Privacy Policy

Website network check

For website security, Awaaz compares your connection IP address locally against a weekly downloaded public list of known VPN and proxy ranges. It does not send your IP to the list provider for this check. A matching web connection is asked to solve a first-party number and word CAPTCHA before entering; Android app traffic is exempt. The answer and your IP and browser user agent are kept in server memory for up to five minutes. Successful checks set a signed, HttpOnly, Secure cookie tied to your IP and browser user agent for four hours. Rate-limit counters are held in memory for about two minutes. The list can misclassify networks, and unknown addresses proceed normally. The range data comes from ipgeo Community Edition.

1. Who to contact

This service is operated under the name Awaaz at awaaz.isharankumar.com. For privacy questions, data requests, or complaints, contact hello@isharankumar.com. Please describe your request without sending passwords or unnecessary sensitive information.

2. What stays on your device

The website stores your selected language, mood, remembered station choices, favourite stations, up to 40 recent stations, data-saver and appearance preferences, and read release announcements in browser local storage. Favourite entries are separated by language and store station IDs and labels, not stream URLs or location. You can remove favourites and clear listening history in Your library. Android also keeps your server address, permission-prompt choices, update-check preferences and timestamps, and update-notification history in app preferences. The Android home-screen widget reads the current playback session and app appearance preference; its controls do not send a separate listening history to Awaaz. A sleep timer runs in session memory and is cancelled by a user pause or when playback ends. Downloaded updates are stored temporarily in the app’s private cache. Language, mood and appearance preferences do not require an account. Signing in is required to open Your library or save station favourites; those entries remain stored on this device.

Awaaz offers optional accounts and does not use advertising identifiers, analytics SDKs, or an app-operated advertising system. We do not sell your personal information or build a listening-history profile on our server. Independent radio stations may broadcast advertisements.

Optional accounts and security

Listening does not require registration. If you create an account, our private PostgreSQL database stores your display name, selected built-in avatar colour, email address, password hash, email-verification status, Terms acceptance version and account timestamps. Passwords are hashed; authenticator secrets and recovery codes are encrypted with a protected server key. Signed-in sessions use HttpOnly cookies and store expiry, connection IP address and browser/app user agent for session security and device controls.

You may explicitly save or restore your language, mood, theme and data-saver preferences. Location, local audio files, favourites and listening history are not uploaded by this feature. Account verification, password reset and security alerts are delivered through Brevo, our SMTP mail provider using mail@isharankumar.com. Required security emails cannot be disabled while keeping an account. Encrypted outgoing mail is deleted after successful delivery or by the maintenance task after expiry (one hour for verification, 15 minutes for reset, and 24 hours for security alerts). Maintenance normally runs every 30 seconds; service outages can delay cleanup. The mail provider may retain its own records.

A first-party image challenge protects registration, sign-in, password-reset and email-verification forms against basic automated abuse. It uses a random number and word, stores a protected answer digest and a keyed digest of the connection IP, and expires after three minutes. It does not contact a third-party CAPTCHA service. Challenge issuance rate-limit digests expire after one hour and are cleaned up as new challenges are requested. Account rate limits are stored temporarily and expired records are cleaned up by the account email maintenance task. Successful sign-ins record the connection IP address, time and browser/app user agent for up to 30 days. You can review your own recent sign-ins. Authorized administrators with verified accounts and 2FA can view registered users, join dates, email-verification and 2FA status, and recent login IPs to manage the service and investigate account security. Administrator access to these records is audited for up to 30 days. Failed passwords and authenticator codes are never stored in this login history. Deleting an account removes its login history and administrator role.

You can change your password, enable or disable authenticator-app 2FA, replace recovery codes, revoke other sessions, and permanently delete your account from the account screen. Deletion removes active account, session and cloud-preference records. Encrypted or access-restricted infrastructure backups are retained for around 14 days and purged by daily cleanup; deletion may take up to 15 days to disappear from backups. Sessions expire after seven days without a refresh, verification links after one hour, and password-reset links after 15 minutes. We use TLS, access controls and local database connections; no service can guarantee absolute security.

Local music and Android Auto

When you choose audio files, Awaaz plays them on your device. It does not upload the files, file names, or selected-track list to our server. The website and Android web player keep a temporary playback selection that clears when you close or reload the page.

On Android 1.0.9 or later, audio documents chosen through the system picker are also added to an Android Auto library on your phone. The app stores their document addresses and display names in its private preferences and keeps read access to those selected documents until you remove them in the Android Auto library or clear app data. A file opened through another app’s Open with menu is played using its temporary access grant; it is not added to the retained library unless you choose it again through the picker. Android does not request broad music-library or storage permission. Android Auto can browse the retained names and play those files through your phone.

