our app and in operating the service securely (Art. 6(1)(f) GDPR). You may object to this processing at any time for reasons arising from your particular situation (Art. 21 GDPR); a message to the address given in the imprint is sufficient. For f), you can additionally do this via the operator of the respective service.
Fonts and external content
All fonts are held locally on the server. No Google Fonts and no other external content are loaded — simply reading this page sends no data to third parties other than the host.
Cookies and storage on your device
This website does not set cookies for analytics or advertising purposes and does not integrate any analytics services.
We store your design choice in your browser's local storage (localStorage). This information does not leave your device.
Likewise, we store in your browser's local storage (localStorage): whether you have already seen the language selection and which language you chose, as well as whether you have already dismissed the notice about AI-generated music. This information, too, does not leave your device.
The website is delivered via Cloudflare's network. In doing so, Cloudflare may set a technically necessary cookie to fend off automated access. Consent is not required for this (Section 25 (2) No. 2 TDDDG); the legal basis for the associated processing is our legitimate interest in secure operation (Art. 6 (1)(f) GDPR).
This cookie is called `cf_clearance`. It is only set when the bot protection actually carries out such a security check, and may in individual cases be combined with a security challenge (CAPTCHA).
Notification list
As soon as a page with the registration form is opened, your browser asks our server (app.radio-432.com) whether registration is open and whether places are still available. No information from the form is transmitted in the process, and nothing is stored on your device. The request runs via Cloudflare (see “Hosting and delivery”); for technical reasons, Cloudflare and our server see your IP address. It is not stored in our server’s logs; there it is only evaluated briefly in order to fend off excessive requests. The legal basis is our legitimate interest in displaying the form correctly and protecting the service from abuse (Art. 6(1)(f) GDPR).
When you register, we transmit to our own server: your name, your email address, your platform choice, your indication of interest in an Android version, and your consents. We additionally store the time of each consent, the version of the consent text, and the time of registration and its status. The purpose of this data is to manage the list: notifying you once the app is available for your chosen platform (for iPhone, iPad and Apple TV in the App Store, for Android once an Android version exists), and — only with separate consent — occasional news about Radio432.
This server is operated by us ourselves. Because it can only be reached through a Cloudflare tunnel, your entries when registering also run via Cloudflare; a transfer to the USA takes place to the extent described in the section “Hosting and delivery” (data processing under Art. 28 GDPR, EU standard contractual clauses).
The registration only becomes effective once you confirm it via the link in the confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time and request deletion of your data — an email to the address given in the imprint is sufficient.
To send the confirmation email and — where you have given the separate consent — the occasional news emails, we use our email service provider Brevo (Sendinblue GmbH). To ensure data-protection-compliant processing, we have entered into a data processing agreement under Art. 28 GDPR with both Cloudflare and Brevo.
If, when registering, you tick the box „I would like to occasionally receive news about Radio 432 by email“, we additionally use your email address to occasionally send you news about Radio 432. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, free of charge — via the unsubscribe link in each email or by writing to the address given in the imprint. After a withdrawal, we delete your entry; we do not maintain a blocklist.
Storage period
If you have not consented to receiving occasional news and have not indicated interest in an Android version, we delete your entry at the latest three calendar months after a decision has been made about it (invitation or rejection), or at the latest three months after the app's release if no decision has been made by then. If you have an active test access at that time, this deadline shifts to three months after it ends.
If you have additionally consented to receiving occasional news, we store your entry beyond that point until you revoke this consent.
If you have indicated interest in an Android version, we store your entry until the Android version has been released and we have notified you; we then delete it within three months. So that the entry is not stored indefinitely, we ask you by email twelve months after your registration, and every twelve months thereafter, whether your interest continues. If you do not confirm within 30 days, we delete your entry. If you have additionally consented to receiving occasional news, the previous paragraph applies to that consent.
Unconfirmed registrations — without a click on the confirmation link — are automatically removed after a short period.
For resilience, we back up our database regularly; we keep these backup copies for a maximum of 14 days and then delete them automatically.
