Privacy Policy

Who is responsible

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Email: nico.peitz22@gmail.com

Neon Palms Radio is a private, non-commercial fan project. You can use the whole site without creating an account or giving us any information. Without your consent you can use everything except the music player itself.

Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Whenever your browser requests a page or file from us, the server automatically records technical information in so-called log files:

• your IP address,
• the date and time of the request,
• the requested address (URL),
• your browser and operating system (user agent),
• the page you came from (referrer), if your browser sends it.

We need this data to deliver the website to you, to keep it secure and stable, and to detect and fix errors and misuse. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in a secure, working website. The recipient of this data is our hosting provider, which runs the servers for us on our behalf under a data processing agreement (Art. 28 GDPR). The log entries we can access are kept for one hour and then deleted; Vercel Inc. itself keeps such technical data only as long as it needs it to run and secure its service. We do not combine this data with other data and do not use it to identify you.

For the same purpose, Vercel Inc.'s firewall briefly uses your IP address to fend off attacks and to limit how often a single connection can report to the listener count (rate limiting). Nothing is stored for this beyond short-lived counters at the firewall.

Our server functions (such as the station clock and the listener count below) run in Vercel’s Frankfurt region in Germany. Pages and files are delivered through Vercel’s global network from the location nearest to you. Because Vercel Inc. is based in the USA, personal data may be transferred there. Vercel is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR); in addition, the data processing agreement includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: Vercel’s privacy policy.

The station clock

Neon Palms Radio works like real radio: everyone tuned to the same station hears the same song at the same moment. To make that possible, your browser asks our own server for the current time (the /api/time endpoint) when you open the radio and may repeat this to keep the clock in sync. The answer contains nothing but the server time and a short version tag of the stations’ playlists, so a page opened before a playlist update knows it is out of date.

These requests only synchronise playback. Nothing is stored about them beyond the normal server log entries described above, and no third party is involved. The “now playing” information you see for each station is calculated from our own schedule, so it works without YouTube.

If the playlists change while the radio is open, the page may reload itself to pick up the new programme. So that this happens only once, it notes the new version tag in your browser’s session storage. The entry contains no personal data, is not sent to us and is deleted when you close the tab. Storing it is strictly necessary for the radio to work (§ 25(2) no. 2 TDDDG).

The listener count

The radio shows how many people are tuned in right now, in total and for each station. To count listeners without recognising anyone, the radio sends our own server a short request (to the /api/presence endpoint) about every 30 seconds while it is open in a browser tab you can see. The request contains nothing but the id of the station you have selected, for example {"station":"rearview"}. It carries no identifier and no cookie, nothing is read from your browser’s storage for it, and nothing is stored there. A hidden tab sends no requests and drops out of the count within a minute.

For each request, our server adds 1 to a counter for that station and the current 30-second window, and answers with the counts of the previous window — the numbers you see on the page. A counter is only a number per station and time window: it does not record who was counted and cannot tell one listener’s requests from another’s. Each counter is deleted automatically two minutes after it was last increased.

The counters are stored in a database that Upstash, Inc., 6202 Vía De Adrianna, San Jose, CA 95120, USA, runs for us in its Frankfurt region (AWS eu-central-1) in Germany, as our processor under its data processing addendum (Art. 28 GDPR). Only our server connects to this database. Your browser never contacts Upstash, so Upstash does not receive your IP address or any other information about you.

The only personal data involved is what every request to our website carries — such as your IP address and browser — which our hosting provider records in its log files as described under Hosting and server log files. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show a live listener count, so that the radio feels like the shared broadcast it is.

We do not ask for your consent under § 25 TDDDG for the listener count: nothing is stored on your device for it, and no information already stored there, such as cookies or browser storage, is read. The request only contains the station you picked on the page and reaches our server like any other request the page makes. Even if sending it were regarded as access to your device, it would be strictly necessary to provide the listener count, which is part of the radio you opened (§ 25(2) no. 2 TDDDG).

The counters stay in Upstash’s Frankfurt region. Upstash, Inc. itself is based in the USA. It is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR); in addition, its data processing addendum includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: Upstash’s privacy policy.

