Legal

Privacy policy

Last updated 25 October 2026 · Applies to stationhandradio.com and all Stationhand services

The short version

We collect as little as we can. Only what we need to run Stationhand, answer you and keep things secure.
No advertising, no tracking cookies, no selling. We never sell or rent personal information, and we don't use it for advertising.
Our website doesn't use cookies. We count visits anonymously and never store your internet (IP) address for statistics.
Your station's data is your station's. On a hosted station, we look after it for you and only use it to run the station.
Cloud storage is only what you connect. When a station or DJ connects OneDrive, Dropbox or Google Drive, Stationhand only works with its own folders, and you can disconnect at any time.
You're in control. You can ask to see, correct or delete your information at any time.

1. Who we are

Stationhand is radio automation, studio and listener software, run by Craig Ryan in the United Kingdom ("Stationhand", "we", "us", "our"). For the personal information described in this policy, we are the data controller, except where section 2 says otherwise.

If you have any question about privacy, or want to use any of your rights, email privacy@stationhandradio.com.

2. What this policy covers

This policy covers:

our website, stationhandradio.com, including the enquiry form, mailing list and live demo;
the Station Manager, our service that links, updates and supports Stationhand stations;
hosted stations that we run for you on our servers, and the invitation form used to set them up;
station websites we host at ws.stationhandradio.com, the listener app and web players;
the new music portal for artists and labels;
cloud storage connections (OneDrive, Dropbox and Google Drive);
the Stationhand software itself, where it sends information to us.

Radio stations and their own listeners. Each station that uses Stationhand decides how it uses its listeners', presenters', guests' and advertisers' information. That station is the data controller for that information, and its own privacy notice applies. Every station website includes one.

Stations we host: we process that information on the station's behalf, as its data processor, only to run its station and as it instructs.
Stations installed on their own computers: that information stays on the station's own computer, and we don't receive it, except for the limited technical reports described in section 3.6.

3. What we collect and why

3.1 Visiting our website

Our website uses no cookies and stores nothing on your device. To understand how the site is used, we count visits anonymously:

What we record: the pages viewed, the website or campaign that sent you (if any), and general details such as device type (phone, tablet or computer), browser, operating system, time zone and language.
How visits are counted: to tell visits apart, your IP address and browser details are combined with a random key that changes every day, and turned into a code that can't be reversed. Your IP address itself is never stored, and each day's key is deleted once the day is over, so you can't be recognised from one day to the next.
Automated visitors: search engine robots and automated browsers are ignored.

Like any website, our web servers see your IP address in order to send you the page. Their technical logs are kept for a short time for security and troubleshooting only.

3.2 Enquiries and the live demo

Enquiry form. When you send it, we receive:

your name and email address;
anything else you choose to give us: phone number, organisation, website, country, details about your station, the features that interest you, your message and how you heard about us;
the page you sent it from.

We use this to reply to you and to follow up on what you asked about. To stop abuse, we briefly limit how many forms can be sent from one internet address; that limit is kept in memory only, not stored.

Live demo. When you sign up, we also create a temporary, read-only login for you on a demonstration station. We record the address it was requested from, to prevent misuse. The login ends automatically when the demo period is over.

3.3 Our mailing list

We only add you to our mailing list if you ask us to. You receive at most one email a week, with news, updates and offers.

Joining: we email you first, and you're only added once you confirm by following the link ("double opt-in").
What we keep: your email address, name (if given), when and how you agreed, and the wording you agreed to.
Leaving: every email has an unsubscribe link, and you can leave at any time.
Unconfirmed sign-ups are deleted after 30 days.

3.4 Hosted stations

If we invite you to set up a hosted station, we collect the details needed to build and run it. These are:

your name, email address and, optionally, phone number, organisation, country and role;
your station's name, web name, description, music style, time zone and colours;
the console username you choose;
expected listener numbers and library size, licence status, and your agreement to the hosted station terms.

What we use them for: to review the application, build the station, send you its details, remind you before it expires, and support you.

Passwords: we never ask for your password on the form. The station's first password is shown to you once, through a link that works a single time.

When a station ends: as stated in the hosted station terms, a hosted station and all of its data are permanently deleted 7 days after it expires or ends.

3.5 Station Manager and console accounts

Station Manager accounts. For people who sign in to the Station Manager, we keep:

their username, name and email address;
their password, stored only as a secure one-way hash;
their two-step sign-in settings;
what they're allowed to manage.

