Privacy Policy

This is a translation. Only the German version is legally binding.

With this Privacy Policy, we inform you about the nature, scope, and purposes of the processing of personal data in connection with our website and the mobile app “SoundNode – Radio Player.”

1. Data Controller

The entity responsible for data processing is:

Matthes Vogel
Ginnheimer Str. 48
60487 Frankfurt am Main
Germany
Phone: 069-17326903
Email: [email protected]
Legal Notice: https://soundnode.de/impressum

2. Scope

This Privacy Policy applies to:

our website,
our backend at soundnode.de, in particular the API endpoints provided there,
The "SoundNode – Radio Player" mobile app for Android (including Android TV) and iOS.

Personal data refers to any information relating to an identified or identifiable natural person. This includes, in particular, IP addresses, device identifiers, pseudonymous tokens, usage data, and communication data.

3. Legal Basis for Processing

We process personal data based on the following legal grounds:

Art. 6(1)(a) GDPR – Consent,
Art. 6(1)(b) GDPR – Performance of a contract or implementation of precontractual measures,
Art. 6(1)(c) GDPR – Compliance with legal obligations,
Art. 6(1)(f) GDPR – legitimate interests in the secure, stable, cost-effective, and user-friendly operation of our services.

To the extent that information is stored on or retrieved from your device, this is done—depending on the specific case—on the basis of Section 25(1) of the TDDDG (consent) or Section 25(2) of the TDDDG (technically necessary processes).

4. Website

4.1 Hosting and Server Log Files

Our website is hosted by an external hosting provider. In doing so, the data that is technically necessary to provide the website and ensure its stability and security is processed.

Hosting provider:
netcup GmbH
Emmy-Noether-Straße 10
D-76131 Karlsruhe

When the website is used for informational purposes only, we process the following data in particular:

IP address,
Date and time of access,
Time zone difference from Greenwich Mean Time (GMT),
HTTP status code,
Amount of data transferred,
Referrer URL,
Browser type and browser version,
Operating system,
Pages and subpages visited.

Purpose: To provide the website, ensure system security, analyze errors, detect misuse, and prevent unauthorized access.

Legal basis: Art. 6(1)(f) of the GDPR.

Retention period: generally 7 days, unless longer retention is necessary for evidentiary purposes, to analyze malfunctions, or to defend against attacks.

4.2 Contacting Us

If you contact us via email, phone, mail, the contact form, or by any other means, we will process the data you provide (e.g., name, email address, phone number, content of the inquiry) in order to handle your inquiry.

Purpose: Communication, processing inquiries, initiating contracts, providing support, and maintaining a record of correspondence.

Legal basis: Art. 6(1)(b) of the GDPR, insofar as the request relates to a contract or concerns an existing contract; otherwise, Art. 6(1)(f) of the GDPR.

Retention period: generally until the processing is completed and beyond, to the extent that statutory retention obligations apply or we have a legitimate interest in the documentation; otherwise, regular review of the necessity, typically no later than after 2 years.

4.3 Comment feature on the blog (if available)

To the extent that a comment feature is provided on our website, we process the content you enter as well as technical metadata. To protect our rights and prevent illegal content, we may also process your IP address.

Purpose: To provide a comment feature, prevent abuse, and pursue legal action against illegal content.

Legal basis: Art. 6(1)(f) of the GDPR.

Retention period: Comments are generally retained until the post or comment is deleted; IP-related log data is generally retained for up to 14 days, unless longer retention is necessary.

4.4 Cookies, Local Storage, and Consent Management

Our website may use technically necessary cookies as well as—only with your consent—other cookies, similar technologies, or local storage, particularly in connection with embedded media and advertising.

If your consent is required for this purpose, we will obtain it in advance through a consent management process. You may revoke or modify any consent you have given at any time, effective for the future.

Legal basis: Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR, to the extent that consent is required; for technically necessary processes, Section 25(2) of the TDDDG and Article 6(1)(f) of the GDPR.

4.5 YouTube

We may embed videos from YouTube on our website. The provider is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. For users in the European Economic Area, data processing may also be carried out by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When loading an embedded YouTube video, personal data may be transmitted to YouTube or Google, specifically your IP address, technical information about your browser and device, and usage data related to the video in question. To the extent that YouTube uses cookies or similar technologies, or stores or reads information on your device, this is done only with your consent, to the extent that such consent is required by law.

Purpose: Provision and playback of video content.

