Privacy Policy
1. Introduction
SONIK TEN PTY LTD ("we", "us", "our") operates SoniPod, a podcast player application available on iOS, Android, and the web, with companion experiences for CarPlay, Android Auto, and wearables. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use SoniPod and its related services.
We are committed to protecting your privacy and complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).
2. Information We Collect
2.1 Account information
- Email address — used for authentication and account recovery
- Display name — used to personalise your experience
- Authentication tokens — issued when you sign in; we never see or store your sign-in provider passwords
Account and sync data is stored in our backend running on Cloudflare Workers with data at rest in Cloudflare D1 (Cloudflare's edge database).
2.2 Listening data
- Podcast subscriptions — the feeds you follow
- Listening history and playback positions — to resume episodes across your devices
- Queue and playlist data — your up-next queue and custom playlists
- Playback preferences — per-podcast settings such as speed and skip intervals
2.3 Search
Podcast and episode searches you perform in the app are sent to the Podcast Index directory service to return results. Search queries are not linked to your account identity by that service.
2.4 Diagnostics
- Crash reports — stack traces and device state at the time of a crash
- Performance metrics — app launch times, screen load times, network latency
- Error logs — non-fatal errors and warnings
Diagnostic data is collected via Sentry in de-identified form and is not linked to your account.
2.5 Purchase information
- Subscription status — active, expired, or cancelled
- Transaction identifiers — Apple App Store or Google Play transaction IDs
We do not collect or store your payment card details. All payment processing is handled by Apple or Google; subscription state is managed by RevenueCat as our processor.
3. How We Use Your Information
- Provide core functionality — sync subscriptions, listening progress, and preferences across your devices
- Process subscriptions — manage your SoniPod Premium entitlement through Apple, Google, and RevenueCat
- Maintain stability — identify and resolve crashes and performance problems
- Improve the app — analyse aggregate usage to prioritise features and fix issues
- Communicate with you — send account-related notifications; we do not send marketing email without your consent
4. Third-Party Services
| Service | Provider | Purpose | Data shared |
|---|---|---|---|
| Cloudflare Workers / D1 | Cloudflare, Inc. | Backend API, account storage, cross-device sync | Email, user ID, auth tokens, sync payloads |
| RevenueCat | RevenueCat, Inc. | Subscription management (processor) | App user ID, transaction IDs, subscription status |
| Sentry | Functional Software, Inc. | Crash reporting, performance monitoring | De-identified crash data, device info |
| Podcast Index | Podcast Index LLC | Podcast search and discovery | Search queries (not linked to user ID) |
| Apple App Store / Google Play | Apple Inc. / Google LLC | Payment processing, app distribution | Purchase transactions (under their own terms) |
Each third-party service is governed by its own privacy policy. We encourage you to review them.
5. Data Storage and Security
- All data in transit is encrypted using TLS 1.2 or higher.
- User data at rest is stored on Cloudflare's edge network (Workers/D1), which employs encryption at rest.
- We apply the principle of least privilege to all service credentials and API keys.
- We do not sell, rent, or trade your personal information.
6. Data Retention
- Account and listening data is retained while your account is active, to enable cross-device sync.
- Diagnostic data is retained for 90 days, then automatically purged.
- Purchase records are retained for the legally required period (typically 7 years under Australian law).
When you delete your account, we delete or de-identify all associated personal data within 30 days, except where retention is required by law.
7. Your Rights
7.1 All users
- Access your personal data by contacting us
- Correct inaccurate data via your account settings or by contacting us
- Delete your account and associated data
- Export your data in a portable format (OPML for subscriptions, JSON for listening data)
7.2 EU/EEA users (GDPR)
You may additionally restrict or object to processing, request data portability in a structured machine-readable format, and lodge a complaint with your local data protection authority. Our legal bases for processing are contract performance (providing the service), legitimate interests (app stability and improvement), and consent where we request it.
7.3 California users (CCPA)
You have the right to know what personal information we collect and how it is used, to request deletion, and to non-discrimination for exercising your rights. We do not sell personal information.
8. Children's Privacy
SoniPod is not directed at children under 13 (or 16 in the EU/EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
9. International Data Transfers
Your data may be processed in countries outside your country of residence, including Australia and the United States (and on Cloudflare's global edge network). Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or emailing your registered address. The "Last updated" date above indicates the most recent revision.
11. Contact Us
- Email: [email protected]
- Company: SONIK TEN PTY LTD
- ABN: 16 695 514 044
- Jurisdiction: Queensland, Australia
For GDPR-related enquiries, you may contact our nominated data protection representative at the same address.