Privacy statement

Airplays (airplays.fm) tracks what Dutch radio stations play and turns that into charts and insights. The service is operated by Samuel van Eck. For any privacy question, email info@airplays.fm.

You can browse Airplays without an account; we then only process what is technically required to make the site work, such as your IP address for rate limiting. With an account, we process:

• Account: your email address and password. The password is stored encrypted (hashed); we cannot read it.
• Sign-in sessions: per device the IP address, browser (user agent) and usage timestamps. You can view and revoke these sessions on your account page.
• Playlists: the names and descriptions you enter yourself. Playlists are private and visible only to you.
• Newsletter preferences: the station and weekdays you choose.
• Search queries: the free text you type into search. Queries are not linked to your account.

• Providing the service and managing your account — needed to perform our agreement with you.
• Sending the newsletter — based on your consent. You can withdraw it at any time; every newsletter contains an unsubscribe link, including one-click unsubscribe.
• Security and abuse prevention — based on our legitimate interest: rate limiting by IP address, a captcha at registration and per-device session records.

We never sell your data and use no advertising networks. We do share data with a small number of processors, strictly to run the service:

• Amazon SES (EU region, Ireland) — sends our email: confirmation, password reset and the newsletter.
• Cloudflare Turnstile — the security check at registration; Cloudflare receives your IP address to tell people from bots.
• OpenAI — interprets search queries. Only the search text is sent, never your account details or IP address.
• Sentry — error reporting so we can fix bugs; set up so no personal data is sent along.
• Spotify — album artwork is loaded from Spotify's servers; Spotify sees your IP address in the process.

Airplays uses one functional cookie: your language preference (i18next, kept for one year). Your browser's local storage holds your sign-in session, language and player preference. We use no tracking or analytics cookies, which is why you see no cookie banner.

• Account data is kept until you delete your account. Deletion is available on your account page, takes effect immediately and permanently removes your playlists, newsletter subscription, sessions and email logs.
• Expired sign-in sessions are removed automatically.
• Logs of the emails we sent you are kept for up to six months.

Under the GDPR you can ask us for access, correction, deletion, restriction, objection and data portability. Most of it you can do yourself: your data is visible on your account page and you can delete your account there. For anything else, email info@airplays.fm. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

All traffic is encrypted (TLS). Passwords are hashed with bcrypt, sign-in tokens have a limited lifetime and every session can be revoked per device.

We may update this statement, for example when the service changes. The date at the top tells you when it was last revised.