Privacy Policy

Last updated 18 September 2026.

In short

We don't use your recordings to train AI models — not ours, not anybody else's. If that ever changes we'll ask you first, not tell you after.
We don't sell your data, and there is no advertising here to sell it for.
No trackers. No analytics, no advertising cookies, no third-party script on any page. The only cookies we set keep you signed in and remember whether your sidebar is open.
We never store a listener's IP address. We turn it into a salted hash and throw the address away.
Your notes are yours. Delete one and it goes from your links at once.
We do measure listening — how much of a note was heard, on what kind of device, near which city. That is what the product is for, and the people you send notes to deserve to be told.

That is the summary, not the agreement. The sections below are the agreement, and where they say something more awkward than this box — they do, twice — believe them.

This policy is a draft written from what the code actually does, not from a template. Everything in square brackets — the company, the address, the supervisory authority — still has to be filled in, and the whole document needs a lawyer's eye before the service takes real customers.

KoeCast is run by GrayLining, of registered address: available upon request], Pakistan. Ask us anything about this policy at [privacy@graylining.com.

Two kinds of people

Senders have an account: they record notes and send links.

Listeners do not. They open a link somebody sent them. We record how that went, and we say so plainly below, because measuring listening is what this product is for.

If you are a listener and you would rather not be measured, the person who sent you the link is the one to speak to first — it is their note and their account. You can also write to us at privacy@graylining.com.

What we hold about senders

The account

Email address — to sign in, to verify the address, and to send you the three messages this service sends: verification, password reset, and a note that you already have an account if you try to sign up twice. We send no marketing email.
Password, stored only as a scrypt hash. We never see it.
Your name and your handle — the "maya-chen" part of your links. Both are shown to everyone you send a note to.
Your plan, and whether staff have suspended the account, with the reason.
Colour theme.

Your profile

Job title, company, website, a short bio, the greeting your notes open with, your time zone, your picture, your logo, and the button your share pages end with. Whether any of it appears at your public page is your switch, off until you turn it on. Your name, picture, greeting, logo and button are shown to the people you send notes to whatever that switch says.

Your sessions

When you sign in we keep a session row with your IP address and your browser's user agent, so you can be signed in on several devices and sign out of one of them. Sessions last 30 days and are all revoked when you change your password.

Your handle history

Every change of handle is kept — the old name, the new one and the date — so an old link can still find you and so a name cannot be recycled to impersonate someone.

Your recordings

The audio you record, the version we prepare for playing, its length, its waveform, its title and its settings.

What we record about listeners

Opening a link records nothing. A row is written only when audio is genuinely played, or when the file is downloaded. Preview fetchers — the ones behind link previews in Slack, WhatsApp and the rest — run no scripts and are ignored, and so is the note's own owner.

When someone does listen, we record:

How much was heard: how far into the note they reached, how much audio played, which parts were replayed or skipped, playback speed, whether it was muted, and whether the file was downloaded.
A listener marker — not a name and not an address. Your browser keeps a random id, and we store a salted, shortened hash of it. Where the browser blocks storage, the hash is made from the IP address and user agent instead.
🔴 We never store a listener's IP address. It is used to make that hash and to look up an approximate place, and is gone when the request ends.
Three coarse words about the device: browser family, operating system and whether it is a phone, a tablet or a computer. Never the full user agent string.
An approximate place — country, region and city — taken from our hosting provider's headers, or from a city database that sits on our own server. There is no lookup call to anybody else. It is accurate to a city at best, which is why every page says "near" it.
The listener's time zone, as their browser reports it.
Where the link was opened from, as a hostname only — "slack.com", never the address of the page it sat on.
On a personal link, the answer to "is that you?": that it was confirmed, that it was somebody else, or that it was not answered — and, if they chose to type one, the name they gave. A confirmed name is the one the sender wrote on the link, not anything the listener typed.

An answer is a claim, not proof of identity, and the dashboard says so.

We also flag what looks like a bot. Those rows are kept but left out of every number.

Cookies and what is kept in your browser

We use no advertising cookies and no analytics cookies, and there is no third-party script on any page.