Legal basis: Art. 6(1)(a) of the GDPR in conjunction with § 25(1) of the TDDDG, to the extent that consent is required; otherwise, Art. 6(1)(f) of the GDPR.

Recipients: YouTube LLC / Google Ireland Limited / Google LLC.

Note: If embedded videos are provided in enhanced privacy mode, this may limit personalization; however, data may still be transmitted to YouTube or Google when the player loads.

4.6 Google AdSense

We may use Google AdSense on our website to display advertisements. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. As part of the provision of services, data processing may also be carried out by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

In connection with Google AdSense, personal data may be processed, including, in particular, IP addresses, device and browser information, advertising and usage data, as well as information from cookies or similar technologies. Depending on the selected configuration, personalized or non-personalized ads may be served.

Purpose: To finance our online services through advertising, measure reach, prevent fraud, and optimize ad delivery.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG, to the extent that consent is required. To the extent that technically necessary processes take place without consent, processing is based on Article 6(1)(f) of the GDPR in conjunction with Section 25(2) of the TDDDG.

Withdrawal: You may withdraw or modify any consent you have given at any time via our consent management system, effective for the future.

5. "SoundNode – Radio Player" mobile app

5.1 Availability of the App and Basic Technical Features

When you use the app, we process personal data to the extent necessary to provide the app, play radio streams, save settings, unlock premium features, localize content, and ensure the security and stability of the app and the API.

In addition to mobile devices (Android and iOS), the app is also available on Android TV. On Android TV, the app is presented in a layout adapted to the lean-back interface and D-pad navigation. No ads are displayed on Android TV.

Legal basis: Article 6(1)(b) of the GDPR, insofar as the processing is necessary to provide expressly requested functions, and, in addition, Article 6(1)(f) of the GDPR.

5.2 Device Registration and Device-Specific Identifiers

When a device is registered for the first time, the following data may be transmitted to our backend at soundnode.de:

a randomly generated installation identifier (UUID) that is not related to any hardware or system identifiers,
Device name or designation (e.g., manufacturer and model),
Platform (Android/iOS),
App version.

During registration, a device-specific token is generated or assigned. The device ID and device token are stored locally in a secure storage environment. According to the available technical specifications, the token is valid for 30 days; it is automatically renewed as needed.

Purpose: technical device mapping, session management, securing the API, preventing misuse, maintaining app functionality, and recognizing a device without a traditional user account.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

5.3 API Communication for Every Request

During communication between the app and the backend, technical headers and connection data are processed in API requests. This includes, in particular, a device-specific token as well as other technical authentication and security parameters. In addition, the end device’s language preference may be transmitted as a language parameter, particularly if the device’s language is not German.

According to the information provided, API communication with our backend takes place via HTTPS, specifically through endpoints at https://soundnode.de/wp-json/ssm/v2.

Purpose: App authentication, provision of station data and configurations, language localization, abuse detection, and API stability and security.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

5.4 IP-Based Geolocation via Cloudflare

To determine the regional location and sort radio stations by geographic area, our backend can process location information derived from the IP address on the server side. For this purpose, we use Cloudflare as a CDN and security service.

The app does not use GPS to determine your location. Specifically, the country and, if applicable, the region are processed on the server side. The app does not request location permission for this purpose.

Purpose: geo-based playback and sorting of stations, technical optimization, and protection of our service.

Legal basis: Art. 6(1)(f) of the GDPR.

5.5 Streaming and Accessing Station Content

When you play a radio station, the connection data required for streaming is processed. This includes, in particular, the IP address, technical connection data, and the retrieval of the respective stream URL.

To the extent that radio streams are loaded directly from the servers of the respective broadcasters, hosting service providers, or CDN providers, a direct connection is established between your device and the respective stream provider. We have no influence over the data processing carried out by these third-party providers other than insofar as we integrate the respective stream source into the app.

Purpose: To play radio streams.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

5.6 Song/Artist Tracking

During playback, information about the content currently being played may be transmitted to our backend at regular intervals and when switching stations. This includes, in particular:

Station ID,
Stage name,
Song title.

According to the available technical specifications, this transmission typically occurs about every 30 seconds or when switching stations. Failed transmissions can be temporarily cached locally and transmitted in batches later.

Purpose: To provide and update track information, improve data quality, analyze station usage statistics, ensure technical functionality, and prevent misuse.