3. Optional location

Location is used only after you select the location control and allow your browser or Android to share it. The interface rounds coordinates to two decimal places before sending them to the Awaaz server. The server sends rounded coordinates to OpenStreetMap Nominatim to find a city and region, then matches eligible stations. Awaaz’s location lookup cache lasts up to ten minutes in server memory.

The current city, region, and approximate coordinates stay in the open listening session and, during Android playback, the service’s memory. They are not saved in Awaaz’s preferences or an application database. Revoke location permission in your device/browser settings or select Clear location to continue listening by language. Technical error logs or third-party providers may retain request details as described below.

4. Requests needed to provide music

• Awaaz hosting: delivering pages, checking releases, and handling station, metadata, lyrics, credits, and location requests requires ordinary network information, such as your IP address, request path, time, and browser/app user agent.
• Radio Browser: our backend queries its directory using language and, where applicable, country or region, and retrieves station metadata. Stream availability checks originate from our server.
• Broadcasters: playback connects your device directly to the selected station’s streaming host. That host receives your IP address and connection information and controls its own logs, programming, and adverts.
• LRCLIB: our server uses the broadcast’s reported song title and artist to look up lyrics. Awaaz does not send an account identity or your location with a lyrics lookup.
• Wikidata: when you open Song cast, our server searches public records using the broadcast’s reported song title and artist. The request does not include your account identity or location; matching credits are cached in server memory.
• Wikimedia Commons: if a person’s public record has a photo, your browser or Android WebView requests that image directly from Wikimedia Commons. Wikimedia receives the ordinary network information needed to serve it, including your IP address. The profile links to the photo’s source and licence page.
• OpenStreetMap Nominatim: receives rounded coordinates from our backend if you use location.

These providers and hosting networks may operate outside your country and follow their own privacy practices. Review Radio Browser, LRCLIB, Wikidata, Wikimedia, and OpenStreetMap’s privacy policy, and the selected broadcaster’s information before using their services.

5. Updates and notifications

The web app fetches public release announcements for the header bell and remembers which release you read. Android checks the public update manifest on launch or when you request it. If you enable update notifications, Android can also check in the background and display an alert for a newer compatible APK. Background timing depends on connectivity and Android battery restrictions. Notification permission is optional, and no push token or account identifier is registered with Awaaz for these checks.

Administrator announcements are a separate optional feature. If you turn them on, Firebase Cloud Messaging (Google) creates a browser or Android app registration identifier and receives the network information needed to deliver messages. The web app sends its registration token to Awaaz only to subscribe or unsubscribe it from the Web announcement topic; the server does not keep a token list. Android subscribes to a separate topic through Firebase. Google may process notification delivery information under its own policies. Turning announcements off removes the topic subscription and deletes the local web or Android token. An administrator can send a title and message to one or both opted-in audiences. Awaaz stores the announcement text, platform choices, sending status and administrator ID for up to 90 days; the account maintenance task removes older records. Notification permission is optional, and turning it off does not affect listening or update checks.

Updates download only after you choose to download them. Awaaz checks file integrity and the app’s signing identity before asking Android to install. Android still asks for installation approval. You can disable update notifications in Awaaz or Android settings without losing access to music or manual update checks.

6. Station reports

If you choose to report a station, Awaaz receives the station ID, its directory name, selected language, issue category, your optional note, and the report time. Do not include personal or sensitive information in the note. Reports are saved privately for troubleshooting, are not published, and do not automatically remove a station. Reports older than 30 days are removed when the report store is next updated; low activity can delay that cleanup. The store holds at most 1,000 reports. A temporary salted digest of the connection IP is used in server memory for rate limiting for up to one hour and is not stored with the report. You can contact us about report data using the address above.

7. Retention, security, and support

Local preferences remain until you change them, clear site/app data, or uninstall. Release and stream-health caches are short-lived and stored in server memory. The production Awaaz HTTPS site disables routine Nginx access logging; infrastructure and error logs can still record technical request details and are used for troubleshooting and security. We do not promise that third-party providers have the same logging or retention settings.

If you email us, your address, message, and attachments may be retained to respond to the request, resolve a complaint, or meet applicable obligations. We use HTTPS for the app and eligible streams and limit update-file access, but no network service can guarantee absolute security.

8. Your choices and requests

You can listen without location, decline notifications, cancel an update download, clear local storage/app data, or stop using the service. Clearing data resets your preferences. Contact the address above to request access, correction, or deletion of information you have sent us, withdraw a consent, or raise a concern. We may need enough information to identify the relevant correspondence and cannot delete a broadcaster’s or another provider’s records on its behalf. Applicable legal rights remain available to you.

9. Children and policy changes

Awaaz is intended for adults and is not designed to collect children’s personal information. If you are under 18, do not send us personal information or use optional location features. A parent or guardian who believes a child has submitted personal information can contact us for assistance.

We may revise this policy when the service changes. The update date appears above. Permission-dependent features continue to require the relevant choice. See also our Terms & Conditions.