Privacy Policy

Last updated: 21 October 2026

This is an English translation. If there is any discrepancy, the Portuguese version prevails.

This policy explains what personal data the Audissey app and the audissey.io website process, what for, who it is shared with, how long it is kept and how you can exercise your rights. It applies to the app on every platform where it is available.

Who we are

The controller of your data is Tiago Costa, an individual based in Portugal, who develops and provides Audissey. In this policy, “we” and “us” mean Tiago Costa as the person responsible for Audissey.

For any question about privacy, support or requests about your data, email alerts@audissey.io.

Quick summary

• We collect what is needed for your account and for Audissey to work and adapt to you: email, name, age, preferences, what you listen to and, on your phone, if you allow it, your medium-accuracy location. On computers, the app does not determine your location: it only uses the language and country set in your operating system.
• We do not sell your data. Audissey is free and shows no ads of its own (radio stations and podcasts may include their own ads).
• We do not use third-party analytics or advertising SDKs. The Android and iOS apps include the Facebook SDK only for Facebook sign-in; even if you do not use it, the SDK may contact Meta's servers when you open the app — we explain it in full below.
• We never receive the audio of your voice. Speech recognition is done by your operating system's service.
• Usage events are deleted after 7 days. Most other data is kept while you have an account or until you delete it.
• The audissey.io website uses no cookies and no analytics.
• You can delete your account directly in the app, and ask to access, correct or delete your data at any time, by email.

What data we collect and why

Account and profile

• What: email, name, age, password (stored only as a protected hash, never in plain text), preferred language, time zone, country, the favourite radio stations you pick when you sign up and the preferences you set to fine-tune A tua Audissey (Your Audissey). If you sign in with Google, Apple or Facebook, we also store the identifier that service links to your account.
• Why: to create and manage your account, let you sign in and adapt the app to your language, time zone and country.

Email, name and age are requested at sign-up and are required to create an account. We ask for your age to confirm that you are at least 13; it is stored in your profile and is not used for anything else.

Location

• On your phone, only if you give permission and only while you are using the app: medium-accuracy coordinates. They are sent at sign-up and stored in your profile, and they are included in requests for radio stations near you and for new episodes. The matching country and city are obtained through the operating system's location service (Apple or Google).
• On your computer (macOS and Windows), the app does not determine your location: it only uses the language and country set in your operating system, just as on your phone when you do not give location permission.
• Why: to show radio stations near you (the “Perto de ti” / Near you section) and suggest content relevant to your area.

App usage

• What: events such as starting, stopping or skipping playback, favourites, sessions, recommendations seen or opened and use of programmings, together with device type, app version and time and day.
• Why: to run and improve recommendations and the service, and to understand problems.
• How long: 7 days.

Listening history

• What: what you listened to (content and title) and how far you got (progress and position).
• Why: to resume where you left off, show “Recently played” and personalise recommendations.

Favourites, collections and programmings

• What: stations, podcasts and programmes you save, your collections, the programmings you create or save and the listening sessions you schedule.
• Why: to store and sync your library and play what you scheduled.
• Sharing by link: if you share a programming, anyone with the link can see it for 7 days, including your profile name (or “Ouvinte” — “Listener” — if you have none).

Recommendation profile

• What: data we calculate from your usage — aggregated listening metrics, preferred genres, relevance scores and a preference vector. We also keep logs of recommendation requests, the content you skip and temporary copies of data used to train the model.
• Why: to generate A tua Audissey, weekly discoveries (“Descobertas da semana”), “Programas para ti” (programmes for you) and other suggestions. The recommendation model is our own and is not shared with third parties.

Voice commands

• What: voice commands are available in the mobile apps. Speech recognition is done by your phone's operating system service (Apple or Google), which may process the audio on its own servers. Audissey does not receive audio. We store up to 50 characters of the transcribed text in usage events.
• Why: to carry out the command you asked for (for example, playing a station or creating a programming) and to understand how commands are used.
• How long: the text snippet is deleted with the events, after 7 days.

