L2MR Cast Privacy Policy

Effective date: September 13, 2026

Policy version: 2026-09-13.1

L2MR Cast is provided by MediaHosting Ltd. This policy describes the L2MR Cast website, mobile applications, Backend3 service, and Live Team feature for radio managers, DJs, and approved listeners. It updates the technical descriptions in our August 27 and August 29 policies. Older app versions may still link to those historical documents; this page describes current service data handling.

Station access and identity

• Station and account data. L2MR Cast uses station addresses, account identifiers, display names, roles, and credentials supplied by you or your radio provider. Mobile credentials can be kept in device-protected storage. Web authentication uses secure, HTTP-only cookies; access or refresh tokens and radio credentials are not placed in browser storage. Appearance and language preferences may be saved locally in the browser.
• Radio-manager verification. For an approved Centova provider, the app or browser sends the selected provider, username, and administrator password to Backend3 over TLS. Backend3 sends these credentials as form fields over TLS only to the provider's approved, network-pinned /api.php endpoint for server.authenticate and server.getaccount. Arbitrary verification URLs, redirects, and private or unapproved network addresses are rejected. These verification credentials are excluded from application logs and audit metadata. When optional remembered access is not selected, they are used for verification and discarded from application memory after that request.
• Optional remembered Centova access. When a manager selects “Keep this station connected,” Backend3 encrypts verified Centova credentials with AES-256-GCM and stores the encrypted envelope in PostgreSQL, bound to the station, owner, provider, and verified provider identity. Backend3 decrypts it in memory for authorized station-information or control requests. DJs, listeners, and the service-operator dashboard cannot retrieve the credential envelope. “Forget station access” removes the active remembered copy; reconnecting replaces it. Existing backups are separate copies.
• DJ and listener pairing. A manager creates a single-use, role-bound, expiring code. The invited person supplies it and a display name, without receiving the station's Centova credential. Backend3 stores a keyed digest rather than the plaintext invitation code and assigns the manager's selected station and role. An internal @identity.invalid address for a passwordless identity is not a real contact address. Email/password accounts, where used, have an email address and password hash stored by the service, not a plaintext account password.
• Installation identity. The apps create a random installation identifier and secret proof for station or guest authentication. Backend3 stores the identifier and a keyed digest of the proof, linked to the user, device, and authenticated session. These persistent records support sign-in, station assignment, session continuity, and protection against unauthorized access. Ending a show, losing presence, or expiring a token does not erase these service records.

Station controls and live production

• Station-management data. For an authorized remembered manager connection, Backend3 can retrieve Centova status, station configuration, listener sessions, recent-song text, playlists, and DJ-account settings. A manager may request audited server, AutoDJ, playlist, DJ-account, or public configuration changes. Provider responses are filtered before reaching the browser. Passwords, raw provider responses, song titles, and listener details are excluded from broker audit metadata.
• Station output profiles. Backend3 saves Current/Custom output configuration in PostgreSQL, including station and owner identifiers, destination address, protocol, port, mount, revision, and encrypted source credentials. Source credentials use AES-256-GCM and a separate protected vault key that is not stored in these database records. This profile is separate from optional remembered Centova panel access. Profile verification expires after five minutes, but that expiry does not delete the saved profile. Ending output can remove a session's pinned credential envelope after lease release, while retaining minimal session metadata and the saved station profile. Database backups can contain encrypted credential envelopes.
• Live Team and show records. Backend3 stores user, station, membership, device, authentication-session, invitation and request digests, presence, readiness, permission and consent state, preflight results, show state, routing commands, gain, mute, on-air timestamps, Terms acceptance, moderation, and security-audit records. These operate and protect a show. Some Redis live-state copies expire; related PostgreSQL records are durable and do not have a complete automatic category-wide purge schedule.
• Microphone and playlist audio. Microphone use requires device permission and an explicit contribution or audio-check action. Live Team sends contribution audio through encrypted WebRTC to Backend3 for authorized mixing and relay. Current and Custom destinations in iOS 2.3.2 use this mixer path; versions or modes that provide direct broadcasting instead send encoded audio to the selected station source. An explicitly started audio check may send microphone or prepared-playlist audio to the private mixer before the contributor is admitted to the public program. Ready and on-air are different states. The manager controls which contributions enter the mixed radio output.

