1. Who We Are
1.1ZeroOne Beats ("we", "us") operates the free song submission system at zeroonebeats.com/submit and the paid ZOB Premium subscription. This policy explains what personal data we collect across both services, why, and what your rights are.
2. Data We Collect
| Data | Source | Purpose | Lawful Basis |
|---|---|---|---|
| OAuth display name | Your chosen sign-in provider (Twitch, Google, or Discord) | Shown to you as confirmation of who you're signed in as | Legitimate interest |
| OAuth provider & user ID | Your chosen sign-in provider | Identity verification; enforcing the 3-submissions-per-24h rate limit | Legitimate interest |
| Artist name, song title, track link, artist profile URL | You (submission form) | Processing and storing your music submission | Contractual necessity (you choose to submit) |
| IP address (hashed, non-reversible) | Your browser / network | Abuse and fraud prevention | Legitimate interest |
| Submission timestamp | Server | Record-keeping | Legitimate interest |
2.1IP addresses are immediately and irreversibly hashed before storage using HMAC-SHA256. We never store your raw IP address.
3. Cloudflare Turnstile (CAPTCHA)
3.1The submission form uses Cloudflare Turnstile to prevent automated abuse. Cloudflare may process your IP address and browser signals to determine whether you are human. This is governed by Cloudflare's Privacy Policy.
4. Session Cookies
4.1When you sign in, we set a session cookie to keep you authenticated during your visit. This cookie:
- 4.2Is HttpOnly (not accessible by JavaScript)
- 4.3Is Secure (only transmitted over HTTPS)
- 4.4Expires after 24 hours
- 4.5Contains only a random session identifier - no personal data
5. Data Retention
5.1Submission files (WAV and metadata JSON) are retained for as long as they are relevant to our playlist management. We do not have a fixed automatic deletion schedule. You may request deletion at any time (see Section 7).
5.2Session data is deleted automatically after 24 hours.
6. Third-Party OAuth Providers
6.1We use Twitch, Google, and Discord for authentication only. We do not receive your password, email address, or any data beyond your display name and user ID. Each provider's own privacy policy governs how they handle your data during the sign-in process.
7. Your Rights (GDPR)
7.1If you are located in the European Economic Area or United Kingdom, you have the right to:
- 7.2Access - request a copy of the personal data we hold about you
- 7.3Rectification - request correction of inaccurate data
- 7.4Erasure - request deletion of your submission and associated data
- 7.5Restriction - request that we limit processing of your data
- 7.6Objection - object to processing based on legitimate interest
7.7To exercise any of these rights, get in touch via the Contact page (choose "Privacy / GDPR data request" as the topic). We will respond within 30 days.
7.8You also have the right to lodge a complaint with your local data protection authority.
8. Payment Processing (ZOB Premium)
8.1If you subscribe to ZOB Premium, payment is processed by Lemon Squeezy (Lemon Squeezy, LLC), which acts as the merchant of record. We do not collect or store your payment card details. Lemon Squeezy shares the following information with us about each subscriber:
- 8.2The e-mail address you used to subscribe
- 8.3Your country of residence (for tax compliance)
- 8.4Your subscription status, renewal dates, and any cancellation
8.5We use this information solely to provide and support your subscription. Lemon Squeezy's own handling of your payment data is governed by its Privacy Policy.
9. Contact Form (Web3Forms)
9.1If you message us through the Contact page, your submission is processed by Web3Forms, which receives your name, email address, message, and the topic you selected, and forwards them to our inbox. We do not store your message on this website. Web3Forms may keep operational logs in accordance with its own Privacy Policy. If you prefer not to use a third-party processor, you can email us directly using any of the aliases referenced from the Contact page.
10. Automated Lyric Review (Anthropic)
10.1When you submit a track, we retrieve the lyrics from the public page you link on the AI music platform you name (for example your Suno track page) and send that lyric text to Anthropic, which returns an automated summary of the content it contains — for example profanity, violence or adult themes. We use this only to check that the Clean/Explicit rating on a submission looks right before a human reviews it. Our lawful basis is legitimate interest in classifying content we broadcast.
10.2Only the lyric text is sent to Anthropic. Nothing else from your submission goes to them — not your name, your email address, your account details, or the audio file you upload to us. Those stay on our own systems.
10.3The result is visible only to station staff — never publicly, and never on your own submissions page. It is advisory: it can flag a submission for closer review, but it never approves, rejects or re-rates a track on its own. A human makes every decision.
10.4The lyrics we send are ones you have already published yourself on the linked platform page. Anthropic’s handling of this data is governed by its own Privacy Policy. The check runs automatically when you submit. If you would rather your lyrics were not processed this way, contact us — we will delete the stored result and handle your future submissions by hand.
11. Social Campaign Reporting
11.1If you arrive through one of our campaign links, we count page opens, web-player playback starts, playback reaching 60 seconds, and completed music submissions. This helps us understand which posts bring people to the radio or encourage submissions.
11.2The campaign database uses a random visit reference, which expires after 24 hours and is removed by scheduled cleanup. It does not store visitor names, account IDs or IP addresses. Daily totals are retained for up to 366 days. Campaign reporting does not create a persistent browser identifier or use local storage. The normal sign-in cookies described above still apply.
11.3Campaign measurement is skipped when your browser sends Do Not Track or Global Privacy Control. You can also open the web player or submission form without a campaign link. We use our own server for these counts, with no advertising pixels or third-party analytics service.
12. Changes to This Policy
12.1We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.