Privacy Policy | huisheng.fm

1. Information we collect

We only collect what we need to run the Service:

Account information: The email address and password you register with. Passwords are stored only as salted hashes; we cannot and do not read your plain-text password. We also record whether your email is verified and which version of this policy and the Terms of Use you accepted, and when.
Google sign-in: If you sign in with Google, we receive your Google account identifier, email address, and its verification status. We never receive your Google password and do not access your contacts, files, or other Google data.
Content you submit: Podcast Feed details (title, description, author, owner name and email, category, artwork), episode details (title, summary, show notes, audio URL, duration, artwork), episode scripts, and podcast platform links that you create through the dashboard, API, MCP, or an AI agent.
API tokens: The user-scoped API token you generate in the dashboard. We store a hash to verify it and an encrypted copy so you can reveal it again in the dashboard.
Technical and log data: IP address, browser type, request time, requested path, and error logs, recorded automatically by us and our hosting providers for security and troubleshooting.

2. How we use information

To create and manage your account and authenticate you;
To store your feeds and episodes and generate and host standard Podcast RSS feeds;
To send transactional emails such as email verification and password resets;
To detect and prevent abuse, fraud, security attacks, and violations of the Terms of Use;
To troubleshoot, maintain, and improve the Service;
To comply with legal obligations.

We do not sell your personal information, use it for targeted advertising, or send you marketing email without your consent.

3. Public content

Podcast feeds are public by design. Please note:

Your RSS feed, including feed details, episode details, show notes, artwork, and audio URLs, can be read by anyone or any program that has the feed URL;
The owner name and email you enter for a feed are written into the RSS feed (itunes:owner) as the podcast industry expects, so they are publicly visible. Use a dedicated podcast address if you do not want to expose a personal email;
Once you submit a feed to Apple Podcasts, Spotify, Podcast Index, or other platforms, they fetch and cache your content. We cannot control copies held by third parties, even after you delete content here;
Episode scripts are never written into the RSS feed. Only you can see them in the dashboard or read them with your API token.

4. Cookies

We only use cookies that are necessary for the Service to work. We do not use advertising or third-party analytics cookies:

Sign-in session: Keeps you signed in for up to 14 days; cleared when you sign out.
Google sign-in state: Protects the Google sign-in flow against cross-site request forgery; expires after 10 minutes.
Interface language: Remembers whether you chose the English or Chinese interface; kept for 1 year.

You can clear or block cookies in your browser, but you may then be unable to sign in.

5. Service providers and sharing

We use the following providers to run the Service. Each receives only the information needed for its function and is required to protect it under its agreements and applicable law:

Vercel: Website and application hosting; processes requests and runtime logs.
Supabase: Database hosting for account, feed, and episode data.
Microsoft Azure: Object storage for audio, images, and RSS files.
Google: Identity verification, only if you choose Google sign-in.
Email delivery provider: Delivers verification and password reset emails.
OP3: Only when you enable download analytics for a feed. Listener requests for audio then pass through op3.dev, which processes listener IP addresses, user agents, and similar data under its own privacy policy to produce statistics.

Beyond the above, we only share your information with your explicit consent, when required by law or a valid request from a court or government authority, or when necessary to protect the safety and property of the Service, our users, or the public.

These providers may operate servers outside the country or region where you live, so your information may be stored and processed abroad. We take reasonable steps to ensure it remains protected as described in this policy.

6. Retention

Account information is kept for as long as your account exists;
Email verification links expire after 24 hours and password reset links after 1 hour;
When you delete a feed or episode in the dashboard, its database records are deleted. Audio, image, and RSS files already published to object storage are not deleted automatically; contact us to have them removed;
After you ask us to delete your account, we delete or anonymize your personal information within a reasonable period unless the law requires us to keep it. Backups are purged at the end of their retention cycle.

7. Security

We protect your information with HTTPS everywhere, salted password hashing, hashed and encrypted API token storage, signed sessions, and access controls. No system on the internet is perfectly secure, however. If a security incident affects your personal information, we will notify you as required by law and take remedial steps.

Keep your password and API token safe. If you suspect a token has leaked, rotate it in the dashboard right away.

8. Your rights

Access and correction: View and edit your feeds and episodes in the dashboard.
Deletion: Delete feeds and episodes in the dashboard, or contact us to remove published files.
Account deletion: Email us to close your account; we will stop providing the Service and delete your information as described in this policy.
Copy of your data: Contact us to receive a copy of your personal information.
Withdrawing consent: Close your account to withdraw your consent. Withdrawal does not affect processing that already took place.

To exercise any of these rights, email contact@huisheng.fm. We will reply within 15 business days after verifying your identity.

9. Children

The Service is not directed to children under 14. If you are under 18, please read this policy and use the Service with the consent and supervision of a parent or guardian. If we learn that we collected a child's personal information without guardian consent, we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time and will change the effective date on this page. For material changes we will notify you by email or an in-product notice. Continuing to use the Service after a change takes effect means you accept the updated policy.

11. Contact us

If you have questions, comments, or complaints about this policy or how we handle personal information, email contact@huisheng.fm.