Privacy Policy

Information we handle

Account and security information

You can create a free account with an email address and password. We generate a display name from your email prefix and a unique username so you do not have to enter them. For an account, we store your display name, username, email address, account identifier and role. We store a password hash rather than your readable password. We use sign-in cookies, hashed session and device credentials, and security records to authenticate you, maintain your session, protect accounts, and limit repeated account-creation, failed sign-in or device-pairing attempts. Security records can include a hash derived from the requesting IP address and account identifier.

Music preferences and connected players

When you save playlists or playback schedules to your account, we store their names, songs, selected music districts, filters, excluded genres, and update times. When the player loads after sign-in, it automatically registers a random player identifier, a default or chosen device name, and a hash of the device credential with your account. This registration occurs even if you do not enable remote control. If you use remote control, we also store pairing relationships, last connection times, current playback status, and temporary commands so your devices can control the same player. These player records and account playlists are associated with your account.

Information kept on your device

Browser or app storage remembers preferences, age confirmation, YouTube consent, local favorites or saved shows, player credentials, cached catalog information, and a limited local playback-event log. Audio files imported into the player are stored locally for playback. Administrator folder access uses device-local browser permissions and remembered folder handles. These local records are not automatically uploaded as listener analytics. Player registration, account-saved playlists, and remote-player status, described above, do use our servers.

Optional location and calendar features

If you choose to find your music district using location, your device processes its coordinates to match a district. Android requests approximate location; on iPhone, iPad, or the web, the precision available depends on your system or browser settings. Piplo uses location while you use this feature, does not track it in the background, and does not upload your raw coordinates to our service. A district derived from location may be sent when loading its music, saving an account playlist, or reporting remote playback status. You can choose a district manually and deny location permission.

The public venue map opens on a selected state or an approximate state derived from your IP address, without requesting device location permission. An explicitly selected starting state does not require an IP lookup. We use hosting-provided state information when available; otherwise, we send the requesting IP address to GeoJS to identify its approximate country and state. Piplo uses a fixed state center and does not save this lookup's IP address or precise coordinates. If the lookup is unavailable, the map opens on its North Carolina home view; you can pan and zoom to other areas. Loading Google Maps also sends Google network and device information under Google's Privacy Policy.

The iPhone and iPad app can offer a system calendar editor for a selected show. You decide whether to save the event. Piplo does not read or upload your existing calendar. The current native apps do not request camera, microphone, contact-list, or photo-library access. Android can open a system file chooser when you explicitly select a file.

Administrator studio and support

Authorized administrators can submit workbooks, intro scripts, voice identifiers and synthesis settings, and create or publish intro audio. We store the submitted studio materials, generated recordings, and catalog metadata needed to operate the shared music service. If an administrator chooses ElevenLabs generation or voice retrieval, our service sends the selected script, voice identifier, synthesis settings, and the administrator's provider credential to ElevenLabs. An optionally saved provider credential is encrypted. We do not send listener account profiles or listening histories to ElevenLabs for these actions.

If you contact us, we handle the information you include to respond to your request. Please send only what is needed and do not email passwords or API keys.

How we use and disclose information

We use this information to provide accounts, music selection, saved playlists, remote controls, optional studio functions, security, and support. Level Eleven Solutions LLC does not sell listener account information or provide listener account profiles to data brokers.

Our hosting and storage providers process information needed to deliver the service. Piplo is hosted using ChatGPT Sites infrastructure, with Cloudflare D1 database and R2 object storage. Requests may expose technical information such as IP address, browser or app details, requested URLs, timestamps, and errors to infrastructure providers. Their handling of infrastructure records and recovery copies follows the applicable provider policies and service arrangements.

We may disclose information when necessary to comply with a legal obligation, respond to valid legal process, protect rights or service security, or carry out a business transfer subject to appropriate protections.

YouTube playback and other external services

Piplo uses YouTube API Services and an embedded YouTube player. YouTube playback loads after you accept the YouTube notice. We use the privacy-enhanced embed domain, youtube-nocookie.com. Google states that views through this mode do not personalize subsequent YouTube browsing or advertising elsewhere, and any ads served within the enhanced player are non-personalized.

This mode does not mean that Google receives no data or that the player uses no storage. Loading and playing videos can send Google network and device information, the referring site or app, video identifiers, viewing activity, and interactions. Google or the player may use cookies or similar device storage for playback, security, and advertising. Google's processing is governed by its own policy. Piplo does not collect your Google password or require access to your Google account.