If you use Siri or Google Assistant to control Audissey (for example, in the car), Apple's or Google's rules apply.

Searches

• What: the terms you search for are sent to our API. If there are no results in our database, the server sends only the search term, with nothing that identifies you, to the Podcast Index and Radio Browser services. Search terms may appear in technical logs. Your last 15 searches are stored on your device.
• Why: to show you results and search suggestions.

Feedback

• What: if you send us feedback from the app: the text, the categories you choose, the app version, the platform and, if you want, screenshots.
• Why: to reply to you, fix problems and improve Audissey.

Technical data

• What: technical logs from our servers in Azure Application Insights (requests, errors, performance, app version and platform). Your IP address is used transiently to limit excessive requests and is not stored in our database.
• Why: to keep the service secure and running, detect abuse and fix errors.

Data stored on your device

The app stores on your device your session data (in secure storage), your email, name and age, recent history, your last 15 searches, your preferences and the episodes you downloaded to listen offline. When you sign out, session data and local history are deleted. If you delete your account in the app, your local preferences and search history are deleted too; downloaded episodes stay on your device until you remove them or uninstall the app. Uninstalling the app removes most of the data it stores on your device, but depending on the operating system some items may persist — for example, session data kept in the system keychain. Uninstalling the app does not delete your account.

What we do not collect

• Payment data (there are no purchases in the app).
• Your contacts or photos (except screenshots you choose to attach to feedback).

Audissey notifications are local only: they are scheduled on your device and do not go through notification servers.

Where the data comes from

Most data is provided by you or generated when you use the app. Some comes from other sources: your device (language, time zone, country and, on your phone, location if you allow it), Google, Apple or Meta when you choose to sign in with them (the account identifier and, depending on what you authorise, your name and email) and, on your phone, the operating system's location service (country and city). The recommendation profile is calculated by us.

Legal bases

We process your data under the General Data Protection Regulation (GDPR) and Portuguese Law 58/2019. For each purpose, the legal basis is as follows (Article 6(1) GDPR):

Where we rely on legitimate interests, you can object to that processing (see Your rights). Where we rely on consent, you can withdraw it at any time in your system settings, without affecting processing carried out before that.

Who we share data with

We do not sell your data or use it for advertising. We share data only with those we need for Audissey to work and with the third-party services included in the app described below — including the Facebook SDK (see the note at the end of this section).

Providers that process data on our behalf

Third parties that process data under their own rules

Note on the Facebook SDK. To enable Facebook sign-in, the Android and iOS apps include Meta's software development kit (SDK). We have turned off this SDK's automatic logging of app events and its collection of the advertising identifier, and Audissey does not show ads of its own. Even so, the SDK is initialised when you open the app and may contact Meta's servers to fetch technical settings, even if you do not use Facebook sign-in. In that contact, Meta receives your device's IP address and basic technical information, such as the app and SDK version and the device and operating system type. Your Facebook profile data (such as your name and email) is only shared if you choose to sign in with Facebook. Meta processes this data under its own privacy policy.

When you open a Spotify link, you leave Audissey and Spotify's rules apply.

Artificial intelligence: we use artificial intelligence providers (OpenAI, Google Gemini and Mistral) only to process public information about radio stations and programmes, such as programme schedules. We never send them user data.

We may also have to disclose data to authorities where the law requires it.

International transfers

Some providers are outside the European Economic Area (EEA):

• USA — Twilio SendGrid, Meta, Google and Apple. These transfers are protected by the EU-US Data Privacy Framework, where the company is certified, and/or by Standard Contractual Clauses approved by the European Commission.
• United Kingdom — part of our Microsoft Azure hosting, including, depending on the region used, the MongoDB Atlas database. The United Kingdom is covered by a European Commission adequacy decision.

You can ask us for more information about these safeguards at alerts@audissey.io.

How long we keep data

Security

We protect your data with appropriate technical and organisational measures, including:

• connections to our API always over HTTPS;
• passwords stored as a hash (bcrypt), never in plain text;
• sessions that expire and are revoked when you sign out or delete your account;
• single-use magic links, valid for 15 minutes;
• configuration secrets stored in Azure Key Vault.

