Privacy Policy

1. Information we collect

Depending on how you use PodEvents, we may collect the following categories of information:

• Account and profile data from Google when you sign in, such as your name, verified email address, profile avatar URL, and Google account identifier.
• Authentication credentials needed to keep your session working, including a PodEvents session token. Individual users do not provide Spotify access or refresh tokens.
• Podcast preferences you create in the product, such as shows you subscribe to monitor and related show metadata (name, description, image, Spotify URL, and latest episode tracking information).
• Notification settings you configure, such as Slack or Discord webhook URLs, Telegram chat IDs, channel labels, and whether a channel is active.
• Technical and operational data generated while providing the service, such as authentication state, API request activity needed to operate the product, and notification delivery logs used to operate and troubleshoot alerts.

We do not require you to provide information beyond what is needed to authenticate, connect services, and deliver the notifications you configure.

2. How we use information

We use the information described above to:

• Create and maintain your PodEvents account
• Authenticate you and keep your session secure
• Search Spotify's podcast catalog and monitor new episodes using the service operator's credential
• Send new-episode notifications to the channels you connect
• Operate, secure, debug, and improve the reliability of the service
• Respond to support requests and communicate about the service when needed

We do not sell your personal information.

3. Cookies and similar technologies

PodEvents uses a limited set of cookies and browser storage technologies that are necessary for authentication and routing:

• A session cookie (pod_events_token) that mirrors your signed-in state so protected routes can work correctly
• Browser localStorage for storing your PodEvents session token
• Short-lived OAuth state values used during Google sign-in and the operator-only Spotify setup flow to help prevent CSRF attacks

PodEvents uses Sabilytics for website usage analytics. Sabilytics may process technical and usage information when you visit the site. We do not use it for third-party advertising.

4. Authentication and connected third-party services

PodEvents relies on third-party services you choose to connect:

• Google — used for account sign-in and basic profile information via OAuth. Google may process your data under its own privacy policy.
• Spotify — used by the service operator to search the podcast catalog and retrieve show and episode metadata. Your personal Spotify account is not connected.
• Slack and Discord — when you add webhook destinations, we send episode notifications to those endpoints.
• Telegram — when you connect a Telegram chat, we use Telegram APIs/webhooks to deliver notifications.

Those providers process information under their own terms and privacy policies. PodEvents only uses the connections you configure to provide the features you request.

5. Music, podcast, and listening-related data

PodEvents is focused on podcast show monitoring and does not request your Spotify authorization, saved library, or playback history. The service processes:

• The podcasts you explicitly subscribe to in PodEvents
• Show and episode metadata needed to detect new releases and compose notifications

We store the podcast subscriptions and notification preferences you set up in PodEvents. We do not import a personal Spotify library or build advertising profiles.

6. Data sharing and service providers

We share information only as needed to operate PodEvents:

• With connected notification platforms you configure (for example, posting a new-episode alert to a Slack webhook)
• With Google as required to authenticate your account, and with Spotify to retrieve public podcast catalog data
• With infrastructure providers that host or process the application and database when you use a hosted deployment of PodEvents
• If required by law, legal process, or to protect the security and integrity of the service

Because PodEvents is open source, a self-hosted deployment is controlled by the operator of that instance. If you use a self-hosted copy, that operator's practices apply to the data processed there.

7. Data retention

We retain account, subscription, channel, token, and operational records for as long as needed to provide the service, maintain security, and meet legitimate operational needs. Exact retention periods are not fixed in the product code. If you delete or stop using connected channels, or if account-deletion tooling becomes available, related data will be removed or disabled according to that process. You can also revoke Google account access through Google's settings.

8. Data security

We design PodEvents with common production security practices, including:

• OAuth 2.0 for Google authentication
• Owner-only Spotify authorization with AES-256-GCM encryption for the stored service credential
• JWT-based session authentication for API access
• Secure cookie attributes for the session cookie where supported (for example, SameSite=Lax and Secure)

No method of transmission or storage is completely secure. We work to protect your information, but we cannot guarantee absolute security.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or restrict certain processing of your personal information, or to object to processing and request portability. You can also:

• Sign out of PodEvents to clear your local session token
• Remove notification channels you no longer want PodEvents to use
• Manage or revoke PodEvents' Google access from your Google account settings
• Contact us to request help with access, correction, or deletion of account data associated with the service we operate

We will respond to requests in accordance with applicable law. We may need to verify your identity before fulfilling certain requests.

10. Children's privacy

PodEvents is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us so we can take appropriate steps.

11. International data processing

PodEvents may be accessed from different countries. If you use a hosted deployment of the service, your information may be processed in locations other than where you live. Those locations may have data-protection laws that differ from the laws in your jurisdiction. By using the service, you understand that your information may be transferred and processed in this way as needed to provide PodEvents.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date on this page. If changes are material, we may also provide additional notice through the product or site. Continued use of PodEvents after an update means you acknowledge the revised policy.

13. Contact us

If you have questions about this Privacy Policy or about how PodEvents handles personal information, contact us at:

devrapture@proton.me

← Back to home