Data processing in the "Radio 432" app
This section applies to our app "Radio 432" for iPhone, iPad and Apple TV. To listen to the radio, you need no account and no sign-in. The app contains no advertising, no analytics services, no crash reporters and no third-party tracking components. We do not create usage profiles and do not share data for advertising purposes. The radio stations you select may broadcast their own advertising as part of their programme; we have no influence over this.
Several features of the app connect to servers that do not belong to us. With every such connection, the respective operator technically and unavoidably learns the IP address of your device. We have no influence over this; the respective operator is solely responsible for processing there (Art. 4(7) GDPR). Which operators these are in detail is set out in the following letters.
a) Listening to the radio
The radio stations are not operated by us. When you start a station, your device establishes a direct connection to that station's server. In doing so, your IP address and our app's identifier ("Radio432CarPlayApp/1.0") are transmitted to that server. This connection does not run through our servers. We do not learn which station you are listening to and do not store that information. The legal basis is the performance of the contract for the use of the app (Art. 6(1)(b) GDPR): without this connection, there is no sound.
Retuning to 432 Hz and any other audio processing take place exclusively on your device. No audio is ever routed through our servers.
b) Station directory
The app does not come with its own station list. To search for and display stations, it queries the public directory radio-browser.info (addresses all.api.radio-browser.info and de1.api.radio-browser.info). In doing so, your device transmits its IP address, our app identifier and your search term to that directory's operator, who is solely responsible for it. Without this query, no station could be selected; the legal basis is therefore Art. 6(1)(b) GDPR.
c) Station logos
For a logo to appear in the station list, the app looks for one in four places: in a logo list on our own servers, on the station's own website, at the radio-browser.info directory, and at Google's favicon service.
When you retrieve a logo list from us, your IP address reaches us in the process. How our logs work is described under letter l.
The station list contains stations from all over the world. If the app looks for a logo on a station's website, your device connects directly to that station's server — even if it is located outside the European Union. The operator thereby learns your IP address, your approximate location and the time. We have no influence over these operators, do not select them, and cannot provide any contractual guarantees under Art. 46 GDPR for these transfers. The connection is established automatically whenever a station logo is needed and the "Load station logos" switch is turned on.
The legal basis is our legitimate interest in displaying stations in the list recognisably with their logo (Art. 6(1)(f) GDPR). You may object to this processing at any time (Art. 21 GDPR): turn off the "Load station logos" switch in the app's settings. The app then no longer queries any of the four sources named above. It is switched on by default.
d) Logo lookup via Google's favicon service
If the app cannot find a usable logo from our own logo list, it queries Google's favicon service. This happens automatically whenever a station logo is needed and the "Load station logos" switch is turned on — without you doing anything with Google yourself.
This transmits the IP address of your device and the domain of the station. From this it can be inferred which stations are displayed to you and which station you are listening to.
The app does not accept any cookies for this request and does not send any along. Which standard information the operating system additionally sends along with such a request is also outside our control.
The recipient is a company of the Google group of companies (category: image service provider) as operator of this favicon service.
Transfer to the USA: The service is provided from the USA; your IP address may arrive there. There is an adequacy decision of the European Commission for the USA, but it applies only to companies certified there. Whether it covers this service, we cannot reliably determine. We have no separate contract with guarantees under Art. 46 GDPR. We can therefore make no assurances about what happens to the data there.
The legal basis is our legitimate interest in displaying station logos (Art. 6(1)(f) GDPR). You may object to this processing at any time (Art. 21 GDPR): turn off the "Load station logos" switch in the app's settings. The app then no longer queries Google's favicon service.
e) Cover art
If the station transmits the title and artist of the current track, the app searches Apple's public (iTunes) search for a cover image. In doing so, the search term made up of title and artist, your device's region setting and your IP address are transmitted to Apple. Apple is solely responsible for this.
In the process, data may also be processed outside the European Union; Apple is independently responsible for this.
