privacy policy

who we are

oud (the website at oud.so) is an independent project by Uğur Sözen, who is responsible for your data here. this policy explains what we collect, why, and who else sees it. questions go to ziegfiroyt@gmail.com, or @forwardset on x.

the short version

• you can listen on the web without an account.
• we don't keep a history of what you listen to.
• no ads, no analytics, no tracking pixels.
• we don't sell or rent your data to anyone.

if you have an account

• your email address, and your name and profile picture if you sign in with google. google also hands us sign-in tokens, which we store with your account.
• if you sign in by email, a 6-digit code that expires after 5 minutes.
• for each signed-in session: the ip address and browser identifier (user agent) it was started from, so sessions can be secured. sessions expire after 30 days without use.
• your bookmarks and lists, including smart list filters.
• if you add them on your profile: a display name and your handles on x, instagram, threads and bluesky.

if you just listen

to play a station, your browser asks our servers for the stream address and, every 25 seconds while it plays, for the current song title. our servers keep standard request logs (ip address, time, requested address), so for a while these logs show which station was requested from which ip. we use them only to run and protect the service, and we don't combine them with your account or build listening profiles from them.

when a stream fails to play, your browser reports that station, the stream address and the error, so we can find broken stations. these reports carry no account information; to count repeats, we attach a code derived from your ip address and user agent that changes every day and can't be turned back into either.

to suggest your country on first visit we read the region from your browser's language setting. we don't use gps or ip location.

stored on your device

first-party only, and none for advertising or cross-site tracking:

• a sign-in session cookie, if you sign in (30 days, renewed while you use it).
• cookies remembering your country choice, whether you finished onboarding, and whether you hid the country section.
• local storage for your theme and the last station you played, and session storage for scroll positions.

who else sees data

• radio stations. most streams play straight from the broadcaster's server, which sees your ip address like any website does. their own privacy policies apply. older http streams are relayed through our servers, in which case the broadcaster sees us, not you.
• google, if you choose to sign in with google.
• resend, which delivers the sign-in code email and so receives your email address.
• unsplash and carto: background photos and station maps load from their servers, which see your ip address.
• our hosting and database providers, who store data on our behalf.

we may also disclose data if the law requires it. if oud is ever sold or merged, data would move with it under this policy.

public lists

lists are private unless you share one. a shared list can be opened by anyone with its link and shows its name and stations. it doesn't say who made it unless you turn on "share my name on my public lists" on your profile; then your display name and the handles you added appear under every list you share. your email is never shown. you can turn this off or stop sharing at any time.

why we use it

to provide what you asked for (your account and library), to keep the service secure and working (sessions, logs, failure reports), and to meet legal duties. we don't send marketing email.

how long we keep it

• account data and library: until you delete your account.
• sign-in codes: 5 minutes. idle sessions: 30 days.
• stream failure reports: kept for station maintenance; they are not tied to you.

your choices and rights

you can edit or remove bookmarks and lists any time, and play without an account on the web. to get a copy of your data, correct it, or delete your account, email ziegfiroyt@gmail.com from the address on your account. we'll answer within 30 days. deleting your account removes your profile, sessions, bookmarks and lists.

depending on where you live (for example under the gdpr or california law) you may have further rights, such as objecting to processing or complaining to your data protection authority. write to us and we'll help.

where data is processed

our providers may process data in the united states and other countries, whose data protection rules may differ from yours. where required, transfers rely on the providers' standard contractual safeguards.

children

oud isn't meant for children under 13, and we don't knowingly collect their data. if you think a child has an account, tell us and we'll delete it.

changes

if this policy changes we'll update the date above, and for significant changes we'll let account holders know by email. see also our terms of service.