Privacy policy

Last updated: Oktober 2026. This English text is a convenience translation. The German version is the legally binding one.

Scope

This policy applies to the web app at app.ondial.de and to the website at ondial.de including all its subpages.

Controller

Felix Wallerius, c/o IP-Management #12486, Ludwig-Erhard-Straße 18, 20459 Hamburg, Deutschland
Email: kontakt@ondial.de
Ondial is a privately run, non-commercial project.

Hosting and technical provision

The application and the website ondial.de run on Cloudflare (Workers, cache, DNS). When you open a page, the servers process your IP address and browser details as technically necessary to deliver the page and to prevent abuse. This includes a short-term limit on requests per IP address. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).

Security check (Cloudflare Turnstile)

Before your stream is checked and before a sign-in link is requested, we use Cloudflare Turnstile to detect automated access. Your browser sends data such as your IP address and browser characteristics to Cloudflare. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).

Demo and preview

For the demo we process the stream address and the configuration you enter (for example station name, colour, logo). To make the preview possible in your browser, the request for your stream and its metadata may run through a proxy. For this purpose the addresses are kept in a cache at Cloudflare for up to 24 hours. Legal basis: Art. 6(1)(b) GDPR (carrying out the preview you asked for).

Activation, account and sign-in link by email

When you activate your station, we process your email address and send you a sign-in link. The link creates your account and signs you in; there is no password. Your station configuration is then assigned to your account. Legal basis: Art. 6(1)(b) GDPR (contractual relationship) and, for creating the demo session, your consent under point (a). We delete incomplete activations and the associated email addresses no later than 14 days after the demo expires.

Some email programs open links in advance as a security check. So that the link is not used up this way, you confirm the sign-in with a click on an intermediate page.

Sending email

We send sign-in links through Resend (Plus Five Five, Inc., USA, brand Resend). Sending runs through the Ireland (EU) region with the sender address login@mail.ondial.de. Tracking of opens and clicks is switched off. The provider logs each message (recipient address, subject, content of the message, time, delivery status), currently for about 30 days. These logs are stored in the USA. Legal basis: Art. 6(1)(b) GDPR.

Database, sign-in and file storage (Supabase)

We store your account, station configurations and uploaded logos at Supabase (database, sign-in, file storage) in the EU region (Ireland). Legal basis: Art. 6(1)(b) GDPR.

Cookies and local storage

We only set technically necessary cookies: a sign-in session after login, a cookie that links your running demo to your activation for up to seven days and, if you switch between light and dark design, a cookie ond_theme that remembers this choice for one year on this device. It applies to ondial.de and app.ondial.de together. If you choose the language of the interface (for example with the parameter lang in the address), the cookie ond_lang remembers this choice for one year on this device. It applies to app.ondial.de only. There are no advertising or tracking cookies, so no consent banner is needed (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). The demo stores your input temporarily in the sessionStorage of your browser so that it is not lost when you reload.

Usage measurement without cookies

We measure how the demo is used (for example page view, preview started, activation clicked) in order to improve the service. We set no cookies for this and store nothing in your browser. We recognise visitors only by an identifier that is newly formed every day from the IP address and browser details. We do not store the IP address itself, and the identifier cannot be followed across days. After activation we assign events to your demo session or your account. We delete the raw data after 90 days. Legal basis: Art. 6(1)(f) GDPR (improving the service). Access by automated programs is not counted. There is no usage measurement on ondial.de.

Error logs

In case of technical errors we write short logs without email addresses (type of error, time, affected function) to the server logs at Cloudflare so that we can find faults. Legal basis: Art. 6(1)(f) GDPR.

Website ondial.de

On ondial.de you find information about Ondial and articles on streaming technology. Apart from the design cookie ond_theme, the pages set no cookies and load no content from third-party providers. If you write to me, I process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). I delete them as soon as the enquiry is settled and no statutory retention obligations stand in the way.

Radio player (public station pages)

The player stores two settings locally in your browser (localStorage): the chosen music service (musicProvider) and the equaliser preset (eqPreset). They are not sent to us and serve only your convenience; you can delete them in your browser settings. Your browser loads the audio stream directly from the operator of the respective station, who can see your IP address when it does.

Content you publish

The station name, stream address, logo and colours of your published station page are publicly accessible. Please do not enter personal data of third parties there.

Recipients and third countries

Recipients of your data are my processors Cloudflare, Inc. (hosting, security check, email forwarding for the contact address), Supabase Pte. Ltd. (database, sign-in, file storage) and Plus Five Five, Inc. (Resend, sending email). Data processing agreements are in place with these providers. Where data is transferred to third countries (for example the USA), the agreements include the EU Standard Contractual Clauses. Cloudflare and Resend state that they are also certified under the EU-US Data Privacy Framework.

Retention

Demo data without activation: until 14 days after expiry. Account and station: until you have them deleted. Measurement data: 90 days. Sending logs at the email provider: about 30 days. Enquiries by email: until settled. Technical logs and counters: short-term.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a data protection supervisory authority. You can withdraw any consent at any time with effect for the future. To do so, write to kontakt@ondial.de. There is no automated decision-making.