Legal basis: Art. 6(1)(f) of the GDPR; insofar as the processing directly serves the playback function you have requested, Art. 6(1)(b) of the GDPR also applies.

5.7 Station Reviews

You can rate stations in the app. When you do so, we process the respective station ID as well as the rating you submit. This information is associated with your specific device—in particular, via the device token—to technically limit multiple submissions and protect the integrity of the rating system.

Purpose: To provide the rating feature, prevent misuse, and improve our service.

Legal basis: Art. 6(1)(b) of the GDPR, provided that you actively use the feature, as well as Art. 6(1)(f) of the GDPR.

5.8 Local Storage in the App

The app stores various types of information locally on your device. This may include, in particular:

Favorites lists,
Most recently listened to station,
Alarm clocks and associated stations,
Settings such as Theme Mode or “Wi-Fi only,”
Local cache of the Premium status,
Station caches,
locally cached station logos/thumbnails,
locally stored radio recordings (audio files and associated metadata),
Cached user profile (for logged-in users).

Unless otherwise specified in this privacy policy, this data is generally not automatically synchronized with our server.

Purpose: App functionality, user convenience, faster loading times, and restoration of settings and alarms.

Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR, and § 25(2) TDDDG, to the extent that storage is technically necessary.

5.9 Secure Local Storage

Technical information requiring special protection, such as device tokens, device IDs, and token expiration dates, can be stored in a separately protected storage environment on the end device.

Purpose: secure device authentication and session management.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

5.10 Google AdMob and Google UMP (Advertising and Consent Management)

In the app, non-premium users may see advertisements via Google AdMob. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. As part of the provision of services, data processing may also be carried out by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

According to the available technical information, the app uses the Google Mobile Ads SDK. Depending on the configuration, region, consent status, and Google’s requirements, this may involve the processing of, in particular, IP addresses, device and account identifiers, diagnostic information, and interaction data related to ads. According to the available information, the app is set up by default to display non-personalized ads; however, data may be processed for ad delivery, audience measurement, fraud prevention, and technical optimization.

To obtain and manage your privacy preferences, the app also uses the Google User Messaging Platform (UMP). If consent is required, it is obtained when the app is launched or as part of the privacy policy prompt. You can change or revoke your selections in the app settings under “Privacy Settings,” effective for the future.

Purpose: Displaying and managing advertisements, financing the service, measuring reach, managing consent, preventing fraud, and technical optimization.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG, to the extent that consent is required. To the extent that processing is carried out solely for technically necessary purposes without consent, such processing is additionally based on Article 6(1)(f) of the GDPR.

5.11 In-App Purchases via Google Play Billing

For premium features, the app may offer in-app purchases via Google Play Billing, specifically for the product “soundnode_premium.” Payment processing is handled by Google Play and thus by Google as the independent provider. We receive from Google or the app only the information necessary to activate, assign, and temporarily store the premium status.

According to the available technical information, payment data is not transmitted directly to our own server. A local cache of the premium status may be stored on the user’s device.

Purpose: Processing and verifying in-app purchases; unlocking premium features.

Legal basis: Art. 6(1)(b) of the GDPR.

5.12 Google Cast / Chromecast

When you use the Chromecast feature, the app processes data to detect available Cast devices on the local network and to transmit streaming information to the Cast system. This may include, in particular, the stream URL, station name, and session-related Cast metadata.

On iOS, permission to access the local network may be required for device discovery. Without this permission, the Cast feature may be limited or unavailable.

On Android TV, the app can also function as a Cast receiver (Google Cast Receiver). In this role, the app receives streaming information (stream URL, station name, artist name, station image URL) from a broadcasting device on the same network and plays the received stream. The received data is used exclusively for playback and is not transmitted to third parties.

Purpose: To provide the Chromecast feature you have specifically requested, as well as Cast reception on Android TV.

Legal basis: Art. 6(1)(b) of the GDPR. To the extent that operating system permissions are required, use is additionally permitted only after you grant permission in the operating system.

5.13 User Accounts and Login

The app allows you to sign in with an existing Google or Apple account. Signing in is optional—all of the app’s core features can be used without restriction even without a user account. Signing in is primarily intended to synchronize favorites, settings, and listening history across devices.

Authentication is handled via Firebase Authentication (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The following data may be processed during registration:

Firebase UID (pseudonymous identifier),
Email address (from the respective authentication provider),
Display name (from the respective authentication provider),
Profile picture URL (from the respective authentication provider),
Authentication provider (Google or Apple),
linked device ID,
Timestamps (creation and last update).

