Privacy Policy

1. Data controller

Markus Sussitz · Ebenthal, Austria
[email protected]

2. Data we process

Rainwave is a privately operated web radio that you can use without an account. To operate and protect the service, we process technical connection data such as IP addresses, browser information and request counts. The app is hosted by Hetzner in Nuremberg, Germany.

If you choose to sign in with Google, we receive your name, email address, verification status, profile picture if available, and provider identifier. We store these details and authentication tokens to identify your account, along with your playlists and preferences. We do not receive your Google password. Playlists and preference syncing are unavailable without the required account information.

To reduce repeated songs across your devices, signed-in accounts also store recently played song identifiers, their latest playback times and search progress for each radio channel. Guests keep this information only in their browser.

If you rate a scene, we store its identifier, your 1–5 star rating, your account identifier and creation and update timestamps. Only averages and rating counts are public. You can change or remove your ratings; deleting your account removes them from the live database.

We send sign-in links through Brevo. Brevo receives the recipient address, sender, subject and message content, including the sign-in link, and processes sending and delivery data.

Music and artwork from Audius are loaded directly from external media servers. These servers receive your IP address and technical request data. Artwork may load before playback starts.

3. Cookies and browser storage

Session cookies enable sign-in. We store your radio preferences, listening history, search progress and a random browser identifier for the listener count in your browser. Listening history is cached separately for each account so offline plays can be synced later. For this count, we also process a tab identifier and activity timestamps. These identifiers are pseudonymous. Locally stored data does not expire automatically; you can delete it in your browser’s website settings.

We also save your language choice in browser storage and a cookie valid for one year, refreshed when the preference is applied. If you are signed in, your language preference is synced with your account. “Automatic” uses each device’s browser languages, with English as the fallback.

4. Legal bases and recipients

Account, sign-in and playlist features you request are based on Article 6(1)(b) GDPR. Operation and security are based on Article 6(1)(f) GDPR; our legitimate interest is providing a reliable service protected against misuse. Recipients are the hosting, authentication, email and media providers listed above.

5. Retention

Sessions are valid for seven days and may be renewed; sign-in links are valid for ten minutes. These periods do not guarantee deletion of all associated data. Listener entries stop contributing to the count after 90 seconds of inactivity and are regularly removed while the listener service is active; interruptions may delay removal.

Listening history keeps the latest playback time per song. When history is updated, older excess entries are removed while songs needed for the repeat-prevention window are retained. Account deletion also removes the associated listening history and search progress from the live database.

Database backups are created daily, stored in Nuremberg and retained for seven days. You can delete individual playlists yourself and request account deletion using the email address above.

6. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise your rights, contact the email address above.

You may lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority.