Privacy
Post Radio is a listening room where each listener plays the track on their own device, in YouTube's player. This policy describes the data the app handles on the Cloudflare Worker and in its Durable Object storage, and what it sends to other services. Apple Music and SoundCloud may be added later; this policy will change first.
YouTube API Services
Post Radio uses YouTube API Services, including the YouTube IFrame Player API. By using Post Radio you agree to the YouTube Terms of Service. YouTube's handling of data is described in the Google Privacy Policy.
What Post Radio stores
A Bluesky account is the channel identity. When you sign in, Post Radio reads your public profile — DID, handle, display name and avatar — from the Bluesky public AppView and shows it in the room. Post Radio keeps an OAuth session so you stay signed in: the Cloudflare Worker stores it in a Durable Object record. The session lasts 30 days and is removed when you sign out. Post Radio never receives your Bluesky password.
Chat messages you send are stored with your public profile and the message text. A message is kept for a rolling 24 hours and then dropped; every message from the last 24 hours is kept, with no message count, up to a per-room storage safety ceiling. The host or a co-host (on a station, the owner) can delete a message, and can mute an account in chat. Post Radio also tracks who is in the room, the current track, the queue and the tracklist while a room is live. The main room and station data persist in Durable Object storage; named rooms are removed after an hour with no listeners and no host.
On a show's "Not live yet" page you can choose Notify me. If you allow notifications in your browser, Post Radio stores the browser's push subscription — its endpoint URL and public keys, tied to that host — so a notification can be sent each time that host goes live. The host's notify switch controls it: with the switch off, no notification is sent. The host's handle link switch controls it too: with the link off, no notification is sent. Turning the button off, or removing Post Radio from your Home Screen, deletes the subscription. Endpoints and keys are never logged.
What Post Radio sends, and why
To name the tracks a room shows, Post Radio reads YouTube track data. To play a track it loads the YouTube player in your browser. To sign you in it talks to Bluesky. To detect errors it sends scrubbed reports to GlitchTip: a message, a stack trace, the route and an anonymous id, with cookies, headers, request bodies and URL query strings removed. Content-security-policy violations are written to the Worker log with the blocked origin, the page and source paths, line and column, a sample of up to 80 characters, the disposition, a coarse browser family (for example "iOS Safari 18") and whether the report came from the lab. All traffic passes through Cloudflare.
Post Radio does not sell personal data and does not use it for advertising.
Cloudflare and the Post Radio Worker keep request logs that can include your IP address and browser details. They are kept for up to 30 days and used only to run and secure the service.
Revoking access
Bluesky: sign out in Post Radio, or remove the app in Bluesky settings. Google: Post Radio does not use any Google authorization today, so there is no Google access to revoke. If that ever changes, you can review and revoke it at myaccount.google.com/permissions.
Cookies and local storage
Post Radio sets one sign-in cookie and one short-lived sign-in nonce cookie. Both are HttpOnly and SameSite=Lax. The page keeps your theme, listening service, mute choice and host key in your browser's local storage. It also keeps a random identifier in local storage and sends it only with error reports, so we can count how many people an error affects. No third-party advertising cookies are set.
Contact
Questions or deletion requests: privacy@postradio.net.