After successful login, profile data is temporarily stored locally on the device. Cloud synchronization of favorites, app settings, and listening history is handled via a dedicated user API hosted on Cloudflare Workers (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Communication takes place via HTTPS at https://user-api.soundnode.de. Favorites are synchronized bidirectionally, app settings are synchronized with the cloud as the primary system after login, and listening history is transferred via batch upload.

Registered users can permanently delete their user account and all associated cloud data (profile, favorites, settings, listening history) at any time in the app settings. The deletion takes place both in the User API and in Firebase Authentication.

Purpose: cross-device synchronization of favorites, settings, and listening history; provision of a personalized user experience; and backup of user data in the cloud.

Legal basis: Art. 6(1)(a) of the GDPR (active registration as consent) and Art. 6(1)(b) of the GDPR (synchronization functions as a contractually requested service).

Recipients: Firebase Authentication (Google Ireland Limited), Cloudflare, Inc.

5.14 Recording Radio Streams

The app allows users to record live radio streams as audio files. The audio data from the HTTP stream is written directly to a local file on the device. The app does not access the device’s microphone, nor does it transcode the audio data.

The maximum recording time is 3 hours; once this limit is reached, the recording stops automatically.

Im Zusammenhang mit einer Aufnahme werden folgende Daten ausschließlich lokal auf dem Endgerät gespeichert:

Audio file in the original format of the respective stream (e.g., MP3, AAC, OGG),
Metadata: Station ID, station name, station logo URL, file path, start time, duration, and file size.

Recordings are not transmitted to our backend or to third parties. The recordings can be played back in the app and deleted at any time.

Before using the recording feature for the first time, a copyright notice is displayed that the user must confirm. The confirmation is stored locally on the device.

Purpose: To provide the recording function explicitly requested by the user.

Legal basis: Art. 6(1)(b) of the GDPR (user-initiated function) and § 25(2) of the TDDDG (technically necessary access to local storage to provide the requested function).

5.15 App Permissions

Depending on the platform and app version, the app may request or technically use various system permissions. These may include, in particular:

INTERNET – Streaming and API communication,
WAKE_LOCK – Audio playback with the screen locked,
FOREGROUND_SERVICE / FOREGROUND_SERVICE_MEDIA_PLAYBACK – Background audio,
RECEIVE_BOOT_COMPLETED – Restoring alarms after a reboot,
VIBRATE – Vibration feature for alarm clocks,
USE_FULL_SCREEN_INTENT – Full-screen display for alarm clocks,
POST_NOTIFICATIONS – Notifications, particularly for playback and alarm functions,
USE_EXACT_ALARM / SCHEDULE_EXACT_ALARM – precise alarm times,
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS – Improves the reliability of alarm clocks,
ACCESS_NOTIFICATION_POLICY – Controls certain notification settings,
READ_EXTERNAL_STORAGE – if technically available in individual app versions or declared for legacy reasons,
Google Play Billing – Processing of in-app purchases.

The permissions are used exclusively for the app’s functions as described. If a permission requires authorization at the operating system level, you can manage it at any time in your device’s settings.

5.16 Firebase Analytics (Conversion Tracking)

The app uses Firebase Analytics, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. As part of the provision of services, data processing may also be carried out by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Processed data: Event data (in particular, purchase events when acquiring the Premium subscription), pseudonymized app instance ID (Firebase Instance ID), app version, device category, and an approximate location estimate based on the IP address (the IP address itself is not permanently stored).

Purpose: To measure the effectiveness of paid marketing campaigns (conversion tracking), specifically to determine whether and to what extent app installations and premium purchases are attributable to advertising efforts. The data is used to optimize advertising spend and is not used to create individual user profiles for advertising purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the economic success of marketing measures). To the extent that data is used for personalized advertising, this is done exclusively on the basis of prior consent (Art. 6(1)(a) GDPR) provided via the Google UMP consent dialog integrated into the app.

Retention period: Event data is stored by Google for up to 14 months and then automatically deleted.

Opt-out / Objection: Data collection by Firebase Analytics can be restricted via the privacy settings of your Google Account or via the “Privacy Settings” option in the app. For more information on data processing by Google and your options for objecting, please visit: https://policies.google.com/privacy.

Recipient: Google Ireland Limited (and, if applicable, Google LLC, USA). Data is transferred to the U.S. based on the EU-U.S. Data Privacy Framework.