The legal basis is our legitimate interest in an appealing presentation of the current broadcast (Art. 6(1)(f) GDPR). You may object to this processing at any time (Art. 21 GDPR): turn off the "Load album covers" switch in the app's settings. The app then makes no request to Apple, and the title, artist and country setting are not transmitted. It is switched on by default.
f) Settings, favourites and iCloud
Your favorites, the retuning level chosen for each station, your app settings, your listening positions and the start date of the trial week (see letter o) are synced between your devices via your own iCloud account (Apple's key-value store). This data resides in your iCloud account; we have no access to it. Apple is responsible for iCloud. You can disable this sync for this app in the iOS settings. The legal basis is the provision of the app features you use (Art. 6(1)(b) GDPR).
Volume, display settings and the last station listened to remain exclusively on the respective device and are not synced.
g) Block list of reported stations
We keep a list of stations that have been reported to us and that we no longer offer, for example because a station itself asked to be removed or because unlawful content was reported to us. So that the app can hide these stations, it loads the list from our servers (sperrliste.radio-432.com, alternatively app.radio-432.com): at every launch and, while the app is in use, whenever the last successful download is older than six hours. The app checks this when you bring it back to the foreground, when you start a station, and once an hour. The app stores the most recently loaded list and the time of the last successful download on your device. The request contains no identifier of your device or of you and no cookies; our app identifies itself only by its name ("Radio432CarPlayApp"). It does not tell us which stations you listen to. The list itself only contains information about stations, not about users.
For this request, our servers neither log your IP address nor evaluate it to limit excessive requests. What the log contains, and that the Cloudflare service is placed in front of our servers, is described under letter l.
This retrieval cannot be switched off, not even with the station logo switch, because otherwise the app would keep showing reported stations. The legal basis is our legitimate interest in not offering reported and possibly unlawful content and in reliably carrying out stations' removal requests (Art. 6(1)(f) GDPR). You may object to this processing under Art. 21 GDPR. Because the list is retrieved without any identifier, we cannot technically assign an objection to an individual device. The retrieval stops when you no longer use the app or delete it.
i) Playback across multiple rooms
For playback across multiple devices, the app searches exclusively your local network (for example, your Wi-Fi at home) for other devices with this app, using Apple's Bonjour technology. In doing so, the audio as well as the title and artist of the current track are transmitted between your devices. The audio, as well as the title and artist, are transmitted directly between your devices and are not stored by us. Our servers are not involved in this. The legal basis is the provision of the multi-room playback you selected (Art. 6(1)(b) GDPR).
j) Favorites — no account with us
The app does not offer any connection to an account with us. The app stores your favorites on your device; it does not transmit anything to our servers for this purpose. Whether your favorites are additionally synced between your devices via your own iCloud account, and how to turn this off, is described under letter f. We have no access to this data.
k) Crash and diagnostic data, reporting a problem
Crash and diagnostic data are stored exclusively on your device and are not automatically transmitted to us. We do not use any third-party service for this.
Via "Report a problem" you can describe an issue to us. The app compiles a text with technical details for this: app and system version, your device's model identifier (for example "iPhone14,5" — not your device's name), language and region settings, the time, whether something is currently playing and from which type of source, the target frequency set, the number of connected devices, and measurements on throttling, temperature and low-power mode. Deliberately not included are the device name, the station currently playing, title and artist, your favorites.
You see the complete text before it leaves the device, can shorten it, and send it yourself — nothing is transmitted in the background. Only once you send the email do we receive this information together with your sender address. The legal basis is the handling of your request (Art. 6(1)(b) GDPR; for requests without a usage relationship, point (f) — our legitimate interest lies in answering your request and fixing the reported issue).
How long your message and our reply are kept depends on whether your matter is resolved and whether follow-up questions on the same issue are to be expected; insofar as correspondence is relevant for tax purposes, the statutory tax retention periods apply (Section 147 AO). There is currently no automatic deletion rule for the mailbox; we delete manually.
l) Logs of our servers
The app contacts our servers for two purposes: to retrieve the logo list (letter c) and to retrieve the block list of reported stations (letter g). For each retrieval the server records a log entry: time, requested address, the server's response, amount of data transferred, where applicable the referring page, and the device information. On our servers, your IP address is not logged: the log line shows the address of our own relay service, not yours.
