Privacy notice

This notice explains what citizen.stream (operator legal name to be confirmed before public launch) does with personal data when you listen to a citizen.stream station, ask for access, or use the console. It covers citizen.stream and its marketing mirror indie.audio, which are one service run from the same servers. We wrote the product to collect as little as possible.

Who is responsible

The controller is citizen.stream (operator legal name to be confirmed before public launch). Contact: privacy@citizen.stream. For audio, team accounts and sponsor records that an organisation puts into citizen.stream, that organisation is the controller and we act as its processor under our data processing terms.

Listeners

• No account, no app, no cookies, no advertising identifiers.
• Your IP address is used to deliver the stream and is not written to listener records. Audience figures are counts only.
• Web server access logs are switched off for citizen.stream sites.

People who request access

We keep your name, email, organisation and message to reply to you (legitimate interest, and your consent at the form). We delete requests after 365 days.

People with a console account

Data	Why	Lawful basis	Kept for
Name, email, password hash	To sign you in	Contract	Until you delete the account
Sessions: a salted hash of the IP, browser name	Security and abuse prevention	Legitimate interest	30 days after expiry
Audit trail of actions	Accountability inside your organisation	Legitimate interest	365 days
Operator conversations	To run the assistant you asked for	Contract	Until you delete them or the account

Passwords are stored only as scrypt hashes. We never store your IP address in readable form.

Who we share it with

Only the sub-processors that host and deliver the service. We do not sell data and we do not use it for advertising.

Where it is stored

In the European Union (Helsinki, Finland). Where a sub-processor is outside the EEA or UK, transfers rely on the European Commission's standard contractual clauses and the UK addendum, or an adequacy decision.

Your rights

You can see, correct, export and erase your data, restrict or object to processing, and withdraw consent. Account holders can export and delete from Your account. Everyone else: email privacy@citizen.stream and we answer within one month. You can also complain to your data protection authority: in the UK the ICO, in the EU the authority for your country.

Changes

We date every version of this notice and tell account holders by email before a material change.