Wookie-Radio - Privacy Policy
Effective date: 16 October 2026
Wookie-Radio ("the app") plays internet radio and podcasts on iPhone and iPad (Apple), and on Android phones, tablets, Android TV and Chromebooks. It is made by Łukasz Dec, trading as AlmostCyb.org, Poland ("we"). We are the controller for the little personal data this policy describes. Contact: use the form at almostcyb.org/support/wookie-radio.
The short version
- No account, no sign-up; the app collects no e-mail address. (If you contact us through the website, see "If you contact us".)
- No advertising, no analytics, no tracking, no third-party SDKs that collect data. (The one exception is Google's casting library in the Android app: see the table under "Who the app contacts".)
- The microphone is used only for voice search on Android TV, when you tap the microphone button and allow it. The app only gets the recognised text; nothing is stored or sent to us. Song identification never uses the microphone. See "Voice search (Android TV)".
- We run no server for the app. The app does not send us your favourites, your listening, your searches or your location.
- Your data stays on your device, and, if you choose, in your own iCloud (iPhone) or your own Android backup.
- Nothing about your free trial, your free features or your purchases leaves your device except through Apple or Google when you buy.
- The app talks directly to the radio stations, podcast publishers and directories you use. Those services see what any player or browser would show them (see "Who the app contacts").
- The almostcyb.org website sets no cookies and uses no analytics or advertising. The main page remembers your language and colour theme in your browser's local storage on your device; this is not a cookie, and it is sent nowhere. The legal pages (privacy, takedown, support) use no local storage. The website loads no fonts or scripts from other hosts, except Cloudflare Turnstile (a robot check) on the pages with a contact form (support and takedown); Turnstile runs from Cloudflare's own domain and is used only for the form.
What is stored on your device
Your station list and favourites, stations you add yourself, play counters, followed podcasts, queue, played and liked marks, listening positions, downloaded podcast episodes, scheduled shows, the calendar address you may enter, your settings, and the date you first installed the app (it also starts your 30-day trial). The app also keeps a note that you have accepted the one-time reminder shown when you first add a station (the reminder asks you to add only free public streams you may listen to). If you turn on Restricted Mode, a PIN hash is stored (it is a filter for children, not a security feature). All of this lives inside the app's own storage on your device. We cannot see it. Deleting the app deletes it from the device (see iCloud and backup below).
iCloud (iPhone and iPad)
If you turn on iCloud sync, the app stores your favourites, followed shows, positions, played marks, own stations and settings in Apple's iCloud key-value storage, tied to your Apple Account. It is your private iCloud data, governed by Apple's terms and privacy policy. We cannot read it. Turning sync off stops this device from taking part; it does not erase what is already in iCloud (manage that in Settings > your name > iCloud). Your radio stations and radio settings are synced between your devices only if you also turn on the separate "radio" switch in Settings, which is off by default; podcast data follows the main iCloud switch. The install date is also kept in iCloud so that it survives deleting and reinstalling the app (so a reinstall does not restart the trial); this needs no sync switch.
Android backup (Android)
Android can back up the app's data to your Google account (Google's automatic backup, if you have it turned on). That copy belongs to you and is handled by Google under its own policy. We do not receive it. The app has no live sync between devices.
Who the app contacts
The app connects to these third parties only when you use the related feature (the Google Cast library on Android is the exception, see its row). They receive your device's IP address and the request itself; their own privacy policies apply. We receive nothing.
