Data policy
Shader Bytes · last updated 20 August 2026
Your account and your music live on a server in Frankfurt, Germany. A short list of named companies process data for us. Everything has a deletion date, and we tell you within 72 hours if any of it is breached.
Contents
The privacy policy covers what we collect and your rights over it. This page is the engineering behind it: where the data physically sits, who else touches it, how long we keep it, and what happens when something goes wrong.
Where your data is stored
The Stereobox database, the uploaded audio and everything about your account are on a virtual server in Frankfurt am Main, Germany, run by Hostinger International Ltd. Media files are additionally distributed through Bunny.net's content network so a track starts quickly wherever you are.
For anyone in the EEA this means the primary copy of your data never leaves the Union. Where a processor below does operate outside it, the transfer runs on the European Commission's Standard Contractual Clauses, or on the EU–US Data Privacy Framework where that company is certified under it.
Who processes data for us
These are every company that handles personal data on our behalf. Each is bound by a written processing agreement and may use the data only as we instruct.
| Company | What for | Where |
|---|---|---|
| Hostinger International Ltd | The server running the API and database | Frankfurt, Germany |
| Google Ireland Ltd / Google LLC | Firebase Authentication (sign-in) and Cloud Messaging (push notifications) | EU and US — Data Privacy Framework |
| Google Ireland Ltd / Google LLC | AdSense advertising, only after you consent | EU and US — Data Privacy Framework |
| BunnyWay d.o.o. (Bunny.net) | Storing and delivering audio, artwork and video | Slovenia, EU, with a global edge network |
| Stripe Payments Europe Ltd | Taking payments made through the website | Ireland |
| Google Play / Apple Distribution International | Taking payments made inside the mobile apps | Ireland and US |
Google, Apple and Stripe act as controllers in their own right for the payment itself, under their own terms. We receive the outcome and a reference — never a card number.
How long we keep things
| What | Kept for |
|---|---|
| Your account and everything in it | Until you delete it, then removed within 30 days |
| Listening history | 26 months, then aggregated into counts with no link to you |
| Proof that you accepted the terms | 3 years after the account closes, so we can answer a dispute |
| Purchase and payout records | 10 years — German commercial and tax law (§147 AO, §257 HGB) requires it, and we cannot shorten it |
| Private messages | Until you or the other person deletes them |
| Server and security logs, including IP addresses | 14 days, unless one is part of an incident being investigated |
| Reports and moderation decisions | 2 years, so patterns of abuse stay visible |
Deleting your account is explained on its own page, including the two things that survive it and why.
How it is protected
- Everything travels over TLS. There is no unencrypted route into the API.
- We never see your password — Firebase Authentication holds it, and we could not read it if we wanted to.
- Card details never touch our servers.
- Access to the production database is limited to people who need it, over key-based authentication only.
- Media is served through signed, expiring URLs rather than public links.
- Requests are rate-limited, and repeated failed sign-ins are throttled.
- Backups are encrypted and kept for 30 days.
If there is a breach
If personal data is exposed and it is likely to put you at risk, we notify the competent supervisory authority within 72 hours of becoming aware, as Article 33 GDPR requires, and we tell you directly and in plain language: what happened, what was exposed, what we have done, and what you should do. We will not wait until we understand every detail before telling you.
Asking for your data
Settings → Download my data in the app produces a machine-readable file of everything we hold. Or write to support@stereobox.io and we will send it within a month, free.