What data StreamTop collects, why, and how long it's kept
This privacy statement applies to StreamTop. Questions about your data or this statement? E-mail info@streamtop.nl or use the contact form.
Last updated: October 22, 2026
When creating an account: username, e-mail address, town/city, your station's website, and a password — the latter is never stored in readable form, only as an irreversible hash. If you choose two-step verification (2FA), the associated key and a set of recovery codes (also only as a hash) are stored.
When adding a stream: the details you enter yourself (name, stream link, optionally a phone number, request link or Discord webhook URL).
Advertising (Google AdSense): ads from Google AdSense may appear on the overview of all stations, the Top stations, the Charts, the song search page and the radio guide. Google and its partners may use cookies and similar technologies for this, for example to measure how often an ad has been shown and, if you consent, to tailor ads to your interests. Visitors from the European Economic Area, the United Kingdom and Switzerland are first asked for consent by Google; you can change your choice at any time via Cookie settings at the bottom of the page. Read more at Google: how we use cookies in advertising and Google: how Google uses information from sites that use its services. There are no ads in your dashboard, the admin area or the widgets on stations' websites.
Newsletter: if you have an account, we occasionally send you a newsletter about StreamTop (new features, tips, the top stations of the week) to your account's e-mail address. You can always unsubscribe using the link at the bottom of every newsletter, via Account → Newsletter, or by unticking the box when registering. We keep track of who a newsletter was sent to and whether that succeeded; we don't measure whether you open the e-mail or click links.
Activity log: important actions on your account are recorded with time and IP address — for example signing in (and failed sign-in attempts), logging out, changing your password or profile, turning 2FA on or off, and adding, editing, making public/private or deleting streams or shows. This is there to detect abuse and break-in attempts and to be able to answer questions about your account. The log is only visible to the administrator, never public, and is automatically cleaned up after 13 months. Passwords and secret links (such as a Discord webhook) are never written to the log.
From visitors of public stream pages (not linked to an account): IP address and a technical "device cookie" — this prevents the same visitor from artificially inflating the vote or visit counter. Also the measurement history of each stream (whether it was online, how many listeners, and which song was playing) — the latter data comes from the streaming server itself, not from visitors.
Follow/push notifications (optional): if you click "follow" on a stream, your browser stores a push subscription on our server. That subscription is technical (an address from your browser vendor) and not linked to an account or e-mail address. The same applies to the bell on a show (show reminder): we then only store which show you want to follow. If you turn the bell off, we delete that link immediately.
Visitor statistics for public pages: when you visit a public page (e.g. the top stations overview, a station page, or the login/registration pages) we record a visit: which page, where you came from (e.g. Google, a social media channel, or another website), a rough estimate of your device/browser/operating system, whether you've been here before (via the same technical device cookie as below under "Cookies"), and a shortened IP address (the last part is set to zero, so it can't be traced back to an individual visitor). Visits by known bots/crawlers and from data centres are not counted. See below for more detail. This data is only visible to the master/admin account, as aggregated statistics — not linked to an account.
To show your dashboard and statistics, to detect abuse (such as fake votes), and to send the e-mails that belong to your account: account verification, a password reset if you ask for one, and — only if you turn it on yourself — an offline notification or a periodic summary.
If you choose to enter a Discord webhook URL for a stream, StreamTop sends a message to that Discord channel when that stream goes online/offline — so this only happens if you set it up yourself, and in that case shares data with Discord.
For Icecast/Shoutcast stations without their own album cover, the title of the current song is looked up via Apple's (public) iTunes search service, purely to be able to show a matching cover.
StreamTop uses a session cookie (to stay signed in), a sign-in cookie valid for 30 days only if you tick Remember me when signing in (with a random code, not a password; logging out or "Log out everywhere" under Account clears it) and, for visitors of public pages, a technical device cookie that prevents duplicate votes/hits and (in hashed form, not the cookie itself) determines whether a visitor counts as "new" or "returning" in the statistics. Both contain no readable personal data and are not used for advertising purposes.
Google Analytics (only with your consent): on the public pages we use Google Analytics 4 to see which pages are visited and how visitors use the site, so we can improve it. You give consent for this in Google's message (the same message as for the ads). Only after your consent do we load Google Analytics; Google then sets cookies (_ga, _ga_*, valid for up to 2 years). Analytics' advertising and personalisation features are switched off. You can change your choice at any time via Cookie settings (also at the bottom of every page).
Your account and stream settings remain as long as your account exists. Detailed measurements (every check of a stream, every visitor hit, and the visitor statistics above including any country cache) are automatically cleaned up after 13 months — plenty to keep a full year of history available (e.g. for the CSV export in your dashboard), without data being kept forever.
These statistics are meant to give the administrator insight into how many visitors the platform attracts, through which sources, and which pages are popular — not to track individual visitors. They can only be viewed via an internal admin dashboard (Statistics), nowhere public.
Country/region/city of visitors (optional, off by default): the administrator can choose to also show the approximate location of visitors. If this is on, the already shortened IP address is periodically (in the background, not per visit) looked up at the external service ipwho.is, which returns the country, the region and the (nearest) city — with a shortened IP address this is always an estimate, not an exact location. The same applies to listeners who press play: the approximate location of their shortened IP address is looked up in the same way, so the station owner can see a listener map (counts per country and place). The owner never sees IP addresses, only those counts. If this setting is off (the default), this doesn't happen and no visitor data leaves the server for this purpose.
New vs. returning: to count whether a visitor is coming for the first time or has been before, a sha256 hash of the existing device cookie (see "Cookies" above) is stored on the first visit — not the cookie itself, and not linked to IP address, account or any other identifying data.
Apart from the (shortened, aggregated) visitor statistics above, the master account shows itself a separate "Online now" panel: which visitors have visited a page in the last few minutes, with their full, non-shortened IP address and a live lookup of internet provider/organisation (whois) at that same external service, ipwho.is. So this happens per visit, not just afterwards in aggregated form, and is the only place in StreamTop where this happens.
This data is not archived separately: an IP address automatically disappears from this panel as soon as someone has been inactive for a few minutes, and the whois lookup is cached briefly so the same service isn't queried unnecessarily often. Visible to the master account, nowhere public.
You can view and change the data you entered yourself (account details, stream settings) via your dashboard and account page.
Want your account (and the associated data) deleted, or do you have another question about your data? That can only be done via the administrator of this platform — get in touch via info@streamtop.nl.