Privacy and cookies

Overview

We respect your privacy. This notice explains what information we collect, how we use it, and the choices you have when using LoftwahFM services and websites.

Data we collect

• Account details such as email, username, and password hash
• Entitlements showing which private albums your account can access
• Subscription metadata used for stream access where relevant
• Security and operational logs such as failed logins and rate-limit events

Listening and game attribution

We measure playback starts and bounded audible progression to understand which public music, stations and games generate listening. Game telemetry is optional in the shared radio SDK. It uses random per-play tokens, not accounts, advertising cookies or a cross-game identity. Short-lived deduplication receipts are removed by our daily cleanup after 48 hours of inactivity, within at most three days; public daily totals are retained for 185 days. Public reports contain aggregate listening time, audio starts, explicitly instrumented game visits and radio-link clicks only. Test, preview, obvious bot and browser Do Not Track / Global Privacy Control events are excluded from these totals. Brief daily-hashed abuse buckets are discarded by the next daily cleanup, within about 25 hours. Historical site telemetry also records a locally stored session token, browser details, approximate country/region, playback events and account identifier when signed in; these records are not exposed by public game reports. Cloudflare operates our infrastructure and its own operational logs.

How we use data

• Authenticate your account and authorise access to content
• Provide and maintain streaming, delivery, and account features
• Prevent abuse and keep the service reliable and secure
• Send important account messages such as password resets and delivery details

Cookies

• Essential cookies only: an HttpOnly, Secure, SameSite=Lax session cookie keeps you signed in and authorises access to private content
• We do not set analytics cookies
• We do not set marketing cookies

Retention and sharing

We keep account and entitlement records while the account is active and as needed for operational, security, and legal reasons. We do not sell personal data. We may share limited data with infrastructure or delivery providers that help us operate the service under confidentiality and security obligations.

Your rights

Depending on your location, you may have rights to access, correct, or delete your personal data. You can contact us to make a request or ask a privacy question.