Version française

Stream My Music privacy policy

Last updated: 9 September 2026.

This policy describes the data processed by Stream My Music — both the streammymusic.net website and the mobile app of the same name. It says what we collect, why, who it is passed to, how long we keep it, and how you take back control.

We have chosen to write down the unflattering parts too: what the app reads on your phone, the third parties that receive something, and the traces your visit leaves behind. A policy that promises « no sharing » is worth nothing unless it is true.

1. Who processes your data

The data controller is the sole proprietorship Fabrice Frattini, 10 rue du Castel, 94000 Créteil, France, SIRET 94926213300018.
Contact for any question or request about your data: contact@streammymusic.net.

2. What we collect

Your account. When you register:

• Username, surname, first name — to identify you and address you properly.
• E-mail address — to confirm your registration, reset a password and write to you about your account.
• Date of birth — the service is for adults only.
• Language — to show the service in your language.
• Password — we keep only a bcrypt hash. We can neither read it nor recover it.

What you upload. The audio files you send, their tags (title, artist, album, genre, length), your playlists, your web radios and your favourites, and the share links you create. These files are yours: we do not listen to them, do not analyse them and do not pass them to anyone. A share link you create makes that one track available to whoever holds the link, until you revoke it or it expires.

Your subscription. If you take a paid plan: your subscription identifier, and the dates and amounts of your invoices. We never see your card number: payment takes place entirely at Stripe.

Your messages. What you write to us through the contact form, with your e-mail address, so that we can reply.

What you listen to. When you play a track for more than thirty seconds, we record its title, artist, album, how long you listened and when. That serves one purpose only: showing you your own statistics under « Your listening ». Nothing is inferred from it, nothing is recommended to you, and nothing is passed to anyone. We record neither your IP address, nor your device, nor your location. These records disappear with your account.

Technical traces. Each visit to the website records the IP address, the page viewed, the date and the browser language. This is used to measure traffic and to spot abuse. These records are kept for twelve months, then deleted.

Displayed currency. To offer a price in euros or in dollars, we read the country our hosting provider derives from your IP address and passes along with the request. That country is not stored, not kept, and not cross-referenced with anything: it picks a currency, nothing else. No third-party geolocation service is called, and your IP address never leaves the hosting. The choice can be changed with one click on the pricing section, and yours then applies.

Audience measurement. On the public pages we measure, ourselves, how they are read: the page opened, the domain name you came from (never the full address), the width of your window, how far down you scroll, the buttons you click and the time spent. No IP address is recorded there, nothing is sent to a third party, and nothing is matched against another website. These records are tied together by a random identifier kept in your browser's session storage: it disappears when you close the tab and does not say who you are. They are kept for thirteen months. If your browser sends the Do Not Track or Global Privacy Control signal, nothing is measured.

Your journey. Inside your space we record the steps of your use: account created, address confirmed, sign-in, upload prepared then completed, first playback, share link created, checkout opened, subscription active. To these we add a few gestures the server cannot see: the screen displayed, the number of results a search returned (never the words typed), how much of a track was played before it was stopped, an upload opened then abandoned, a failure of the app. Each line carries your account, the date and at most eight short pieces of information. It serves to know where use breaks down, and nothing else: nothing is inferred about you, nothing is recommended to you, nothing is passed to anyone.

The link between the two. When you sign in, the random identifier of the tab is recorded next to your account. That is what lets us know which page someone arrived through before creating an account. The identifier dies with the tab: it does not follow you from one day to the next, and is never used to recognise you elsewhere. The legal basis is our legitimate interest in understanding where our service fails. If your browser sends Do Not Track or Global Privacy Control, no identifier is sent, no link is made and none of these gestures is recorded; only the steps the server observes by itself remain. These records are kept for thirteen months, and disappear with your account. You may ask for their deletion at any time by writing to contact@streammymusic.net.

3. What the app reads on your phone

The Android app asks for a small number of permissions. Here is what each one is for, and what it does not do.

