Privacy Policy

Last updated: October 13, 2026

72FM ("we", "us", "our") operates 72fm.com (the "Service"). This policy explains what personal data we collect, why we collect it, and your rights under GDPR, UK GDPR and the CCPA.

1. Data we collect

  • Account data: email address, display name, and password hash when you sign up.
  • Listening activity: stations played, favorites, listening history — stored to power your library. The 20 (free) or 100 (Premium) most recent plays shown on screen are a display limit, not a deletion: signed-in history stays stored until you delete it or your account.
  • Mood search: the text you type into "Match my mood" is sent to our server and passed to an AI model (currently an OpenAI model, reached through our host Lovable's AI gateway) so it can choose stations for you. We do not store that text or attach it to an account. Please do not put personal details in it.
  • Listener requests: a request you send while signed in (the station or song, an artist and a note if you add them) is stored with your account id and display name. Approved requests are shown publicly with that display name.
  • Payment data: processed by PayPal. We never see or store your card number. From PayPal we receive and keep your order reference, the plan and its expiry date, and the email address on your PayPal account, which we use to match a purchase made without an account to the account you create afterwards.
  • Technical data: IP address, browser type, device type, and referrer, collected via standard server logs.
  • Page counts: our own counter records page views and clicks on 72fm.com with no cookie and no identifier of any kind — the page, the site you arrived from (or, if you followed a link from one of our own tools, posts or messages that carries a source tag, the name of that tool or network), whether the screen is phone-sized, and the time. Nothing in that record can be tied to you or to your next visit, so it tells us which pages people read and where the sign-up path breaks, and nothing about anyone. Browsers sending Global Privacy Control or Do Not Track are left out of the count entirely.
  • Cookies and local storage: essential storage for authentication and your player; optional analytics only if you consent. Our host also runs its own visitor analytics on every page, which records your browser's user agent and language, a country guess, the page address and the referring page, and keeps a random session id for 30 minutes in a cookie or browser storage — see the Cookie Policy.

2. How we use your data

  • To provide the Service (playback, favorites, history, cross-device sync).
  • To process Premium subscriptions via PayPal.
  • To communicate service updates and respond to support requests.
  • To detect abuse and enforce our Terms of Service.

3. Legal basis (GDPR / UK GDPR)

  • Contract: account creation, Premium billing.
  • Legitimate interest: abuse prevention, service analytics in aggregate.
  • Consent: optional cookies and marketing communications.

4. Data sharing (subprocessors)

  • PayPal — payment processing.
  • Supabase — hosted database, authentication, storage and the stream relay described below (edge functions).
  • Cloudflare — the network that delivers 72fm.com and filters abusive traffic. It sees your IP address like any such network and sets a short-lived security cookie (__cf_bm); see the Cookie Policy.
  • Lovable — hosting of the site, including its built-in visitor analytics (described in the Cookie Policy), and the AI gateway that passes "Match my mood" text to the model provider.
  • Ticketmaster — event listings, fetched by our server (no personal data shared).

Besides the services above, your browser contacts the following directly, which means they also see your IP address the way any site you open does:

  • Radio Browser — the open, community-run station directory 72FM is built on. Browsing or searching stations queries it from your browser, and pressing play tells it which station you chose — the directory asks apps to do this so its public popularity counts stay accurate. It receives the station, not who you are.
  • Skimlinks (affiliate network) — whenever 72FM uses it, it loads only on guides that link to shops, and only if you chose “Accept all”. It turns those shop links into affiliate links so 72FM can earn a commission if you buy, and it sees which shop link you clicked. With “Essential only” it never loads.
  • Apple (iTunes) — podcast charts, search and artwork. Episode feeds are fetched by our own server, never through third-party proxies.
  • PayPal — its checkout script loads as soon as you open the Premium page, before you press anything, so PayPal sees your IP address then; its own privacy policy applies.
  • Ticketmaster's image servers — event pictures on the Events page load straight from them.
  • The broadcasters themselves — station logos load from wherever the broadcaster publishes them, so their servers see your IP address. The audio is different: on 72fm.com, station and podcast audio is relayed through 72FM's stream proxy (a Supabase edge function), which passes it through unchanged and does not store it. The station then sees the proxy's address rather than yours, while the proxy and the platform it runs on see your IP address and the stream address you opened, as any server does and as its request logs may record. The embeddable player is the exception: it plays the station's stream directly from your browser, so there the station sees your IP address.

Fonts and placeholder artwork are served from 72fm.com itself, so no font service, avatar service or analytics network is contacted on your behalf.

We do not sell your personal data. Ever.

5. Data retention

Account data is kept while your account is active. If you delete your account, we erase your personal data within 30 days, except where retention is legally required (e.g. tax records for paid subscriptions).

6. Your rights

Under GDPR / UK GDPR / CCPA you may request access, correction, deletion, restriction, portability, or object to processing. Contact privacy@72fm.com. You may also lodge a complaint with your local data protection authority.

7. International transfers

Our infrastructure providers may store data outside your country of residence. We rely on Standard Contractual Clauses where required.

8. Children

The Service is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to this policy

We will post updates on this page and, where material, notify subscribers by email.

10. Contact

Email privacy@72fm.com or visit our contact page.