We also keep a record of important actions (an "audit trail"), so we can see who changed what and keep the service secure.

Station contacts. These are the names and email addresses a station gives us, for alerts, sign-in help and important notices.

Console accounts. A station's console accounts (presenters, producers and so on) are kept on the station itself, not by us.

3.6 Technical information from stations

Stations linked to the Station Manager check in regularly, so that we can keep them licensed, up to date and working. Each check-in sends:

the software version and licence status;
health information, such as whether the stream is live, uptime, the current number of stream listeners and what's on air;
basic details of the computer it runs on: operating system, processor and memory;
how much storage the station is using.

If a station switches on station logging, it also sends its technical log, such as stream drops and errors. None of this includes listeners' personal information.

3.7 Listening, players and station websites

Delivering audio: to deliver a station's audio to you, our stream servers need your IP address while you listen.
Statistics: stations see listener numbers only as totals over time. Listening through a web player, a station website or the listener app is counted in the same anonymous, cookie-free way as visits to our website (section 3.1).
Station newsletters: if you sign up to a station's newsletter on its website, that station is responsible for your details, and its privacy notice applies. Sign-ups are confirmed by email, and every email includes an unsubscribe link.

3.8 Artists and labels (new music portal)

Your account: your name or artist name, contact name, email address, password (stored as a secure hash), website, biography, country and agreement to the portal terms.
Your music: the tracks you send us, with their details.
How it's used: we use this to review your music, offer approved tracks to stations, and report which stations added them.

3.9 Support and emails we send

Support: when a station contacts us through its console, we keep the conversation so we can help.
Service emails: we send these from our own mail server, for example alerts, sign-in help, approvals and expiry reminders. We keep standard delivery records to make sure email arrives and to prevent abuse.

4. Cloud storage connections (OneDrive, Dropbox, Google Drive)

A station's administrators, or an individual DJ, can choose to connect a Microsoft OneDrive, Dropbox or Google Drive account. You always sign in on the provider's own page: Stationhand never sees your cloud password.

What a connection is used for. Only for the features you switch on:

nightly backups of the station's audio library and, if chosen, its database;
an Import folder: audio you put in it is added to the station's library;
DJ mix folders: a mix and its .cue file are added as a pre-recorded show.

What Stationhand accesses. Stationhand works in its own folder: Stationhand/<station name>, or for Dropbox, the app's own folder Apps/Stationhand. It reads the files placed in that folder and writes the station's backups and status notes there. It doesn't open, change or delete any other files in your account. We also record the account's email address or name, and its storage space (total, used and free), so the station can show which account is connected and how much room is left.

Your access keys. These are the provider's "tokens" that let the station use your account.

They're stored on the station that uses them: for hosted stations, on our servers in France.
The Station Manager holds them only briefly and encrypted, while it hands them to the station, and then deletes them.
The station renews its access through the Station Manager, so our app's own secret keys stay with us.

Disconnecting. You can disconnect at any time in the console. The station's access is switched off and its keys are deleted; files already in your cloud stay there. You can also remove Stationhand's access from your account at any time:

Google user data. Stationhand's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google Drive data only to provide the backup, import and mix folder features you've chosen.
We don't use it for advertising, and we don't sell it.
We don't use it to train AI or machine-learning models.
We don't let people read it, except with your permission, for security reasons, to comply with the law, or where it's been made anonymous.

5. Our legal reasons for using your information

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), we rely on these legal bases:

Legal basis	What it covers
Contract	Running hosted stations, Station Manager and console accounts, the new music portal, cloud storage features you switch on, and support. It also covers steps you ask us to take before an agreement, such as reviewing an application.
Legitimate interests	Replying to enquiries, anonymous website statistics, keeping our services secure and preventing abuse, technical check-ins and service emails. We make sure these interests aren't outweighed by your rights.
Consent	Our mailing list and station newsletters. You can withdraw your consent at any time.
Legal obligation	Where the law requires us to keep or share information, for example for accounting or in response to a lawful request.

6. Cookies and browser storage

Our website and station websites: no cookies, and nothing stored on your device for tracking or advertising.
Signed-in services: the Station Manager, station consoles and the portals use your browser's storage only for what they need to work. That means keeping you signed in, remembering a trusted computer for two-step sign-in (for up to 30 days) and saving preferences such as the colour theme.
Consent: because this storage is strictly necessary for the service you ask for, it doesn't need your consent.