• Music and audio (READ_MEDIA_AUDIO) — to list the music already on your phone and let you play it inside the app. That reading stays on the device: neither the files, nor their titles, nor the list are sent to our servers or to anyone else. You may refuse this permission: only that one screen stops working.
• Notifications — to show the playback controls and the alarm screen.
• Exact alarms, waking the screen, drawing over other apps — so that the music alarm rings on time and shows a screen to stop it, even on a locked phone.
• Network access — to play your music and the web radios.

The app asks for no photos, no contacts, no location, no microphone and no address book. It contains no advertising network and no third-party analytics.

4. Who your data is passed to

We neither sell nor rent your data. Some operations do require a third party; here they are, all of them.

• O2Switch (Clermont-Ferrand, France) — hosts the website, the database and your files. Everything stays in France.
• Stripe — collects the subscription payments. Receives your e-mail address and your payment details, which we never see.
• Google — only if you choose « Sign in with Google ». Google then passes us your e-mail address and your name.
• Brevo — delivers our e-mails (registration confirmation, password reset). Receives your e-mail address.
• Deezer and Apple — to find a track's cover art. We send them only the artist name and the title, from our server and with no account identifier: they see a search, never who asked for it, nor the contents of your library. The artwork embedded in your own file is always tried first; this search only happens when there is none.
• radio-browser.info — the public directory the app queries when you look for a station to add. It receives the country and the term you are searching for.
• The radio stations themselves — when you listen to a web radio, your phone connects directly to the broadcaster. Its operator therefore sees your IP address, just as if you had opened its website. We do not act as an intermediary.

5. How long we keep it

• Account, files, playlists — for as long as your account exists, then deleted when it is closed.
• Invoices — ten years, as accounting law requires.
• What you listen to — for as long as your account exists, then deleted with it.
• Traffic traces — twelve months.
• Sign-in tokens — sixty days, or until you sign out.
• Messages sent through the contact form — three years after the last exchange.

6. Your rights

You may access your data, correct it, have it erased, ask for a portable copy, or object to a processing operation. Write to contact@streammymusic.net : we answer within thirty days.

Closing your account. You may delete your account at any time, from the app, from your personal space on the website, or by writing to contact@streammymusic.net. We then delete your account, your files, your playlists, your radios and your shares. Only the invoices are kept, because accounting law requires it. The steps are set out on the Delete my account page.

If you consider that your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

7. Security

• The website and the app communicate over HTTPS.
• Passwords are kept only as a bcrypt hash.
• Access to your files goes through a signed, short-lived token.
• In the app, those tokens are held in the phone's secure storage — never your password.
• Web radio streams are sometimes served in the clear (http) by their operator, which is outside our control. They carry only public audio; no data about you travels through them.

8. Cookies and local storage

We use no advertising cookie and no third-party analytics cookie. The website sets one technical session cookie (PHPSESSID), strictly necessary for it to work, erased when you close your browser.

If you pick the language of the website by clicking “FR” or “EN”, that choice is kept for a year in a cookie of ours (smm_langue) holding two letters. It only stops us from sending you back to the other language every time: it is a preference, it follows nobody, and it is exempt from consent on that ground.

On the pages carrying the “Continue with Google” button, Google sets its own technical cookie (g_state): it remembers whether the sign-in window has already been offered to you. It belongs to Google, not to us, and appears only if you open one of those pages. Doing without it would mean removing sign-in with Google.

The audience measurement described above uses no cookie: it keeps a random identifier in session storage, erased when you close the tab. It stays with us and follows no one from one website to another. As long as you do not sign in, it serves only to know which pages are read, which places it within the audience measurement that the French data protection authority exempts from consent (CNIL deliberation no. 2020-092). If you do sign in, that identifier is attached to your account as explained above; that attachment then rests on our legitimate interest, not on this exemption. Either way, nothing is measured if your browser asks not to be tracked.

Your personal space also keeps your sign-in tokens and your display preferences in your browser's local storage. That information never leaves your device and disappears when you sign out or clear the site's data.

9. Minimum age

The service is for adults only. We do not knowingly collect data about minors. If you find that an account was created by a minor, write to us: we will delete it.

10. Changes

This policy may change. Any change is published on this page, and the date at the top is updated. Changes that affect you directly will be announced by e-mail.