Last updated: 20 August 2026
Online: https://app.glassydev.de/apps/audiostream/privacy.html
1. Controller
Dimitri Valjuzenic
Brauhausstr. 17 B
26506 Norden
Germany
Email: contact@glassydev.de
Support: support@glassydev.de
Privacy: privacy@glassydev.de
2. Overview
AudioStream (iOS, macOS, tvOS, watchOS and widget) streams audio: internet radio, local and NAS media and, optionally, your own music server. Personal data is processed only as necessary for operation, optional login, optional iCloud synchronization, in-app purchases and support.
No tracking or advertising SDKs are used. There is no cross-app tracking within the meaning of App Tracking Transparency (ATT). Non-essential trackers are not activated before consent (TDDDG). The associated website provides information and is not a web player.
Sign in with Apple is not used. Optional login uses OpenID Connect (typically Pocket ID) with an identity provider you specify.
3. Website and hosting (Vercel)
This page and related legal documents at https://app.glassydev.de/apps/audiostream/ are provided through Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Server log data (IP address, timestamp, requested URL, user agent, referrer) may be processed.
| Purpose | Legal basis | Retention |
|---|---|---|
| Website provision, security and stability | Article 6(1)(f) GDPR (legitimate interest) | According to Vercel policies, generally limited log retention |
Recipient: Vercel Inc., USA. Third-country transfer: USA; safeguards through standard contractual clauses (Article 46 GDPR) and a data processing agreement (DPA). These pages use no tracking cookies, Google Analytics or advertising pixels.
4. Processing overview
| Processing | Purpose | Legal basis (Article 6 GDPR) |
|---|---|---|
| App features (radio, media, NAS) | Streaming and playback | Paragraph 1(b) |
| In-app purchases (StoreKit) | Premium subscriptions and purchases | Paragraph 1(b) |
| iCloud / CloudKit | Optional synchronization of favorites, playlists and trial status | Paragraph 1(b) / (a) |
| OIDC / Pocket ID (optional) | Login to your own music server | Paragraph 1(b) / (a) |
| RadioBrowser, cover/favicon requests | Station lists, cover art and station icons | Paragraph 1(b) / (f) |
| Website hosting (Vercel) | Provision of legal documents | Paragraph 1(f) |
| Support requests | Handling user inquiries | Paragraph 1(b) / (f) |
5. What data is processed?
5.1 Data you provide
- When contacting support: name, email and message content.
- NAS credentials (username/password): only stored locally in Keychain, not sent to us.
- Optional OIDC/Pocket ID: access/refresh tokens and email address from the identity provider, stored locally in Keychain.
- Server URLs you enter (music API, OIDC issuer, client ID, stream and NAS addresses).
5.2 Automatically or technically processed data
- Device and app information needed for operation (app version, platform).
- Purchase data through Apple StoreKit (transaction ID, product, subscription status).
- A local device/user identifier for favorite lists on your own server.
- Search terms from stream metadata for optional cover searches (title/artist).
- Radio station hostnames for optional favicon requests (domain only, no login data).
5.3 Local app data
Settings, favorites, playlists and playback information may be stored locally on your device. The widget and Apple Watch share this data locally through the shared app container. Legal basis: Article 6(1)(b) or (f) GDPR.
6. Permissions
AudioStream does not request microphone, camera, location or contacts access. NAS/DLNA uses the local network (NSLocalNetworkUsageDescription, Bonjour services including SMB, HTTP/HTTPS and UPnP). Local folders are read only after explicit selection in Files/Finder.
7. Network connections and external services
7.1 Radio streams
During playback, your device connects directly to the station’s stream URL or CDN. We receive no content or connection data about your playback. The provider may technically process your IP address, timestamp and user agent; that third party is responsible for this.
7.2 RadioBrowser
Station lists and metadata are loaded from public RadioBrowser mirrors (e.g. *.api.radio-browser.info) to display internet radio.
7.3 Cover search (iTunes Search API and Deezer)
For Now Playing cover art, the App may send titles/artists to itunes.apple.com/search and api.deezer.com/search. Only search terms from stream metadata are transmitted, not account data.
