Privacy Policy

This policy explains how Host-Caster ("we", "us") handles personal data in the hosted Host-Caster service: this website, the web app at https://app.host-caster.com and the phone apps when signed in to our service. If you run Host-Caster on your own server, that server is yours and this policy does not apply to it.

1. What we collect, and why

• Account: your name, email address and profile photo address, from the way you sign in (Google, X, Apple or a one-time email code). We use them to sign you in and to write to you about your account.
• What you set up: your hosts, stations, brains and voices, playlist names, what you wrote in About me (like what to call you, your town, life events, notes and reminders) and your settings. We store them so they sync to all your devices.
• Your own keys: API keys for AI and voice providers you connect, and a mailbox login if you add one. We store them encrypted and use them only to make the requests you set up.
• Plan and billing: your plan, its status and renewal date, and a customer reference from our payment provider. Card details go straight to the payment provider; we never see or store them.
• Usage of included AI: how much included AI and voice your account used this month, by type, so we can apply fair use and keep costs in check. Not what the hosts said.
• Sessions and logs: for each signed-in device, the browser or app name and when it was last used. Our servers log requests (time, address requested, IP address and result) to keep the service secure and fix problems. Logs never contain your keys, passwords or synced data.

We use this data to provide the service you asked for (our contract with you), to keep it secure and prevent abuse (our legitimate interest), and to meet legal duties such as tax records. We do not use it for advertising or profiling.

2. What stays on your device

Your songs and covers, your library and play counts, your on-air history, and the cached weather, calendar, email summaries and news your hosts use stay on your phone or in your browser. They are not uploaded to us. When your hosts need today's calendar or new mail, our server fetches it at that moment, passes it to your device and does not keep it.

3. AI and voices

To write a break, the brain you picked gets one request with your host's personality, what to call you and what you wrote about yourself, and the facts for that break, but only from the topics you switched on: the time, the songs around the break, the weather for your town, calendar items (title, time, place), email senders and subjects (never the text), news headlines, life events, notes and reminders. When you call in, your words are included too. The voice then gets the text of each line.

• Included Host-Caster AI and voices are provided through our AI routing provider (currently OpenRouter) and the model and voice companies it connects to. They process these requests only to produce the answer.
• Your own AI or voice gets the same request under your own account with that provider, and its own privacy terms apply.
• The scripted fallback (the short lines your hosts read until an AI is connected, or when it cannot be reached) and your device's own voices send nothing anywhere.

We do not keep the text of your breaks on our server, and we do not use your data to train AI models.

4. Services you connect

When you connect Google Calendar, Gmail or YouTube, we ask Google only for read access to what you switch on, and store the access tokens encrypted. Weather comes from Open-Meteo, using your town's coordinates. Spotify, YouTube and internet radio stations play in their own players and see what you play there. Each of these services has its own privacy policy. You can disconnect any of them in the app at any time.

5. Who else sees your data

We never sell or rent your personal data. We share it only with companies that help us run Host-Caster, under contracts that limit what they may do with it:

• our hosting provider, which runs our servers;
• Stripe, for payments and invoices;
• our AI routing provider and the AI and voice companies behind it, for included AI and voices;
• an email delivery service, for sign-in codes and account emails;
• Google, X and Apple, when you choose to sign in with them.

We may also disclose data when the law requires it, or to protect people from harm, and we will tell you when we are allowed to.

6. Cookies

This website uses no cookies at all, and no analytics or tracking scripts. It remembers your light or dark theme in your browser's local storage, which never leaves your device. The web app uses a cookie only to keep you signed in, which is strictly necessary, so there is no cookie banner.

7. How we protect it

Connections are encrypted with HTTPS. API keys, sign-in tokens and mailbox logins are encrypted at rest with AES-256-GCM, and each is tied to your account. Session tokens are stored only as hashes, so a copy of our database cannot be used to sign in as you. Every request is checked against the signed-in account, so no one can read another person's data.

8. How long we keep it

• Your account data: while you have an account. When you delete it, we delete it from our live systems right away and from backups within 30 days.
• Billing records: as long as tax law requires, usually several years.
• Server logs: a short time, normally no more than 30 days, unless we need them to look into abuse.
• Usage counts: for the current and previous billing periods.

9. Your choices and rights

• Get a copy: export a backup file from the app at any time, or ask us for everything we hold about you.
• Correct it: change your details in the app, or ask us.
• Delete it: delete your account in the app. This cancels any plan, removes your data from our server and revokes access you gave to Google and others.
• Object or restrict: you can object to how we use your data or ask us to limit it.

Depending on where you live (for example the EU, the UK or California), these are legal rights, and you can also complain to your data protection authority. We will answer any request within one month, and we will not treat you differently for using your rights.

10. Children, transfers and changes

Host-Caster is not meant for children under 16, and we do not knowingly collect their data. Our providers may process data in other countries; where the law requires, we use safeguards such as standard contractual clauses. If we change this policy in a way that matters, we tell you by email or in the app before it takes effect.

11. Contact

Host-Caster is responsible for your data in Host-Caster. Questions or requests: support@host-caster.com.