Privacy Policy

1. What We Collect

When you create an account we collect your email address, display name, and a bcrypt-hashed version of your password. We never store your password in plain text.

We also store the last station you listened to so we can resume it on your next visit.

2. Cookies & Sessions

After you sign in, we set a single encrypted session cookie (stationaire_session) that keeps you logged in for 30 days. It contains only your user ID and role — no personal information.

We do not use tracking or advertising cookies beyond the session cookie and Google AdSense (see Section 4).

3. How We Use Your Data

• To authenticate you when you sign in.
• To save your station preferences.
• To send password reset emails when you request one (via Resend).

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Advertising

We use Google AdSense to display advertisements. Google may use cookies to serve ads based on your prior visits to this or other websites. You can opt out of personalised advertising by visiting Google Ads Settings.

5. Data Retention

Your account data is retained for as long as your account is active. If you would like your account and data deleted, please contact us and we will remove it within 30 days.

6. Security

All data is stored in an encrypted PostgreSQL database. Passwords are hashed with bcrypt (12 rounds). Sessions are sealed with an AES-256 key. We use HTTPS exclusively in production.

7. Your Rights

You have the right to access, correct, or delete your personal data at any time. To exercise these rights, contact us.

8. Jurisdiction

Stationaire operates under the laws of Canada. By using this service you consent to the collection and use of your information as described in this policy.

9. Changes to This Policy

We may update this policy from time to time. We will post the revised policy on this page with an updated date. Continued use of the service after changes constitutes your acceptance.