Privacy Policy

Overview

GoCast is a live radio streaming platform. This policy explains what data we collect, why we collect it, and how we protect it. We believe in collecting the minimum data necessary to provide the service.

Data We Collect

Account Information

When you create an account, we collect your name and email address. If you sign in with Google, we also receive your Google profile ID and profile photo URL. We do not store your Google password or access token beyond the initial authentication.

Station Data

When you create a station, we store the station name, slug, description, genre, and any artwork you upload. This information is publicly visible on your station's player page.

Broadcast Data

When you broadcast, we record session start and end times, peak listener counts, and track metadata (song titles and artist names) that you provide. Audio streams pass through our relay server to Icecast but are not recorded or stored.

Listener Data

Listeners do not need an account. When someone presses play we open a listening session, so a station can see how many people are tuned in and where its audience is. That session records the country the request came from, the broad device and browser type, the host of the referring page — never the full URL, because a path can carry personal data — and when listening started and stopped.

We do not store listeners' IP addresses. The address is used at the moment of the request to resolve a country and to compute a hash salted with a secret that rotates daily. That is enough to avoid counting the same person twice within a day, and not enough to identify them or to link them across days.

If you ask to be told when a station goes live, we store your email address against that station so we can send you that one email. It is not used for anything else.

The site-wide analytics and Sentry session replay described below run on every page, including player pages.

Uploaded Files

Audio you upload to a station's library is stored on our servers, because playing it back on air is the point of the library. It is kept until you delete the track, the station, or your account, and it is never used for anything other than broadcasting on your own station.

Audio you broadcast live is different: it passes through our relay to listeners and is not recorded or kept. Station artwork is stored on our servers and served publicly.

How We Use Your Data

• To provide and maintain the streaming service
• To authenticate your account and authorize access to your stations
• To display station information on public player pages
• To show real-time listener counts and now-playing metadata
• To give broadcasters audience statistics for their own stations
• To email listeners who asked to hear when a station goes live
• To send email verification and service-related notifications
• To detect and prevent abuse (rate limiting, stale session cleanup)
• To understand how the site is used, so we can improve it

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described below.

Third-Party Services

• Google OAuth— used for “Sign in with Google.” We receive your name, email, and profile photo. Google's privacy policy applies to data they collect during the sign-in flow.
• Sentry — error monitoring and session replay. Receives error stack traces and request metadata, and records a small sample of browsing sessions — roughly 2% of sessions, and half of those where an error occurs — so we can see what led to a fault. Recordings mask all text and form inputs and block media, and we do not attach account identifiers to them. Replay applies across the site, including public player pages.
• Google Analytics— site-wide usage analytics. Receives the pages you visit, the referring site, your device and browser type, and an approximate location, and sets its own cookies to tell visits apart. Google's privacy policy applies to that data.
• Umami — privacy-focused page-view analytics. Receives the pages you visit, the referring site, and your device and browser type. It does not use cookies.
• Microsoft Clarity— session recordings and heatmaps, so we can see where the site is confusing or broken. Records how you move, click, and scroll across the site, including the dashboard and player pages, along with your device and browser type and an approximate location. Sensitive content is masked before it leaves your browser, and it sets its own cookies to tell visits apart. Microsoft's privacy statement applies to that data.
• Resend — our email provider. Receives the address and contents of any email we send: verification codes, password resets, station-live alerts, and service notices.
• Cloudflare — sits in front of the site, so it handles every request before we do and tells us which country a listener is in. Their own privacy policy governs that traffic.

Cookies

We set three cookies of our own, all needed for the site to work:

• token — your authentication token. Set by our server as HttpOnly, so page scripts cannot read it, and it expires 30 days after it is issued.
• user — your name and email, used to personalize the interface without an extra API call.
• sidebar_state — whether you left the dashboard sidebar open or collapsed.

All are set with SameSite=Lax and the Secure flag in production.

Google Analytics and Microsoft Clarity also set analytics cookies (_ga, _ga_*, _clck, and _clsk) to tell one visit from another. You can block them in your browser settings without affecting how GoCast works.

Some things stay in your browser's local storage and are never sent to us at all: the stations you save, your recent listening history, and which stations you have asked to be notified about. That data lives on your device only. Clearing your browser storage removes it.

Data Retention

• Account data is kept until you delete your account. Deleting it revokes your sessions and strips your name, email, and Google details from the record; an anonymous row remains so past activity stays consistent.
• Stations you delete — and the audio in their libraries — are kept for 30 days so a deletion can be undone, then permanently erased.
• Individual listening sessions are deleted after 90 days. The summaries built from them (counts by hour and by country) are kept, and cannot be traced back to a session.
• Broadcast session history is retained indefinitely for your station statistics.
• Real-time data (listener counts, now-playing metadata) is stored in Redis and cleared when your broadcast ends.
• Authentication tokens expire 30 days after they are issued.

Your Rights

You can:

• View and update your account information from the dashboard.
• Delete individual stations. Their broadcast history goes with them, and their audio is erased once the 30-day recovery window is up.
• Ask us to remove a notification email address from a station at any time.
• Request a full export or deletion of your data by contacting us.
• Revoke Google account linking at any time from your Google account settings.

Security

We protect your data with HTTPS encryption in transit, hashed passwords (bcrypt), rate-limited API endpoints, and scoped authentication tokens. Internal relay communication is authenticated with a shared secret. We do not store plaintext passwords.

Changes to This Policy

We may update this policy as the service evolves. Significant changes will be communicated via email or an in-app notice. The “last updated” date at the top reflects the most recent revision.

Contact

For questions about this policy or to exercise your data rights, contact us at privacy@gocast.fm.