## 1. Information We Collect ### Automatically Collected When you use Sonaria, we automatically collect: - **IP address**: Used for rate limiting and security (fail2ban). Stored temporarily in server logs. - **Listening data**: When you tune in to the radio, your connection is counted as a listener. No personal identifier is attached. - **Play counts**: When you play a song, an anonymous counter is incremented. No user tracking. ### User-Provided When you upload a song or playlist URL: - The URL you submit is stored in our database - Song metadata (title, artist, cover art) is fetched from Suno and cached - No account or personal information is required to upload ### What We Do NOT Collect - We do not require accounts or email addresses - We do not use cookies for tracking - We do not use analytics or tracking pixels - We do not sell or share data with third parties - We do not use fingerprinting or behavioral tracking ## 2. How We Use Information - **IP addresses**: Rate limiting, brute-force protection (fail2ban), and security hardening - **Play counts**: Displaying popularity metrics in the catalog - **Upload data**: Serving uploaded songs in the feed and community radio ## 3. Data Storage - Song metadata and upload records are stored in SQLite databases on our server - Server logs (including IP addresses) are rotated daily and retained for 7 days maximum - Redis is used for caching and rate limiting; no personal data is stored in Redis ## 4. Third-Party Services ### Suno (suno.com) Song content (audio, cover art, metadata) is fetched from Suno's CDN. When you play a song, your browser connects directly to `cdn1.suno.ai` (or through our proxy when the visualizer is active). Suno's privacy policy applies to their CDN. ### Cloudflare If proxied through Cloudflare, basic request routing and DDoS protection apply. Cloudflare may log request metadata per their privacy policy. ### Hosting Provider Our server is hosted with a third-party provider. They may collect basic server metrics per their privacy policy. ### Discord Bots (Sonaria Music & Sonaria Radio) If you use our optional Discord bots, they process the minimum data Discord provides to make slash commands and voice playback work: - **Slash command input**: The genres or Sonaria links you type into a command are used only to answer that command and are not stored - **Voice state**: The bots see which voice channel you are in, only to join it — this is never stored - **Radio assignments**: For Sonaria Radio, we store the Discord server ID, the chosen voice channel ID, and the chosen station so the radio can resume after restarts. Nothing else. Running `/stopradio` deletes this record - **What the bots do NOT do**: They do not read chat messages, do not store user IDs or usernames, do not record audio, and do not track listening behavior Your use of Discord itself is governed by [Discord's Privacy Policy](https://discord.com/privacy). ## 5. Data Retention - **Server logs**: 7 days (automatically rotated) - **Upload records**: Retained until manually removed - **Play counts**: Aggregated and anonymous; retained indefinitely - **IP bans (fail2ban)**: 1 hour for SSH brute-force protection - **Discord radio assignments**: Server/channel/station IDs only; retained until someone runs `/stopradio` or removes the bot ## 6. Your Rights Since we do not collect personal data or require accounts: - There is no personal data to access, export, or delete - If you want an uploaded song removed, contact us via GitHub - You can use the Service without providing any personal information ## 7. Security We implement standard security measures: - UFW firewall (only ports 22, 80, 443 are open) - Fail2ban for SSH brute-force protection - SSH key-based authentication (password auth disabled) - HTTPS with Let's Encrypt certificates - Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) - Request body size limits - Rate limiting on API endpoints ## 8. Children's Privacy The Service is not directed at children under 13. We do not knowingly collect any data from children. If you believe a child has provided information, contact us and it will be removed. ## 9. Changes to This Policy We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. ## 10. Contact For privacy concerns, reach out via GitHub at [github.com/jumpino27](https://github.com/jumpino27).