We never sell or rent personal information. We share it only where needed to provide Stationhand, with these service providers:

Provider	Why	Where
OVHcloud	The servers for hosted stations, station websites, email and our website	France and the UK
ClouDNS	Internet names (DNS) for stations: station names only	EU
Let's Encrypt	Security certificates for station addresses: web addresses only	USA
Docker Hub	Delivering Stationhand software and updates to stations	USA
Microsoft, Dropbox, Google	Only if you connect a cloud storage account (section 4)	Under the provider's own terms

Services stations can use. The Stationhand software can look up information that contains no personal information:

song details for artwork, music reporting and lyrics checks: Apple iTunes Search, Deezer and LRCLIB;
the weather for the station's town: Open-Meteo and OpenStreetMap.

A station can also choose an AI voice service with its own account, such as Typecast. The text of its links is then sent to that service, under that service's terms.

When else we may share information:

if the law requires it;
to protect the rights, safety and security of our users, our services or others;
with a buyer or successor, if Stationhand is ever sold or reorganised. If that happens, we'll tell you, and this policy will continue to apply.

8. Where your information is kept

United Kingdom: the Station Manager runs on our own equipment in the UK, and our website on OVHcloud servers in the UK.
France: hosted stations, station websites and our email run on OVHcloud servers in Gravelines. The UK recognises the European Economic Area as giving an adequate level of protection, so this transfer needs no extra safeguards.
Your own computer: a station installed on its own computer keeps its data there.

Where a provider in another country handles personal information for us, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or the UK–US data bridge.

9. How long we keep it

Information	How long
Anonymous visit and listening statistics	Up to 400 days. Listener totals up to 800 days. The daily key behind visit counting is deleted after each day.
Enquiries	As long as needed to deal with them, and no more than 2 years after our last contact.
Mailing list	Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days.
Live demo logins	Until the demo period ends. The sign-up is kept as an enquiry (see above).
Hosted stations	While the station runs. Everything is permanently deleted 7 days after it expires or ends.
One-time password links	Up to 3 days. A link is wiped as soon as it's opened.
Cloud sign-in keys held by the Station Manager	Until the station collects them, and never more than a day.
Station technical logs sent to us	30 days.
Accounts (Station Manager, portals)	While the account is in use, and up to 12 months after it closes. The audit trail is kept for the same time.
Artists' music and details	Until you withdraw it or close your account.

We may keep some information longer where the law requires it, for example accounting records.

10. How we protect it

Encryption in transit: everything is sent over encrypted (HTTPS/TLS) connections.
Passwords: stored only as secure one-way hashes. Two-step sign-in is available for the Station Manager and station consoles.
Secrets: sensitive items, such as one-time passwords and cloud sign-in keys, are encrypted with AES-256.
Access: our servers are protected by firewalls and key-only access, kept up to date, and only people who need access have it.
Hosted stations: each one runs separately, in its own virtual machine.

No system is perfectly secure. If a breach affects your information and puts you at risk, we'll tell you and the Information Commissioner's Office as the law requires.

11. Your rights

You have the right to:

access the personal information we hold about you;
have it corrected if it's wrong, or deleted;
restrict or object to how we use it, including objecting to anything based on legitimate interests;
receive it in a portable format (data portability);
withdraw consent at any time, where we rely on it.

How to use your rights: email privacy@stationhandradio.com.

We'll reply within one month, and there's normally no charge.
We may need to confirm who you are first.
If your request is about a radio station's listeners, presenters or newsletter, contact that station. If it's a station we host, we'll help it respond.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, on 0303 123 1113.

12. Children

Stationhand's services are for radio stations, presenters, artists and the people who run them. They're not aimed at children under 13, and we don't knowingly collect children's information. If you think a child has given us their details, contact us and we'll delete them.

13. Changes to this policy

We may update this policy as Stationhand changes or the law requires. The date at the top shows when it last changed. If we make important changes, we'll make them clear here and, where appropriate, tell you by email or in the Station Manager.

14. Contact us

For questions about this policy or your information:

Stationhand – Craig Ryan
Email: privacy@stationhandradio.com
Website: stationhandradio.com