Backend3's standard live path mixes and relays contribution audio in transient buffers and is not configured to record or archive the microphone or live mix. Audio is associated with station, show, membership, and session identities to authorize routing. Selected audio files are not uploaded merely because they were selected; starting their contribution sends the audio into the live path.

Selected files and saved playlists

Mobile files selected for a queue may be copied into private app storage. On iOS, temporary queue imports and explicitly saved playlists are separate copies, and new temporary imports require successful backup exclusion. Saved playlists remain in the device's shared station library when a temporary queue is cleared or stations are switched or removed. Deleting a saved playlist removes its app-owned copies, not the original phone files or other playlists. The current iOS version requests backup exclusion for saved playlists but does not check whether it succeeds. Saved copies may therefore remain in device backups; local deletion does not establish removal from an existing backup.

Who receives live audio

The mixed program is delivered to the source endpoint selected for the station and can then be heard by its listeners. The station owner, hosting provider, Icecast or SHOUTcast operator, downstream relay, or listeners may independently record, relay, log, or archive the stream. Their practices are outside Backend3's non-recording configuration. Contact the applicable station or hosting operator about its retention and deletion practices. L2MR Cast does not use live audio for advertising or cross-app tracking.

Safety, diagnostics, and service operations

Backend3 can store report reasons and optional details, participant blocks, manager moderation decisions, and related audit records for abuse response, security, and legal or store-policy obligations. A separately authenticated service-operator dashboard can display accounts, stations, live sessions, participant roles, and connection state. It does not reveal Centova, source, DJ, or user passwords.

Servers can receive IP address, request time, remote port, method, URI, host, User-Agent, rate-limit events, and security or error details. Application container logs rotate by size, generally up to three 10 MB files per container; this is not a guaranteed time-based retention period. Depending on platform and consent, Google advertising, consent-management, analytics, and crash-diagnostic SDKs can process device identifiers, approximate IP-derived location, app interactions, crashes, performance, and advertising data under their own policies. These SDK activities are separate from the live audio contribution.

Security and transport

Web and app account, safety, control, and Live Team connections to Backend3 use encrypted transport. The connection from Backend3 or a mobile device to a radio source is separate and may be cleartext when the selected server does not support TLS. In that case, source credentials and audio can be observed or changed in transit. L2MR Cast does not place source passwords in listener URLs or analytics events.

Server-side credential encryption keys are protected separately from credential database records. Managed PostgreSQL backups can contain encrypted credential envelopes without those key values. Full filesystem or project backups are a separate scope and may contain additional protected material. No system can guarantee absolute security. Use unique credentials and “Forget station access” when persistent Centova access is no longer needed.

Retention, deletion, and choices

Identity, Terms, show-control, safety, audit, and related service records are distinct from transient audio and can persist in PostgreSQL and backups. They support service operation, abuse prevention, security, dispute handling, and legal obligations. Expiring an authentication token or stopping output does not itself delete historical service records or the saved station profile.

A database-backup expiry policy has been approved, but enforcement and coverage of all copies are not yet fully verified. We do not promise deletion of every copy by a particular date. A deletion from the live database does not establish removal from existing backups, and backup expiry does not establish deletion of all live service or recovery records. Database backups are not a microphone or live-mix recording mechanism.

A successful server logout revokes the current session but does not delete the account or all durable records. An offline or failed logout can clear local access without confirmed server revocation. “Forget station access” removes the active remembered Centova credential, not the separate station output profile or existing backups. You may request access, correction, or deletion by emailing privacy@listen2myradio.com or admin@listen2myradio.com. We may request proof of identity and retain records required for security, legal claims, or law. A pending request is not confirmation that cleanup is complete.

You can decline microphone permission, turn availability or Ready off, return backstage, stop a broadcast, clear imported media, remove saved playlists, avoid remembered access, block another participant, or report live content. Current Terms, safety, presence, and preflight checks govern contribution admission and starting output.

User content and contact

You must have the rights needed to broadcast your microphone, music, and other content and follow the Live Audio Terms and User Policy (2026-08-26.1). Managers can mute, return backstage, or remove contributors. Live Team provides reporting and participant-blocking controls.

Privacy matters: MediaHosting Ltd., P.O. Box 3220, Acre 24132, Israel — privacy@listen2myradio.com.