| Service | When | What is sent |
|---|---|---|
| Radio stations and their stream hosts | when you play a station | a request for the stream (your IP address; the app's name) |
| radio-browser.info (public station directory, servers de1 and at1) | when you search for stations to add | your search words, genre or country filters |
| Apple iTunes Search (itunes.apple.com) | when you search podcasts or browse top shows | your search words or the show id |
| Podcast publishers' servers (feeds, audio files, transcripts, chapters) | when you follow, open or download a show | a request for the feed or file |
| Artwork and station logo servers (a publisher's or station's own address) | when a cover or logo is shown | a request for the image; downloaded logos are kept in a cache on your device |
| The website you enter as a calendar (.ics) address | at launch and about every five minutes if you set one | a request for that file |
| ShazamKit (Apple's song-recognition service, on both iPhone and Android) | when you tap "What song is this?", and, on both iPhone and Android, automatically if you turn on the optional auto-identify feature, in Settings or for a single station (off by default) | a short audio signature (a digital fingerprint, not a recording) made from the audio the app is playing, not from the microphone |
| Google Cast (Android only; Google's casting library built into the app) | automatically, when the app looks for Cast devices or you cast | anonymised usage events (device discovery, casting sessions, basic device and app information) with no identifier that points to you; Google keeps them briefly, then aggregates them. You cannot switch this off, and neither can we. |
| Android speech recognition (voice search on Android TV; on a typical Android TV this is Google's) | only when you tap the microphone button in a search box and speak | your speech, handled by Android's own speech recognition: on the device or sent to Google, depending on your device and its settings, under Google's privacy policy. The app receives only the recognised text; nothing is sent to us. |
| Apple App Store or Google Play | when you buy, restore or manage the Pro subscription | handled by the store; we never see your payment details or identity |
Some stations and feeds use plain http, which is not encrypted; the app allows this because many radio stations only offer it. Nothing you type into the app is sent to us.
If you choose to share analytics or crash reports with app developers in your device settings, Apple or Google may give us anonymous, aggregated reports. They contain no personal data that identifies you, the app itself sends us nothing, and we use such reports only to fix problems.
Stations and feeds you add
A station address or podcast feed you add yourself stays on your device (and in your own iCloud if you turn sync on). We do not receive it. The app contacts that address only to play it. The "Report" button next to a station opens our takedown page in your browser; it sends no data about the station or about you. If you fill in that form, see "If you contact us".
Song identification
The button listens to the sound the app itself is playing for about eight seconds, turns it into a fingerprint on the device and sends that to Apple's Shazam service (ShazamKit) to find the title and artist - on both iPhone and Android. This feature never uses the microphone: it works only on the sound the app itself is playing, and the app asks for no microphone permission for it. On iPhone, a match from the button is added to your Shazam library, under Apple's privacy policy; on Android the result is shown in the app only.
The app also has an optional auto-identify feature (off by default, both iPhone and Android), a switch in Settings that you can also set for a single station. When it is on and a station shows no song title, the app waits for the quiet gap between two songs and identifies the next song the same way, to show you what is playing. This automatic identification only shows the song: it is never added to your Shazam library. A station that does show titles is not checked for a week at a time. The feature is offered as is, with no guarantee that it works on every station or stays available.
Voice search (Android TV)
On Android TV, the search boxes have a microphone button. The first time you tap it, the app asks for the microphone permission (RECORD_AUDIO). You can refuse; typing and everything else still work. When you speak, the audio is handled by Android's own speech recognition service, which on a typical Android TV is Google's. Depending on your device and its settings, it works on the device or sends the audio to Google, under Google's privacy policy. The app only receives the recognised text and uses it as your search words. The app does not record, store or send the audio, and nothing goes to us. Song identification (the "What song is this?" button and the optional auto-identify feature) does not use the microphone.
Notifications
If you schedule a show, the app can send local notifications (an optional reminder before it starts, off by default) on both iPhone and Android. They are made on your device; no push service or server is involved. On Android the app also asks for notification permission to show the playback controls. You can refuse; playback still works.
Calendar
The app does not access your calendar. If you paste a public or private .ics link, the app downloads that file from the address you gave and uses the show names in it. No calendar permission is requested.
If you contact us
The app itself sends us nothing. If you write to us through the website, the data is handled as follows.
