Privacy notice
What Tuneping processes, for how long, with whose help, and what it never does. In short: the index is built from public station metadata, not from people; the only personal data we hold is what API customers and correspondents give us, plus short-lived technical logs.
Last updated: 29 October 2026
Who is responsible
Victor Antofica, Albisstrasse 29, 8800 Thalwil, Switzerland ("we", "us"), is responsible for the processing described here. Questions and requests: [email protected]. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, for people in the European Union and the United Kingdom, under the GDPR and UK GDPR.
What the index contains, and does not
Tuneping reads the public "now playing" text of internet radio stations and keeps, per station, the titles seen and when they were seen, together with the station's public directory listing (name, stream address, country, codec). This is information about radio programmes, not about people. The crawler never reads, stores or relays audio, never fetches pages that need credentials, and sends no cookies. It identifies itself as TunepingBot; everything it does, and how to opt out, is on tuneping.com/bot.
To be able to prove what our crawler did (for example when a hosting provider asks), we log each of our own outbound connections: time, the station server's IP address and port, and the result. These logs are kept for 7 days in detail and 30 days as hourly counts per server address. Station server addresses are normally not personal data; where a station is run by a private individual we treat them as such and apply the same retention.
Using the API
Anonymous use. The live endpoints can be called without a key, and the search box on our home page uses them. For each request we process your IP address, the request (for example your search words), the time, the response code and the request id. We use this to enforce the per-address rate limit, to keep the service up and to investigate abuse. Raw request logs with IP addresses are kept for 7 days; security logs (blocked addresses, repeated failures, suspected attacks) for 90 days. We do not build profiles of what anyone searches for.
API accounts. To issue an API key we store your e-mail address, the plan, the key's hash and a short recognisable prefix (never the key itself), the scopes and status of each key, and a daily count of requests per key. Usage counts are kept for the life of the account and, for paid plans, as long as invoicing law requires (10 years in Switzerland). We use your e-mail address to send the key, service notices (incidents, breaking changes, quota warnings) and invoices; never for third-party marketing. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the service secure (Art. 6(1)(f)).
Paid plans are handled by Stripe Payments Europe, Ltd., Dublin, Ireland, once they open. Stripe receives the data needed to charge you (name, e-mail, billing address, payment details, VAT id) under its own privacy policy; we never see full card numbers. We keep the invoice data Stripe gives us as long as bookkeeping law requires.
Partner apps. Apps such as Tapelark use Tuneping with a signed token instead of a key. The token carries a licence id, an installation hash, the plan and expiry dates, and nothing about the person: no name, e-mail or hardware id. We count requests per licence id for quota purposes (kept like other usage counts) and may block a licence id after a refund or abuse. We cannot connect a licence id to a person; the partner can, under its own privacy policy.
Wishlists, webhooks and exports (when these features ship) store what you ask them to: the artists, songs or search text you want to be told about, the station filter, and the delivery address (a URL for webhooks). Matches are kept for 30 days, webhook delivery logs for 30 days. A wishlist describes a musical interest; we use it only to deliver the matches you asked for.
This website
tuneping.com sets no cookies and loads no analytics, advertising or tracking scripts. The site is static and delivered by Cloudflare Pages; Cloudflare processes connection data (IP address, time, page requested, browser user agent) to deliver the site and protect it, under its own policy, and we use none of it to track you. The live search on the home page and the status page call api.tuneping.com from your browser; those requests fall under "Anonymous use" above.
Writing to us
When you e-mail hello@, bot@ or [email protected], Cloudflare Email Routing forwards the message to our mailbox. We keep correspondence as long as needed to deal with it and to document opt-outs and abuse reports; an opt-out of a station is kept permanently so that we do not poll it again, together with the e-mail that requested it.
Processors and locations
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH, Germany | Server for the API, the crawler and the database | Falkenstein, Germany |
| Cloudflare, Inc., USA | Website hosting (Pages), reverse proxy and tunnel for the API, DNS, e-mail routing | Global network; EU Data Processing Addendum in place |
| Stripe Payments Europe, Ltd., Ireland | Payments and invoices for paid plans (once they open) | EU; Stripe, Inc. (USA) under Stripe's standard contractual clauses |
| GitHub, Inc., USA | Source code, build and deployment of our software (no customer data) | USA |
Switzerland is recognised by the EU as providing adequate protection; transfers to the USA rely on the processors' standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. We sell nothing about you to anyone and share personal data only with the processors above, or when the law requires it.
Your rights
You can ask us what we hold about you, have it corrected or deleted, receive it in a portable form, object to processing based on legitimate interest, and withdraw consent where processing was based on it. Write to [email protected]; we answer within 30 days. Deleting an API account deletes the e-mail address and keys at once; usage counts and invoices stay as long as bookkeeping law requires. You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your member state.
We make no automated decisions with legal effect about you. Rate limits and quotas are applied mechanically to keys and addresses, not to people.
Changes
We will update this page when the service changes, and notify API customers by e-mail of changes that affect them. The date at the top says when it was last changed.