5.17 Processing Operations Not Performed

According to the available technical specifications, the app currently does not use the following in particular:

No Crashlytics, no Sentry, and no other external crash reporting,
No GPS location tracking,
No microphone access,
No camera access,
No access to contacts or calendars.

6. Recipients and Categories of Recipients

We disclose personal data only to the extent permitted by law. Recipients may include, in particular:

our own server, or rather our WordPress/API backend at soundnode.de,
Hosting and infrastructure service providers,
Cloudflare as a CDN, proxy, and security service, as well as a hosting provider for the User API (Cloudflare Workers) in connection with the cloud synchronization of user data,
Firebase Authentication (Google Ireland Limited) in connection with user accounts and login,
Google and Google-affiliated services related to AdMob, UMP, Google Play Billing, Google Cast, YouTube, AdSense, and Firebase Analytics (conversion tracking),
where applicable, the technical providers of the respective selected radio streams, insofar as they are accessed directly from their servers,
Consultants, government agencies, or courts, to the extent that there is a legal obligation to do so or it is necessary for law enforcement purposes.

7. Transfers to Third Countries

When using certain services, the transfer of personal data to countries outside the European Union or the European Economic Area—in particular to the United States—cannot be ruled out. This applies in particular to services provided by Google, YouTube, Firebase, and Cloudflare.

In the event of a transfer to a third country, we ensure that it is based on a legally permissible basis under data protection law, in particular an adequacy decision, certification under the EU-U.S. Data Privacy Framework, or appropriate safeguards such as standard contractual clauses, to the extent that the respective provider uses them.

8. Retention Period and Deletion

We store personal data only for as long as is necessary for the respective purposes, as required by statutory retention obligations, or where there are legitimate interests in continued storage.

In particular, the following applies:

The website’s server log files are generally retained for up to 7 days, unless longer retention is necessary,
Contact information until the final processing is complete and beyond, in accordance with legal obligations or legitimate interests,
Device-related registration and token data for as long as the respective device is actively used, the token is valid, or storage is necessary for security, fraud prevention, and support,
User account data until the account is deleted by the user or until consent is revoked,
Cloud-synchronized data (favorites, settings, listening history) until the account is deleted or until the user manually deletes it,
local recordings until the user manually deletes them or uninstalls the app,
Local data on your device until you delete, reset, or uninstall the app,
Reviews and usage data are retained only as long as necessary for the respective function, quality assurance, and fraud prevention.

9. Data Deletion, Revocation of Device Assignments, and Uninstallation

You can generally delete locally stored app data through your device’s settings or by uninstalling the app. This will remove locally stored data from your device, to the extent that the operating system allows it.

According to the available technical information, server-side device assignment or a device token can be revoked. For requests to delete data processed on the server side, please contact us using the contact information provided above.

10. Your Rights Under the GDPR

In accordance with the statutory requirements, you are entitled to the following rights in particular:

Right of access under Article 15 of the GDPR,
Right to rectification under Article 16 of the GDPR,
Right to erasure under Art. 17 of the GDPR,
Right to restriction of processing under Article 18 of the GDPR,
Right to data portability under Article 20 of the GDPR,
Right to object under Article 21 of the GDPR,
Right to withdraw consent granted pursuant to Art. 7(3) of the GDPR,
Right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 of the GDPR.

11. Right to Object

To the extent that we process personal data pursuant to Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

If personal data is processed for the purpose of direct marketing, you have the right to object to such processing at any time. If you object, your personal data will no longer be processed for these purposes.

12. Withdrawal of Consent

You may revoke your consent at any time with future effect. The revocation does not affect the lawfulness of the processing that took place prior to the revocation.

In the app section, you can change your consent settings, particularly through the app’s privacy settings. On the website, you can revoke or adjust your consent through the consent management system used, if such a system is in place.

13. Data Security

We implement state-of-the-art technical and organizational security measures to protect personal data against loss, destruction, unauthorized access, unauthorized modification, or unauthorized disclosure. These include, in particular, access restrictions, secure transmission channels, pseudonymization, role-based authorization models, and the use of protected local storage areas for sensitive technical identifiers.

14. Up-to-Date Status and Changes to This Privacy Policy

This Privacy Policy is current as of March 2026. We reserve the right to update this Privacy Policy if legal requirements, technical features, the services we use, or our data processing practices change.