7.4 Favicon services (Google, gstatic, DuckDuckGo)
If a station logo is missing, the App may load favicons as a fallback from public CDN endpoints: www.google.com/s2/favicons, t3.gstatic.com and icons.duckduckgo.com. The hostname of the station page or stream URL is transmitted, with no account data, tracking SDKs or cross-app tracking. Legal basis: Article 6(1)(f) GDPR (legitimate interest in a readable station display). Recipients may process data in third countries, including the USA.
7.5 Your own NAS / Docker music server / Pocket ID
Connections to WebDAV, SMB, FTP/FTPS, DLNA and a self-hosted music API go only to addresses you enter. The server’s OIDC issuer and client ID are adopted only after your confirmation in the App. We do not operate your identity provider; its operator determines how data is processed there. Unencrypted FTP is possible and is marked as a risk in the App.
8. Cloud services and SDKs
| Service | Provider | Purpose | Legal basis |
|---|---|---|---|
| StoreKit | Apple Inc. (USA) | In-app purchases / Premium | Article 6(1)(b) GDPR |
| iCloud / CloudKit | Apple Inc. (USA) | Optional synchronization (favorites, playlists, trial) | Article 6(1)(b) / (a) GDPR |
| ASWebAuthenticationSession (OIDC) | System browser / your IdP | Optional Pocket ID login | Article 6(1)(b) / (a) GDPR |
| Vercel | Vercel Inc. (USA) | Hosting of this website | Article 6(1)(f) GDPR |
For StoreKit, Apple processes transaction data under its own privacy terms. We do not receive complete payment details (e.g. credit card numbers). Subscriptions, renewals, cancellations and refunds are managed through Apple (Settings → Apple ID → Subscriptions). Privacy: apple.com/legal/privacy.
Optional synchronization of radio favorites, media favorites and playlists uses the CloudKit container iCloud.io.dima.webradio. Data is stored in the user’s iCloud account and is not transmitted to us as the app provider.
Not used: Sign in with Apple, analytics, advertising or tracking SDKs, crash reporters or our own cloud backends with user accounts.
9. Data transfers to third countries
Transfers to the USA may occur through Vercel (website), Apple (StoreKit, iCloud), optional cover search (Apple/Deezer), optional favicon requests (Google/gstatic/DuckDuckGo) and stations, NAS or Pocket ID servers you select. Legal basis: an adequacy decision (EU–US Data Privacy Framework), where applicable, and/or standard contractual clauses (Article 46 GDPR).
10. Retention periods
- Local app data: until you delete it, restore factory settings or uninstall the App.
- OIDC tokens and NAS passwords: until logout, factory reset or App uninstallation.
- iCloud data: while synchronization is active; deletion through iCloud or the App’s factory reset.
- Website logs (Vercel): according to provider policies, generally retained for a limited period.
- Support requests: until resolved, at most 12 months unless retention obligations apply; in legal disputes, up to 3 years.
- Purchase/transaction data (Apple): according to Apple policies and statutory retention obligations (up to 10 years).
11. App Store privacy information
The information in App Store Connect / PrivacyInfo.xcprivacy is consistent with this policy:
| Category | Details |
|---|---|
| Tracking | No |
| Email address | Yes, linked to you — app functionality (optional Pocket ID) |
| User ID | Yes, linked to you — app functionality |
| Other user content | Yes, linked to you — favorites/playlists (app functionality) |
| Purchase history | Yes, linked to you — StoreKit (app functionality) |
| Diagnostics / analytics / advertising | No |
12. Your rights
You have the rights of access, rectification, erasure, restriction, data portability and objection (Articles 15–21 GDPR), and to withdraw consent with future effect (Article 7(3) GDPR). Requests: privacy@glassydev.de; handled without undue delay and within one month at the latest.
13. Competent supervisory authority (Lower Saxony)
State Commissioner for Data Protection of Lower Saxony
Office: poststelle@lfd.niedersachsen.de
Website: lfd.niedersachsen.de
14. Consent and data security
No tracking consent tool is used because there are no tracking services. iCloud synchronization and Pocket ID login occur only following an active user decision. TLS is used for HTTPS, Keychain for secrets, and the app sandbox on Mac.
15. Minors
AudioStream is not specifically directed at children under 16.
16. Changes
The current version applies at this address.