- Contact form (support questions, takedown requests, general messages): we receive the name, e-mail address and message you type. Cloudflare Turnstile checks that the sender is not a robot, and a Cloudflare Worker passes the message on. It is stored as a ticket in a private GitHub repository that only we can read. We use it only to answer you and to keep a record of the request. We do not share it, and we do not use it for marketing.
- Bug reports and improvement suggestions on GitHub: these are public. Anything you write there, and your GitHub username, can be seen by anyone. Do not put private details in them; use the contact form for anything private. GitHub's own privacy policy applies to your GitHub account.
- You can ask us to delete your ticket at any time through the support form.
Purchases
The Pro subscription, which unlocks all features of the app, is sold by Apple (App Store) or Google (Google Play), who process the payment and are the seller of record. We never see your payment details or your identity. The app checks on the device whether the Pro subscription is active; there is no account and no server of ours. Restore Purchases asks the store. Billing, renewal, cancellation and refunds are handled by Apple or Google under their own rules. The 30-day free trial is kept on your device (and in iCloud on iPhone) and needs no payment details. Which features are free and which need the Pro subscription is decided and stored on your device; nothing about it is sent to us.
What we do not do
We do not sell or share personal data, build profiles, show ads, use advertising identifiers, read your contacts, photos or location, or track you across other apps or websites.
Security
The app keeps your data inside its own storage on your device and sends nothing to us, so there is no database of ours to break into. The contact form uses an encrypted (https) connection and the tickets are kept in a private repository that only we can access. No system is completely secure, and we cannot promise it. Please note that some radio streams use plain http, which is not encrypted (see above), and that the Restricted Mode PIN is a filter, not a security feature.
Legal basis, retention, transfers
Through the app we process no personal data, so there is nothing to retain or to transfer. The device-side processing above is carried out at your request to provide the app's features (Art. 6(1)(b) GDPR). If you contact us, we process the details you send to answer you (Art. 6(1)(f) GDPR, our interest in replying to requests), and we keep the ticket for up to 12 months after the request is closed, then delete it. Cloudflare and GitHub act on our behalf to deliver and store it, and may process it outside the EU under their own safeguards. Apple, Google and the third parties in the table are independent controllers for their own processing, and may process data outside the EU under their own safeguards.
Your rights (GDPR)
If you are in the EU or UK you have the right to access, correct, erase, restrict, object to and move personal data about you, and to withdraw consent. Because the app gives us none, the practical answer to a request is usually that we hold nothing about you, unless you wrote to us; you can still ask through the support form and we reply within 30 days. To remove your data yourself: delete the app, turn off and clear iCloud data for it (iPhone) or delete the backup in your Google account settings (Android). You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or to the authority in your country.
Users in the United States and other regions
We do not sell or share personal data, as those words are used in the California Consumer Privacy Act and similar laws of other US states, and we do not use personal data for targeted advertising or profiling. We do not collect sensitive personal data. The rights those laws give you (to know, delete, correct and opt out) are answered the same way as the rights above: the app gives us no personal data, and we hold only what you send us through the contact form, which you can ask us to show or delete at any time. We will not treat you differently for asking. Users in the UK, Switzerland, Brazil and other regions with similar laws can use the same route.
Children
The app is not directed to children and we do not knowingly collect data from anyone, children included. Radio and podcasts are third-party content and may contain adult material; Restricted Mode (Podcasts settings) greys out explicit-marked shows and asks for a PIN to follow them. It is an in-app filter, not parental control. Use your device's own parental controls for stronger protection.
Station names, logos and artwork
Station names and logos belong to their owners; the app is not affiliated with or endorsed by them. Podcast artwork comes from each show's own feed. Station owners can ask for removal at almostcyb.org/takedown.
Changes
If this policy changes we post the new version here with a new effective date; a material change is also announced in the app's release notes.
Contact
Łukasz Dec, trading as AlmostCyb.org, Poland. Contact form: almostcyb.org/support/wookie-radio.