Use of YouTube services is subject to the YouTube Terms of Service and Google Privacy Policy. See YouTube's privacy-enhanced embed explanation and your Google privacy controls. Links to ticket sellers, venues, YouTube, or other external sites follow those services' policies when you open them.

We preserve YouTube's content and age restrictions. An 18+ Piplo confirmation does not unlock an age-restricted YouTube video or guarantee that every available music video is suitable for a particular listener.

Security and how long information remains

Piplo service connections use HTTPS. Account passwords are hashed, saved provider keys are encrypted, and account access controls restrict private playlists and paired-player controls. No system can guarantee absolute security.

• Account profiles, account-saved playlists and schedules, device registrations, and saved private studio credentials remain while the account or feature is active, until you remove them or delete the account.
• Sign-in sessions expire after 30 days and may renew during continued authenticated use. Setup links have their stated expiry. Device-pairing codes expire after ten minutes and are single-use.
• Remote commands expire for execution after 15 seconds. Their stored payloads become eligible for removal after one hour. An offline player's stored playback status becomes eligible for clearing after 24 hours.
• Account-creation, failed sign-in or pairing records become eligible for removal 24 hours after the last failure once any temporary lockout has ended. Expired sessions, setup links, pairing codes and eligible temporary records are cleared in limited cleanup batches when the service receives requests. Removal can take additional requests, or wait until activity resumes.
• Independently licensed, nonpersonal business catalog materials and published intro recordings can remain for the music service independently of an administrator's account. Account-associated personal contributions are covered by the removal process below.
• A contributor's account deletion opens a personal-content removal case automatically. We retain the account identifier, name, email address, and optional description of contributed material only to identify and complete that removal. We normally complete review and removal within 30 days. Pending case information remains until the work is completed; then those identity, contact, and description fields are erased, leaving a receipt with the case number, status, and dates.
• We retain support correspondence only while needed to handle the request, follow up, protect service security, or meet applicable legal obligations.

Device-local data remains until you clear it, remove app or site data, or your device removes it. Infrastructure logs and backup or recovery copies can follow a provider's separate retention and recovery arrangements; this policy does not promise a deletion deadline for those copies. We limit retained information to the relevant service, security, recovery, or legal purpose.

Your choices and account deletion

You can deny or revoke location access, choose a district manually, delete saved playlists, forget paired devices, and clear app or browser data. Clearing local data resets remembered consent and preferences. YouTube will not load through Piplo until you accept its notice again.

To delete your Piplo account, open Delete account from the app or visit piploradio.com/delete-account, including after uninstalling the app. Sign in and confirm with your current password and the requested deletion confirmation. If you cannot access your account, contact us for help verifying ownership.

Confirmed deletion immediately removes your active account profile and credentials, sign-in sessions, account playlists and schedules, registered remote devices and pairings, related commands, account-specific failure records, and any privately saved studio provider key. It signs out your Piplo sessions. Local copies on other devices are not erased remotely; clear their app or site data separately.

If you contributed studio or catalog material, deleting the account automatically starts a separate review and removal of your account-associated personal scripts, workbooks, voice recordings, and other personal content. You can add an optional description in the deletion form to help us locate it; a separate email request is not required. The confirmation provides a case number. We normally complete this work within 30 days; removal of contributed content is not immediate.

Active studio ownership is detached when the account is deleted. Independently licensed, nonpersonal business catalog assets and recovery history can remain available to the continuing music service. Historical administrator attribution can remain in shared import and restore records while needed to validate recovery and complete the personal-content review. Our review covers associated personal material and attribution in those records; retaining business catalog assets is not a blanket exception for personal contributions.

For automatically provisioned administrator accounts only, we retain a one-way hash of the fixed account identifier indefinitely solely to prevent the deleted privileged account from being automatically recreated. This marker contains no name, email address, password, or deletion timestamp. Account deletion does not delete information held independently by Google, ElevenLabs, external sites, or infrastructure providers.

Adults, changes, and contact

Piplo is not directed to children. If you believe a person under 18 has provided personal information through Piplo, contact us so we can review and remove the account information as appropriate.

We may update this policy when the service or data practices change. The effective date identifies the current policy, and material changes will be communicated through the service where appropriate.

Level Eleven Solutions LLC
Privacy questions, access or correction requests, and deletion assistance: jay@levelelevensolutions.com.