Cookies we set:

The session cookie — signed-in senders only. 30 days, http-only.
A "don't remember me" cookie for the length of the browser session, when you ask not to be remembered.
A sidebar cookie that remembers whether the dashboard's sidebar is open. 7 days.

Kept in the browser and never sent anywhere except as described above:

A listener id — the random value behind the listener marker.
A name you typed when answering "is that you?", so you are not asked again on the next note.
Your answer for each personal link, for the same reason.
Light or dark mode, which never reaches our server.
A listen token and playback progress, for the tab you are listening in, so a reload continues the same listen instead of counting a second one. Gone when the tab closes.

Why we hold all this

To run the service: store a recording, prepare it, put it at a link, and play it.
To tell a sender what happened to the note they sent — the product's whole purpose.
To keep accounts secure, to enforce plan limits, and to stop abuse.
To answer support requests, and to meet the law.

Where the law asks for a basis: your account data and recordings are processed to perform our contract with you; listening statistics rest on the legitimate interest of a sender in knowing whether the note they sent was heard, which is why we hold senders to telling their recipients — see the Terms.

How long we keep it

Notes on a plan with a time limit stop working at that limit, wait 30 days, and are then deleted for good — the audio and every listening record with it.
Notes on a plan without a time limit are kept until you delete them or close the account.
A deleted note disappears from your links at once, and can be restored by support for 30 days.
🔴 Being straight about a gap: today, permanent deletion only runs for notes that carry an expiry. A deleted note on an unlimited plan is hidden from everyone but is not yet erased by itself. Ask us at privacy@graylining.com and we will remove it. This is being fixed.
Listening records and downloads live with their note and are removed when it is.
Sign-in sessions last 30 days.
Our record of staff actions is kept indefinitely — that record is the reason staff access is defensible.
Handle history is kept for as long as the account exists.
Backups are kept for 30 days.

Who else sees it

We do not sell anything, and we do not use your recordings to train anything.

The companies that hold data on our behalf:

Our object storage provider, which holds recordings, pictures and logos.
Resend, which sends the three emails listed above and therefore sees your address.
Our hosting provider, which terminates the encrypted connection and may pass the country and city headers described above.
Our backup storage, which holds the nightly database dumps.

Our own audio service, which normalises recordings and measures them, runs on our own machines. It is handed time-limited links to one file at a time, holds no keys to the storage, deletes its working copy when it finishes, and can reach exactly one table in our database and nothing else.

We will also hand over data where the law requires it, and we will tell you when we are allowed to.

Our staff

Support staff can see account rows, note rows and statistics, and can restore a note or sign a customer out. They cannot ban anyone, change roles or passwords, or act on another staff member's account.

An administrator can additionally sign in as a customer, which means being able to play that customer's private recordings. That is deliberately narrow: a written reason is required, it cannot be aimed at another staff account, the session lasts 30 minutes, and the record of it is written before the session changes hands. Staff actions that cross account boundaries are recorded in a log that is never edited or deleted.

The admin panel has no audio player.

How it is protected

Passwords are stored as scrypt hashes.
Sessions live in our database, so they can be revoked; every one is revoked when a password changes.
Traffic is encrypted in transit, and the app refuses to start in production without a secure address.
Pages carry a strict content security policy with a per-request nonce; no third-party script may run.
Audio is never linked from a page as a permanent address. A link to a recording is signed at the moment play is pressed and expires in minutes.
Sign-in, sign-up, password reset and listening are all rate limited.
The listener hash is salted, and the service refuses to start in production with a default salt. We change that salt from time to time, which detaches old records from new ones — an operational practice, not an automatic one.

No service is perfectly secure, and we do not claim to be.

Your choices

See and change what we hold about you: your profile and your account are yours to edit in the app.
Get a copy, or ask us to delete it: write to privacy@graylining.com. Deleting your account from inside the app is not built yet — until it is, we will do it for you.
Listeners: ask us at the same address. Tell us roughly when and which link you opened; we cannot identify you from a name alone, because we do not hold one.
If you are in the [UK or EU], you can complain to [supervisory authority].

Children

This service is not for children. Do not create an account if you are under 16.

Changes

If we change this policy we will change the date at the top, and tell account holders by email when the change matters.