Privacy policy
Last updated 9 October 2026
Podmaniac ("we") is a podcast hosting service at podmaniac.com, operated from New Zealand by Terence Rhoda, a sole trader trading as TRK Digital. This policy explains what we collect, why, and what we never do with it. The short version: we store what is needed to host your podcast and count your downloads, we sell nothing to anyone, and your content stays yours.
What we collect from podcasters
- Account details: your email address, name and a securely hashed password (we never store the password itself). Sign in uses an encrypted session cookie.
- Your content: the audio, artwork, show notes, transcripts and settings you upload or create. It is stored so we can host and deliver your podcast; it remains yours.
- Billing details are handled by Polar, our reseller and merchant of record, which processes payments and issues invoices; we receive your name, email, country, plan and payment status, and we never see or store card numbers. Polar's own privacy policy covers what it holds.
- Support email you send us, so we can answer it.
What we collect about listeners
When someone downloads or streams an episode we log the request: IP address, user agent (which app was used), country and the episode requested. We use this solely to produce download statistics for the show's owner, following the IAB Podcast Measurement Technical Guidelines v2.3. IP addresses are used to count unique listeners in anonymised, hashed form and are not shown to show owners or anyone else. We do not build listener profiles, we do not track listeners across podcasts or websites, and public show pages carry no advertising trackers.
Google and YouTube data
If a show owner connects a YouTube channel, we use Google sign in to ask for two permissions, and nothing more:
- Upload videos to the channel (youtube.upload): used only to upload the episode videos the owner has switched on or asked for, with the episode's title and show notes.
- View the channel (youtube.readonly): used only to show the owner which channel is connected (its name and picture), to check whether the channel may receive videos longer than 15 minutes, and to read the processing status of the videos we uploaded so the dashboard can show it.
What we store from Google: the channel's ID, name and picture, whether long uploads are allowed, the ID of each video we uploaded, and the authorisation token Google issues for the connection. We do not read the channel's other videos, comments, subscribers, playlists, analytics or any other YouTube or Google account data, and we never post anything the owner did not initiate.
Google user data is used only to provide the YouTube publishing feature to the show owner who connected the channel. It is never sold, never used for advertising, never used to train AI or machine learning models, and never shared with third parties other than Google itself and the infrastructure provider that stores it for us. No person at Podmaniac reads it, except with the owner's permission to resolve a support request, for security purposes, or where the law requires it.
Podmaniac's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. A connection can be removed at any time in Show settings or at myaccount.google.com/permissions. Disconnecting revokes the token at Google and deletes it from our systems at once.
How we protect your data
Sensitive data, including Google authorisation tokens, account details and passwords, is protected as follows:
- Encryption in transit: every connection to Podmaniac, and every connection Podmaniac makes to Google and its other providers, uses HTTPS (TLS). Unencrypted connections are refused or redirected.
- Encryption at rest: our databases and file storage are encrypted at rest (AES 256) by our infrastructure provider.
- Tokens stay on the server: Google authorisation tokens are held only on our servers. They are never sent to a browser, never shown in the dashboard, never written to logs, and are not visible to other users of the same show.
- Passwords: stored only as salted hashes (PBKDF2), never as text. New passwords are screened against common and leaked passwords; for the leak check only the first five characters of a one way fingerprint of the password leave our servers, never the password itself.
- Access control: each account sees only the shows it is a member of, with owner, editor and viewer roles. Access to production systems and stored data is restricted to authorised Podmaniac personnel and is used only to operate and support the service.
- Minimal data: we request the narrowest Google permissions that the feature needs and store only what is listed above.
- Deletion: disconnecting a channel deletes its token immediately. When a show or an account is removed, its Google connection stops being used at once and is erased from our systems within 7 days.
- Incidents: if a breach affected your data we would notify you and the relevant authorities as the law requires.
AI features
Transcription runs on infrastructure we operate. For AI show notes, the episode transcript is sent to our AI provider (Anthropic) to generate the notes; it is not used to train their models. AI features only run when a show owner switches them on or clicks the button.
We send account email only: invitations, email verification, password resets and service notices, via our email provider (Resend). No marketing lists, no newsletters you did not ask for.
Cookies
The dashboard uses one cookie: the session that keeps you signed in. Public show pages and the player set no cookies and use no third party analytics.
Where data lives
Content and data are stored and served on Cloudflare's global network, with primary storage in their infrastructure. Backups exist for reliability.
Retention and deletion
Your content stays as long as your account does. Delete an episode and its files are removed from storage; remove a show or account (or ask us to) and its content, members and tokens go with it: it goes offline immediately, and copies of removed content are erased from our systems within 7 days. Raw listener request logs are kept for up to 90 days for counting, after which only aggregated statistics remain.
Sharing
We share data only with the processors that make the service work: Cloudflare (hosting and delivery), Resend (email), Anthropic (AI show notes) and Polar (payments and invoicing). We do not sell or rent any data, full stop. We would disclose data if the law genuinely required it, and would tell the affected user unless legally barred.
Your rights
Email us to access, correct, export or delete your data. New Zealand's Privacy Act 2020 applies; EU and UK users have their GDPR rights, which we honour.
Changes
If this policy changes materially we will note it here and email account holders.