Privacy Policy

Using Podcst without an account

An account is optional on the web, iOS and Android. Almost every feature works without signing in on each platform: discovering, searching, following and listening to public podcasts, Starred episodes, your queue, playback settings, downloads in the apps and sharing. An account adds two things: synchronization of your follows, Starred episodes, listening progress and playback preferences across devices, and custom RSS feeds, including private feeds from podcast publishers.

Without an account, your library and listening state stay on your device or in your browser and are never sent to Podcst. Search, streaming and other network requests still involve the processing described below, but they are not linked to an account.

Information we handle

Data stored only on your device. Without an account, the follows, Starred episodes, queue, listening positions, preferences and downloads you create are kept only in your browser or app. When you sign in, the app keeps your guest library separate from account data, so signing out or deleting an account does not remove it.

Account and sign in. If you create an account, we store your email address, an account identifier, the creation date, your sign-in sessions and short-lived sign-in codes. Codes are stored only as hashes. If you add a passkey, we store its public key, credential identifier, the passkey provider reported by your device (for example iCloud Keychain or Google Password Manager), when it was added and when it was last used. Your biometric data and the passkey’s private key stay with your device or credential provider and are never sent to Podcst.

Synchronized library and listening state. If you sign in, we store the podcasts you follow, Starred episodes and other episode lists, listening positions, completion status and playback preferences (speed, volume boost and silence trimming). We also store timestamps, revision numbers and app-generated client identifiers so changes from your devices synchronize reliably.

Searches and feeds. We receive your search terms and selected chart or search region, including when you use Podcst without an account. Search terms are used to answer the request and are not saved to your account. Custom RSS feeds require an account. When you add a feed, we fetch it and store its URL, podcast and episode information for your account. Private feed URLs often contain a subscription access token issued by the publisher; we store these URLs so we can refresh the feed for you and never show them to other users.

Technical information. Our servers and hosting providers process IP addresses, requested URLs, device and browser information and timestamps to deliver the service and keep it secure. Hosting providers record this in short-lived request and error logs. To limit abuse of sign in and account deletion, we keep short-lived, hashed records of email and IP addresses.

Support. If you contact us, we receive your email address and whatever you include in your message.

What we don’t collect. Podcst contains no advertising, analytics or crash-reporting software, and we do not build usage profiles. We do not access your contacts, photos, location, microphone or advertising identifier. Audio processing such as volume boost and silence trimming runs on your device.

How we use information

We use information to search for, retrieve and play podcasts, show charts for your region, keep the service running and secure, prevent abuse and respond to your requests. If you create an account, we also use it to sign you in, send sign-in and account-deletion codes, refresh your custom feeds and synchronize your library. An email address is required for an account and not for using Podcst without one. We only email you about signing in and account deletion.

We do not sell personal information, and we do not use or share it for targeted or cross-context behavioral advertising. We do not track you across other companies’ apps or websites, and we do not use your information to train machine-learning models.

Services and other recipients

Hosting and infrastructure. Vercel and Fly.io serve the website and API. Our database and other servers run at Hetzner in Germany, and encrypted backups are stored with Amazon Web Services in Germany. These providers process information on our behalf to run Podcst.

Email. Resend delivers sign-in and account-deletion codes. It receives your email address and the message content.

Apple podcast search. For podcast searches, our server sends Apple’s iTunes Search API your search term and selected country or region. The request comes from our server, not your device, and does not include your IP address or any account information. Episode search and adding RSS links are handled by Podcst without Apple.

Podcast publishers and hosts. Audio and linked pages come from podcast publishers, hosting companies, content-delivery networks and the measurement or redirect services they choose. When your device fetches them, they receive your IP address, the requested URL and normal request information such as your device or browser type. Publishers may use this for their own analytics or advertising under their own privacy policies, and private feed or media URLs can identify your subscription to that publisher. Podcst fetches feeds, chapters and artwork on its servers, so publishers do not see your IP address for those requests.

Google Cast on Android. The Android app includes Google’s Cast SDK so you can play to Cast devices. Google states that the SDK collects anonymous interaction, device and app information to improve the service, that some collection happens automatically even when you are not casting, and that developers and users cannot opt out of or individually delete this data. Podcst does not receive it. When you cast, the selected receiver gets the episode and playback information. See Google’s Cast SDK data disclosure.

Passkeys and AirPlay. Passkeys are created and used through Apple, Google or the credential manager you choose, under that provider’s terms. AirPlay on iOS and the web connects your device directly to the receiver you select.

Web resources and sharing. The website loads fonts from Google Fonts and Google’s Cast script, so your browser connects to Google, which receives your IP address and browser information. When you share an episode or export your subscriptions, the information goes to the destination you choose. Exported subscription files can contain private feed links, so share them only with people you trust.

We may disclose information when the law requires it, or when it is necessary to protect Podcst, its users or others from fraud or abuse, with the safeguards the law requires. If Podcst is transferred to a new operator, your information would move with it under this policy, and we would tell you beforehand.

Storage and security

Podcst uses a sign-in cookie on the web and a session token stored in secure storage in the apps. It uses local storage for your preferences, library, listening state, caches and downloads. Guest data is kept separate from account data. You can remove local data through your browser or device settings, or by uninstalling the app. Removing it does not delete your Podcst account. Podcst does not use advertising or tracking cookies.

All connections to Podcst use HTTPS, and connections between our own systems are encrypted and authenticated. Backups are encrypted with keys only we hold, and access to production systems is limited to the operator. Account sync and private feeds are not end-to-end encrypted, because our servers need to read them to synchronize your library and refresh your feeds. Some publishers use unencrypted HTTP links that we cannot secure.

Vercel, Fly.io and Resend may process information in the United States. For transfers outside the European Economic Area, we rely on the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses included in each provider’s data processing terms. Contact privacy@podcst.app for details or a copy of the relevant safeguards.

How long we keep information

Account and synchronized data are kept for as long as your account exists. We do not delete inactive accounts automatically. Sign-in sessions expire after 30 days, and sign-in and deletion codes expire within minutes. Neither signing out nor uninstalling deletes your account.

Hosting providers keep request and error logs for short periods under their own retention settings. Support emails are kept for as long as needed to resolve your request.

Encrypted backups may contain account information and private feed addresses, and are kept for up to 12 months. Information deleted from the active service may remain in existing backups until they expire. We reapply recorded account deletions before any restored data is put back into use.

Delete your Podcst account

You can delete your account in account settings, or open Settings → Delete account in the iOS or Android app. You confirm with a code we email you, and you can cancel at any point before you confirm. Once confirmed, deletion cannot be undone and you are signed out on every device.

Deletion removes your account, email address, passkeys, sessions, follows, listening history, Starred episodes and lists, preferences and private feeds from the service. Public podcast listings remain available. Deleting your account does not cancel a publisher’s subscription or revoke a private feed token at the publisher. To do that, contact the publisher.

Deletion usually completes immediately. If it cannot be confirmed straight away, the request stays pending and completes automatically, and you can check its status in the app or on the website. Until deletion is confirmed, the app keeps your saved data.

After deletion is confirmed, the browser or device you used removes that account’s saved data, including downloads. Guest data and other accounts stay. Other devices are signed out but keep their saved copies until you remove them. Deletion cannot reach disconnected devices, system caches, publisher services or copies you exported.

Some cached information derived from private feeds, such as chapter titles and artwork, is no longer available to your account after deletion and expires over time, chapter data within 180 days.

We keep a minimal record of each deletion, an identifier and a timestamp with no email address, feeds or listening data, so that the deletion is reapplied if a backup is ever restored.

For help with account deletion, contact privacy@podcst.app.

Your rights and legal bases

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Providing the service you request (contract): search, playback, charts, accounts, sign in, synchronization, custom feeds and account deletion.
• Legitimate interests: keeping Podcst secure and available, preventing abuse, logs and backups, deletion records and supporting Google Cast on Android. Our interest is a reliable, secure service that respects deletions. You can object to this processing.
• Legal obligations: responding to lawful requests and keeping records the law requires.

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal data, to restrict processing, and to object to processing based on legitimate interests. You can export your subscriptions from your library at any time.

To exercise your rights, contact privacy@podcst.app. We respond within one month and may need to confirm that you control the account’s email address. You can also complain to a data protection authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens, and you can also contact the authority where you live.

Children’s privacy

Podcst is a general-audience service and is not directed at children under 13. Accounts are for people aged 13 or older, and in countries that set a higher age for consent, a parent or guardian must approve. Podcasts are made by independent publishers and some contain mature content. If you believe a child under 13 has created an account, contact privacy@podcst.app and we will delete it.

Changes to this policy

We will update this policy when our practices change, revise its effective date and give any notice the law requires. Contact privacy@podcst.app with questions.