Please note: not every connection the app makes is encrypted: some radio stations broadcast their streams over HTTP, without encryption. No system is 100% secure, but we work to protect your data.

Your rights

Under the GDPR, you have the right to:

• Access — know what data we hold about you and get a copy;
• Rectification — correct inaccurate or incomplete data;
• Erasure — ask us to delete your data;
• Restriction — ask us to temporarily stop using your data, in certain cases;
• Portability — receive the data you gave us in a structured, commonly used format;
• Objection — object to processing based on legitimate interests;
• Withdraw consent — at any time, in your system settings, without affecting processing carried out before that.

How to exercise your rights

1. Email alerts@audissey.io, preferably from the email address of your account, saying what you would like us to do.
2. If needed, we will ask you for more information to confirm the account is yours.
3. We reply within 30 days at the latest. If the request is particularly complex, we will tell you within that period if we need more time, as the law allows.

Exercising your rights is free of charge. There is no automatic data export in the app yet: access and portability requests are handled by email.

If your location is already stored in your profile and you withdraw the location permission, the app stops sending it. To have us delete the stored location too, email us.

If you think we have not handled your data properly, you have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. We would appreciate the chance to sort it out with you first.

Deleting your account

You can delete your account and all associated data at any time, directly in the app, under Profile → «Eliminar conta» (Delete account). If your version of the app does not have this option yet, or if you can no longer sign in to your account, you can make the request by email. We explain every step and what happens to your data on the Delete account page. After deletion, your data may remain in encrypted database backups until they expire (up to 12 months); these backups are used only for disaster recovery.

Device permissions

All permissions are optional and you can revoke them at any time in your system settings. If you do not grant them, the rest of the app keeps working.

• Location (phone) — only while you use the app. It is used to show radio stations near you. Without it, the “Perto de ti” (Near you) section and local suggestions stop working or become less accurate.
• Microphone and speech recognition — used for voice commands, available in the mobile app. Without them, voice commands do not work.
• Notifications — used to remind you of the listening sessions you scheduled. They are created on your device, with no notification servers. Without this permission, you will not get those reminders.

On computers, no location permission is requested and the app does not determine your location: it only uses the language and country set in your operating system, as explained in What data we collect and why.

Children

Audissey is not intended for children under 13 (in line with the age set in Article 16 of Portuguese Law 58/2019). If you are under 13, you should not use Audissey.

We ask for your age at sign-up to confirm that you are at least 13. It is stored in your profile and is not used for anything else.

If we learn that an account belongs to a child under 13, we delete it. If you are a parent or legal guardian and believe a child under 13 has created an account, email alerts@audissey.io.

The audissey.io website

The audissey.io website uses no cookies, no analytics and makes no requests to third parties (for example, fonts are hosted on the site itself). That is why we do not show you a cookie banner.

The website is hosted on Microsoft Azure Static Web Apps. To deliver the pages and protect the site, Microsoft may process your IP address and technical request data in server logs. The legal basis is our legitimate interest in providing a working and secure website.

If you write to us using an email link on the website, the message is received in our Zoho Mail mailbox.

Recommendations and automated decisions

Audissey uses your history, favourites, usage events, preferences and, on your phone, if you allow it, your medium-accuracy location to suggest content (A tua Audissey, weekly discoveries and other recommendations). This is a form of profiling to personalise the app.

These recommendations have no legal effects and do not affect you in a similarly significant way: they only suggest what to listen to. We do not make solely automated decisions with such effects. You can fine-tune the criteria of A tua Audissey in the app. If you do not want your data to be used to improve recommendations and train the model, you can delete your account: your data is deleted and the model is retrained without it. You can also contact us with any objection, which we will assess as required by law.

Changes to this policy

We may update this policy when the app or the law changes. The “Last updated” date shows the version in force. If the changes are significant, we will let you know in the app or by email before they take effect.

Contact

Please also read the Terms of Service.