Within our servers, your IP address is evaluated (not for the block list retrieval, letter g) to throttle too many requests in a short time; it is kept in memory for up to 60 seconds and is only written to a log in the event of abuse. The same limitation as above applies to this entry: it is kept in the application log, which is likewise rotated by size — there is no fixed retention period in days here either.
The logs are limited by size, not by time: they run in a fixed-size ring buffer — once it is full, the oldest part is overwritten. How far back the logs reach therefore depends on how heavily the servers are used; there is no fixed retention period. The legal basis is our legitimate interest in secure, trouble-free operation (Art. 6(1)(f) GDPR); you may object to this processing under Art. 21 GDPR.
Our servers are placed behind the service Cloudflare (Cloudflare, Inc., USA). In doing so, connection data including your IP address is routed through Cloudflare's servers and processed there. Cloudflare acts in this respect as a processor for us (Art. 28 GDPR). A transfer to the USA may occur; Cloudflare bases such transfers on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Which logs Cloudflare keeps on its own side is governed by Cloudflare's own statements; the statement above concerns only our own logs. You can obtain a copy of these standard contractual clauses on request at kontakt@radio-432.com.
m) Purchases in the App Store
Purchase of the app is handled exclusively via the App Store; Apple is responsible for this. We are not involved in payment processing. From Apple we receive billing and sales reports with aggregated figures — such as period, country, unit counts and revenue. We do not receive names, addresses, email addresses or payment details of buyers from this.
Crash reports collected by Apple itself are subject to Apple's own privacy terms; you decide whether to take part in your device's settings.
n) Support
For questions about the app, you can reach us via our support page or at support@radio-432.com. The same applies to retention of your message as under letter k: what is decisive is whether your matter is resolved, follow-up questions to be expected, and, insofar as the correspondence is relevant for tax purposes, the statutory tax retention periods (Section 147 AO); there is currently no automatic deletion rule for the mailbox. The legal basis is the handling of your request (Art. 6(1)(b) GDPR; for requests without a usage relationship, point (f) — legitimate interest in answering it).
o) Free trial week
Radio 432 can be tried for seven days without a subscription and without a payment method. The trial week only starts when you tap "Try free for 7 days" in the app. So that the week does not start over after the app has been deleted and downloaded again, or on another device with the same Apple ID, the app then stores the start date (only this date) in two places: (1) an entry in your device's keychain, which may be retained even after the app is deleted, and (2) your iCloud key-value store (letter f). To check the trial, the app takes the earlier of the two dates. The date is not transmitted to us; we have no access to it. The app does not delete the entry; it remains stored for as long as it exists on your device or in your iCloud account. If you switch off iCloud sync for this app, (2) no longer applies. The legal basis is the provision of the trial week you started (Art. 6(1)(b) GDPR).
Right to object
You may object at any time to the processing under c), d), e), g) and l) (Art. 21 GDPR). These are the processing activities we base on a legitimate interest; this also applies to k) and n), insofar as we rely there — for requests without an existing usage relationship — on a legitimate interest. For the station logos (c, d) and the album covers (e), you exercise this right directly in the app: turn off the "Load station logos" or "Load album covers" switch in Settings, as applicable. From that moment on, the respective requests no longer take place; no reason is required. If a switch is missing in your app, please update it via the App Store. To object to the block list retrieval (g), our server logs (l) as well as to k) and n), an informal message to kontakt@radio-432.com is sufficient. For the special case of g), see there.
Are you required to give us data?
There is no account with us. Without the connections described above, however, individual features will not work — without a connection to the station, for example, there is no sound.
Automated decisions
Automated decision-making, including profiling, under Art. 22 GDPR does not take place.
You will find your rights as a data subject and your right to complain to the supervisory authority in the following sections of this policy.
Your rights
You have the right to access your stored data, to rectification, erasure, restriction of processing and data portability, as well as the right to withdraw a given consent at any time. You may also lodge a complaint with a data protection supervisory authority. For all of this, please contact the address given in the imprint. Insofar as processing is based on a legitimate interest (server logs), you also have a right to object under Art. 21 GDPR.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority — the competent authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW).