Privacy policy

Last updated 15 October 2026

Who we are

Email: contact@abyssfm.online, for privacy questions and anything else.

AbyssFM is run by Peter Stevens, who decides how your personal data is used (the controller).

Postal address: 15 High Barns, Ely, Cambs, UK, CB7 4RQ.

What we collect, and why

Your account. Your email address, when you signed up, whether you have set up two-step sign-in, your roles (listener, creator, admin), and the date you confirmed you are 16 or over. Your password is held by our sign-in provider, and we never see it. We use these to sign you in and to run the service for you.

Credits. Your credits for the current month, the heat points your likes have earned, and how many minutes of music you have released this month and in total. We use them to let you release tracks.

Tracks you upload. The audio file and cover you send, the title and genre you give, and when you uploaded. The file you send is deleted once we have converted it to the format the radio plays. An admin checks each track before it goes on air. Once a track is on air, anyone can hear it and see its title, cover and creator name.

The rights you claim for each upload. Which AI service and plan you made the track with, whether you hold the rights to distribute it, the terms you accepted and when, the IP address you uploaded from, and the source link if you gave one. We keep this as our record of what the uploader told us, in case someone claims rights in a track that was on air.

Your creator profile. The name you choose, your picture, a few lines about you (your bio), and your handles on Instagram, X and Facebook. An admin checks each before it is shown. Once approved they are public, on your creator page; your name is also shown with your tracks, and your name and picture in the list of creators each listener follows. We store your picture as a new image we make from it, which leaves out hidden details a photo can carry, such as where it was taken. Until you choose a name, your tracks show a placeholder made from your account's ID.

Likes and follows. Which tracks you liked, and which creators you follow. Only you see them. Likes help decide how often a track plays and earn its creator heat points. Creator pages show how many followers a creator has and how many listeners like each of their tracks, but not who they are. When you take back a like or unfollow, we keep the record for 15 days and then delete it.

Listens. When you play a track, the player tells us, and we add one to that track's count. The count does not record who listened.

Time listened. While the player plays, it tells us every ten minutes or so how long it has been playing, and we count how much of each day you listened, so that listening earns heat points. We keep only that day's total and the time we last counted, not what you heard or on which channel. It is deleted a few days after the day ends.

Reports. The track you reported, the reason you chose, and your note. Admins read reports to decide what to do about a track, without seeing who sent them. We tell you what was decided. The creator is never told who reported their track.

Feedback. What you write to us. Admins read it without seeing who sent it. It is deleted when an admin marks it done, or after 90 days.

Notices about content. If you send a notice from Report content, with or without an account: your name and email address, where the content is, the reason you chose and your explanation. Admins read all of it, including who sent it, to judge the notice and to email you what they decided. If you claim the rights in a track and we take it down, we show its creator your name and your explanation, never your email address, so that they can answer; if they contest the takedown, an admin emails you their answer and their creator name. A notice is not linked to your account, even if you have one, so erasing your account does not delete it. To have one deleted sooner, contact us with its reference.

Contesting a takedown. If you contest a takedown of one of your tracks: what you write, when, and whether the takedown answered someone's rights claim. Admins read it to decide. If it answered a rights claim, an admin emails what you wrote and your creator name to whoever made the claim, which you agree to when you send it.

Service logs. What the service did and any errors, naming accounts by their ID, never by email. We use them to keep the service running and secure.

Where you are. AbyssFM is only available in the UK. Each time you use it, our hosting provider tells us which country your IP address is in, and if it is not the UK we let you do no more than download or erase your account. We do not store the country.

Sign-in emails. Our sign-in provider emails you a code when you sign up and when you reset your password.

We use no analytics or advertising, do not track you on other sites, and do not sell your data. We take no payments at present.

Legal basis

• To provide the service you signed up for (GDPR Art. 6(1)(b)): your account, credits, tracks, creator name, picture, bio and links, likes, follows, listens, time listened and sign-in emails.
• Our legitimate interests (Art. 6(1)(f)): the rights you claim for each upload, to handle and defend rights claims; reports and notices about content, to keep unlawful content off the radio; showing a rights claimant's name and explanation to the creator, and a creator's answer to the claimant, so that each can answer the other; feedback, to improve the service; service logs, to keep the service running and secure; the country you are in, to offer the service only where we meet the law that applies to it.

You can object to processing based on our legitimate interests (see Your rights).

Who can see what

• Everyone: tracks on air, with their title, cover and genre; your creator name, picture, bio, links and page; how many followers you have.
• Admins: tracks, covers, names, pictures, bios and links waiting for review; reports and feedback, without who sent them; notices about content, with the name and email of who sent them; contests of takedowns.
• The creator of a track taken down on your rights claim: your name and your explanation.
• Whoever made the rights claim a takedown of your track answered, if you contest it: what you wrote, and your creator name.
• Only you: your email, likes, follows, credits and reports.

Who processes it for us

Amazon Web Services (AWS) hosts the service, stores its data, runs sign-in and sends sign-in emails, under its data processing terms. Everything is stored in AWS's Frankfurt region. The site and its audio are delivered through AWS's worldwide network, so your requests may be handled at a location near you, including outside the EU. Settings for our web firewall and certificate are kept in AWS's US East region; they hold no personal data.