The station in the page address

When you switch stations, the page address shows the one you picked — for example /rearview — so you can bookmark it or share a link that opens the same station. That is its only purpose. We do not save your choice — nothing is stored in your browser for it, and nothing on our server beyond the normal log entries.

Like any page address, it can appear in the server log entries described above — as the requested address when you open such a link, or as the referrer of requests the page makes afterwards, such as to the station clock or for the listener count. If you have allowed the YouTube player, the page address Google receives (see below) can include the station as well.

Remembering your choice

When you decide about the YouTube player, we save that decision in your browser’s local storage under the key neonpalms.consent.v1. It contains only your decision (allowed or not allowed) and the time you made it. It stays on your device and is not sent to us. It is not a cookie, and apart from the version tag described under the station clock we do not store anything else in your browser.

Saving it is strictly necessary to respect your choice — otherwise we would have to ask you again on every visit, or could not stop YouTube from loading once you said no. The legal basis is § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) for storing it on your device and Art. 6(1)(f) GDPR for processing it — our legitimate interest in respecting your choice.

The entry is deleted when you withdraw your decision via “Privacy settings” at the bottom of every page, or when you clear the site data in your browser.

The YouTube player

The music on Neon Palms Radio plays through YouTube’s embedded video player, using only the official videos published by the artists and their labels. The player is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

This website uses YouTube API Services (the YouTube IFrame Player API). By using the player you agree to the YouTube Terms of Service.

Only after you agree

Until you click “Accept & tune in”, this website makes no connection to YouTube or any other Google service — no player, no scripts, no preview images. Once you agree, your browser loads YouTube’s IFrame Player API script from www.youtube.com (which loads a further script from www.youtube.com) and the player itself from YouTube’s privacy-enhanced mode at youtube-nocookie.com.

Privacy-enhanced mode applies to the player only, and it reduces but does not prevent the data YouTube collects. The script requests to www.youtube.com can set and read YouTube cookies if your browser allows third-party cookies — for example VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA and __Secure-YNID (kept for about six months) and YSC (until you close the browser) — and they carry the YouTube and Google cookies already in your browser, including sign-in cookies if you are logged in.

What happens when the player loads

• Your browser connects directly to Google’s servers.
• Google receives your IP address, information about your device and browser (for example browser type, operating system, language and screen size), the address of this page, and information about the playback.
• YouTube may store cookies or similar data (such as local storage) in your browser — even in privacy-enhanced mode.
• If you are logged in to a Google account, YouTube may link this data to your account. If you don’t want that, log out of your Google account before tuning in.
• YouTube may show advertisements and other content in the player; these are served by YouTube/Google, not by us.

We have no influence on how Google processes this data. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Transfer to the USA

Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. You can find more information in Google’s privacy policy: https://policies.google.com/privacy.

Withdrawing your consent

You can withdraw your consent at any time via “Privacy settings” at the bottom of every page. The player is switched off immediately and YouTube won’t be loaded again unless you agree again. Withdrawal is effective for the future; it does not affect the lawfulness of processing before the withdrawal (Art. 7(3) GDPR).

Withdrawing does not delete cookies or other data YouTube has already stored in your browser for youtube.com and youtube-nocookie.com (some are kept for about six months). You can delete them in your browser settings.

Links to YouTube

The Rotation page lists every song on every station with a plain “Watch on YouTube” link. Nothing is loaded from YouTube on that page. Only if you click a link does your browser open YouTube’s website — from then on, Google’s privacy policy applies.

Fonts

All fonts on this website are served from our own server. Your browser does not connect to Google Fonts or any other font service.

Your rights

Regarding your personal data, you have the right to:

• access the data we process about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• withdraw any consent you gave, with effect for the future (Art. 7(3) GDPR).

To exercise your rights, simply send an email to nico.peitz22@gmail.com. Because we don’t run accounts or tracking, we usually cannot link log entries to a specific person without further information from you.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live, where you work, or where you believe the infringement took place.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR (server log files, the listener count, your stored choice), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). Just email nico.peitz22@gmail.com.