PRIVACY & DATA PROTECTION
Privacy Policy.
How your data is used when listening to NonStopPop FM or joining the community.
1. Who is responsible?
Data controller for the NonStopPop FM website: Dominik Pach, Legionstraße 25, 74706 Osterburken, Germany. Contact: info@it-pach.de.
This notice describes the data handling of the NonStopPop FM website. Services opened or loaded from third-party providers may be subject to those providers' separate privacy notices.
2. Website access, hosting and server logs
This website is hosted on infrastructure supplied by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup provides the hosting infrastructure and may process technical connection data when delivering the service.
When you access this website, your browser sends technical connection information, including your IP address and request details, to the server. Security logs can include the date and time, requested resource, response status and browser or device information. We use these records to operate and protect the website and investigate security incidents.
Under our server configuration, security logs are held on the server only until the next server restart; they are not kept as a permanent log archive. The actual storage time therefore depends on when the next restart takes place.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in making this website available and maintaining its security.
3. Discord and Google sign-in
If you choose to sign in, you are redirected to Discord or Google. The website requests only the minimum sign-in scopes configured for that provider (Discord identify or Google openid). These providers process the sign-in under their own privacy terms.
We store an internal account ID, the provider name and its user identifier, account role, account creation date and linked-provider information. We do not create account records containing your email address, name, password or profile photo. Provider access tokens are used for sign-in but are not stored in our account database. The identifiers are pseudonymous, not fully anonymous, because they can be associated with an account.
A temporary sign-in cookie helps protect the authentication process. After successful sign-in, a session token in a protected cookie identifies your account to the website. The server stores a hash of that token, not the raw token. The session is valid for up to 14 days unless it expires or is revoked earlier.
For an administrator-only overview of the most recent successful sign-in, the server uses your IP address to estimate your country, region and (if available) city. When the trusted proxy provides an IP address, the server sends it to the HTTPS geolocation service ipwho.is (ipwhois.io). Only the approximate country, country code, region, city and login timestamp are stored with your account; the IP address and any location history are not stored in the community database. Each new login replaces the previous location. VPNs and mobile networks may affect accuracy. Previously registered accounts have no location until their next successful sign-in; if lookup is unavailable, location is shown as unknown.
The legal basis for processing needed to provide your requested community account and its features is Article 6(1)(b) GDPR. Security and abuse prevention are also pursued under Article 6(1)(f) GDPR.
4. Votes, song suggestions and community activity
When you vote for a song, your account ID is associated with the selected song, the vote type and the time of the vote. Changing or removing a personal vote updates the corresponding results.
When you suggest a song, we store the selected track identifier, song title, artist, submission time, your account association and its review status (pending, approved or rejected). Activity timestamps and counters help enforce fair-use limits and prevent repeated submissions.
Your account page lets you view and remove personal votes and suggestions. Public charts show voting results; they do not display your internal account ID. Older anonymous voting events may remain in the aggregated results without being linked to a community account.
These data are processed to provide the community functions you request (Article 6(1)(b) GDPR) and to keep the voting and suggestion systems reliable and resistant to abuse (Article 6(1)(f) GDPR).
5. Cookies and storage on your device
Account session cookie: __Host-nsp_session in production (nsp_session_dev during local development). It is HttpOnly and lasts for up to 14 days; signing out clears it.
Temporary authentication cookies: nsp_oauth_discord and nsp_oauth_google can be set while connecting an account. They are short-lived (up to 10 minutes) and are cleared when the authentication callback finishes.
Volume preference: nsp_volume stores the volume level you choose on a desktop device for up to one year. It is not a user-tracking identifier.
Appearance preference: nsp-theme stores your selected light or dark theme in browser localStorage until you change or clear that preference.
The application code reviewed for this notice does not implement advertising or analytics cookies. This does not establish what a hosting provider, separate external website or streaming provider may use. Device storage needs to be assessed under Section 25 TDDDG; storage strictly necessary for a feature you expressly request may not require consent, but other uses may.
You can remove website cookies and localStorage entries in your browser settings. Removing a session cookie will sign you out; clearing preferences resets your chosen appearance or volume.
6. Live radio and external media
When you start the live player, your browser connects to the streaming service operated by laut.fm (the configured stream URL). The streaming provider receives technical connection information, such as your IP address, in order to deliver the audio. Its own privacy terms and, where applicable, advertising or measurement practices may also apply.
Current-track information is obtained using the laut.fm API. Album art or other music imagery can be served from Spotify or other external image hosts. If your browser loads an external image, the host can receive connection information including your IP address.
The purpose of these requests is to provide the radio and accompanying music information (Article 6(1)(f) GDPR, legitimate interest in providing the listener-requested service). Third-party services may have their own purposes and legal grounds.
7. Song search and external information
The song suggestion search uses the Spotify catalog through our server. Search terms and track identifiers are used to find and verify songs. You do not need to link a Spotify account to use our suggestion feature.
Weather information is requested by our server from Open-Meteo and the US National Weather Service for the fictional Los Santos presentation. The weather feature uses a fixed Los Angeles location; it does not request your device's location.
External links to Discord, Google, Spotify, laut.fm or other websites open services governed by their own privacy policies.
8. How long is information stored?
A login session expires after at most 14 days unless revoked sooner. Temporary authentication cookies expire after at most 10 minutes. Browser theme and volume preferences persist until changed, expired where applicable, or cleared by the browser.
Account details, linked sign-in methods, last-login timestamp and approximate location, personal vote events and song suggestions are kept while the account is used, unless you remove an individual item or delete the account. Each sign-in replaces the previous login location rather than building a location history. Account deletion removes the associated identity links, sessions, last-login information, personal vote events and suggestions from the live application database. Historical votes that were never linked to an account are not affected.
Short-lived abuse-prevention counters expire automatically. Server security logs are kept only until the next server restart, as described above.
Off-site backups are created continuously to help restore the service after data loss or technical incidents. Backup copies are used for recovery and are not used for advertising or profiling. Data removed from the live database may remain in earlier backup copies until those copies expire or are overwritten under the applicable backup retention cycle. A deletion from a live account therefore does not necessarily erase every previously created backup immediately.
9. Recipients and international transfers
The internal community database is used to operate NonStopPop FM; we do not sell account records or share them with advertisers for marketing. Our hosting provider is netcup GmbH. Separate off-site backup copies are maintained for service recovery.
Optional features involve external services: choosing Discord or Google sign-in connects you with the selected provider; during successful sign-in our server also sends the connecting IP address to ipwho.is for approximate geolocation; starting the radio connects your browser to laut.fm; and loading album artwork may connect your browser to external image hosts. Those providers can receive technical connection data such as an IP address. Song searches are sent to the Spotify catalog from our server. These interactions do not transfer our entire community database.
We do not intentionally export our internal community database to third countries for marketing or unrelated uses. However, we cannot describe every visit or login as free of external or international data transfers: third-party providers may process connection or sign-in data outside the European Economic Area under their own arrangements. Their privacy notices provide information about processing locations and applicable safeguards. For transfers for which we are responsible, the requirements of Chapter V GDPR apply.
10. Your privacy rights
Subject to the relevant legal conditions, you may request access to your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and object to processing based on legitimate interests (Article 21). Where processing relies on consent, you may withdraw it at any time for the future.
You can delete your NonStopPop account on the account page. For other privacy requests, contact info@it-pach.de. We may need to verify your account ownership before disclosing account-specific data.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI Baden-Württemberg).
The community application does not make solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR.
11. Updates to this notice
We update this privacy notice when website features, service providers or legal requirements change. The current version is available on this page.
You can also review our Imprint for legal provider details.