Zoho hosts our mailbox, contact@abyssfm.online, under its data processing terms. It processes what you send to that address and our replies, including our replies to notices about content. The mailbox is stored in Zoho's EU data centres.

How long we keep it

• Your account and what it holds: until your account is erased, except as below.
• A like you take back, or a creator you unfollow: 15 days.
• Your total time listened for a day: a few days after that day ends.
• Feedback: until an admin marks it done, and at most 90 days.
• A notice about content: until six months after we decide on it.
• A contest of a takedown: until six months after we decide on it.
• The audio file you upload: until it is converted.
• Service logs: 14 days.
• What we keep after your account is erased is listed in that section.

Your rights

You can:

• get a copy of your data, in a format other services can read: Account, Your data, Download;
• correct it: change your creator name, picture, bio and links under Account, and ask us to correct anything else;
• have your account erased: see below;
• ask us to restrict how we use your data, or object to uses based on our legitimate interests;
• complain to a data protection authority, in particular where you live or work.

To use a right we have not built a page for, contact us at the address under Who we are. We answer within a month.

No decision with legal or similarly significant effects on you is made by automated means alone.

Erasing your account

You can ask for your account to be erased under Account, Your data. It is erased seven days later. Until then everything works as before, and you can keep your account from any page. Every page shows the date it is due, so that you see it on your next visit even if someone else asked.

After the seven days you are signed out for good, and your tracks come off air. Within about three weeks of your asking, we delete your account and email, your tracks with their audio and covers, your name, picture, bio and links, and your likes, follows, reports, contests, feedback and credits. The rest of this section lists what we keep.

What we keep after your account is erased

The rights you claimed for each upload: for three years. For each track, we keep:

• which AI service and plan you said you made it with;
• whether you said you hold the rights to distribute it;
• the terms you accepted, and when;
• the IP address you uploaded it from;
• the source link, if you gave one.

We keep this because a rights holder may claim against a track that was on air, and it is our record of what the uploader told us (GDPR Art. 17(3)(e)). It is deleted automatically three years after your account is erased. It is filed under your account's ID, a random identifier, not under your email or name. The ID is also what your tracks' placeholder name was made from, if you had not chosen one.

A record that your account was erased: for 35 days after the erasure is finished. It holds your account's ID, when you asked, when it was due, how far the erasure got, and which of our emails went out. It holds no email address. If we ever have to restore our database from a backup, which can reach back 35 days, we use these records to erase your account again.

Our service logs: for 14 days. They record what the service did and any errors, naming accounts by their ID, never by email. They are deleted 14 days after they are written. We keep no access logs of your visits.

Counts that do not identify you. Likes, listens and reports add to counts on each track: how many likes, how many reports, a score. Those counts stay, but nothing in them says who contributed.

What other people hold. Other listeners' likes and reports about your tracks belong to their accounts, and name the track, not you. They stay with those accounts.

Emails we sent you. Copies stay in your own mailbox.

Cookies

We set only the cookies the service needs to work. We use no analytics or advertising cookies, so we do not ask for consent.

• __Host-aim_refresh keeps you signed in, for up to 30 days.
• __Host-aim_authtx holds a sign-in that is in progress, for 10 minutes.
• __Host-aim_mfasetup holds the setup of two-step sign-in while you do it, for up to 10 minutes.
• CloudFront-Policy, CloudFront-Signature and CloudFront-Key-Pair-Id let your player fetch the radio's audio, for 6 hours.
• The sign-in pages, run by our sign-in provider, set their own cookies for the sign-in, for about an hour.

Some actions need you to sign in again first: downloading your data, asking for erasure, and for admins, taking a track off air. While you do, the page keeps which action you started in your browser's session storage, for up to 15 minutes. It is gone when you close the tab.

The Android app

The app is for listening. It collects what the website collects when you listen, as this policy describes, and nothing more. It sends no tracks, covers, names, pictures, bios or links, because you cannot upload or change those in the app. It contains no analytics, advertising or crash-reporting code.

What the app keeps on your phone:

• What keeps you signed in, for up to 30 days. It is encrypted with a key that Android keeps locked inside the phone, which not even the app can copy out.
• A sign-in in progress, while you sign in in your browser. It is deleted when you come back to the app.
• What lets the player fetch the radio's audio. It is kept in memory only, and is gone when the app closes.
• Covers of tracks and pictures of creators it has shown you. Android clears them when it needs the space.

None of this goes into your phone's backups or moves to a new phone, so on a new or restored phone you sign in again. Signing out deletes what keeps you signed in, and uninstalling the app deletes everything it keeps.

Signing in happens on our sign-in pages, which open in your phone's browser and set their own cookies there, as they do on the website.

Your data and erasure. Download my data and Delete my account in the app open this website, at Account, Your data.

Google Play. We distribute the app through Google Play. Google handles installing and updating it under its own privacy policy, not on our behalf. If you allow your phone to share usage and diagnostics data, Google shows us crash reports and performance figures for the app. These describe the phone model and Android version, not who you are.

Age

AbyssFM is for people aged 16 and over. The first time you sign in, we ask you to confirm that you are. We keep the date you confirmed it, and nothing else about your age. If you tell us you are under 16, we do not keep that answer, and you cannot use the service. You can still download your account's data or have the account erased.

Changes to this policy

When we change this policy, we publish the new version here and change the date at the top.