Privacy policy

This policy explains what personal data is processed in connection with atsminiradio.com (including the ATS Mini Controller app) and voluntary support through Buy Me a Coffee: for what purpose, on what legal basis and for how long, who receives it, and what rights the people it concerns have.

1. Data controller

The controller is Grzegorz Zając, trading as WebUncle Grzegorz Zając, ul. gen. Kazimierza Pułaskiego 27A/2, 40-276 Katowice, Poland, tax ID (NIP) 9542783954 (the "Controller").

Contact for anything related to personal data: contact@atsminiradio.com.

2. In short

• The Site has no accounts, logins or forms. It uses no advertising or analytics cookies and does not profile users.
• The USB and Bluetooth connection to the radio, audio, the logbook and the app settings stay on the user's device.
• The Site runs on Cloudflare, which processes the user's IP address, among other things, with every request.
• Some features (such as PSK Reporter spots) connect directly to other companies' services. They are listed in section 4.
• When a user supports the project through Buy Me a Coffee, the Controller receives the data needed to handle the payment and keep the books.

3. What data is processed, why and for how long

3.1. Serving the Site and keeping it secure

When a user opens a page or the app fetches data from the server, Cloudflare handles the request on the Controller's behalf. This involves the IP address, the date and time, the requested address, the headers the browser sends (for example browser and operating system type, preferred language) and the country derived from the IP address.

• Purpose: delivering the Site, protecting it against attacks and abuse (for example traffic filtering, request limits and restricting access to the Sponsors page from some countries), and finding and fixing faults.
• Legal basis: Art. 6(1)(f) GDPR, the Controller's legitimate interest in making the Site available and keeping it secure.
• Retention: server-side invocation logs (Cloudflare Workers Logs) are kept for up to 3 days. Other technical data and security events are kept by Cloudflare for the period its rules set for the plan the Controller uses.

3.2. Visitor statistics

The Site uses Cloudflare Web Analytics. It uses no cookies and stores nothing in the browser. Its measurement script sends Cloudflare details such as the page address, the referring page, the browser type and load times. According to Cloudflare's documentation, the IP address is discarded at the nearest data centre and never reaches its databases or logs. The Controller sees only aggregate statistics from which no user can be identified.

• Purpose: seeing which pages are used and how fast they load.
• Legal basis: Art. 6(1)(f) GDPR, the Controller's legitimate interest in maintaining and improving the Site.
• Retention: Cloudflare keeps the aggregate statistics under its own rules.

3.3. Email

For email messages, the following is processed: the sender's email address, their name if given, the content of the message and anything else the sender chooses to send. Messages sent to contact@atsminiradio.com are forwarded by Cloudflare Email Routing, which does not store them, to the Controller's mailbox in Gmail, a service provided by Google Ireland Limited.

• Purpose: replying and corresponding, and when the message is a complaint, a refund request or a report of illegal content, also dealing with it.
• Legal basis: Art. 6(1)(f) GDPR, the Controller's legitimate interest in communicating with people who contact it. For reports of illegal content: Art. 6(1)(c) GDPR together with Art. 16 of Regulation (EU) 2022/2065 (the Digital Services Act).
• Retention: until the matter is closed, then until any claims connected with it become time-barred.

3.4. The “Recently heard” feed

The logbook is stored only in the user's browser. If the user turns on sharing or publishes a single entry, the app sends the server: the reception time (UTC), frequency, mode, signal readings (RSSI and SNR), the station name and the six-character Maidenhead locator of the user's location (a rectangle a few kilometres across).

No IP address, device identifier or account data is attached to the entry, and the Site has no accounts. The request itself is handled like any other (section 3.1). The station name is stored only if it matches the public EiBi list. The public entry shows the locator shortened to four characters, an area of roughly 150 × 110 km. No page or API response shows the full locator.

• Purpose: running the public reception feed and publishing the entry the user asked to publish.
• Legal basis: Art. 6(1)(b) GDPR, performing the electronic service the user requested.
• Retention: 30 days from the reception time. Older entries are deleted automatically every 6 hours. A deleted entry can remain for up to 7 more days in the database's automatic change history (Cloudflare D1 Time Travel), which exists to restore the database after a failure.

An entry contains nothing that would let the Controller work out who added it (Art. 11 GDPR). An entry the user points to, for example by giving its time and frequency, will be deleted at their request.

3.5. Voluntary support through Buy Me a Coffee

Support is accepted through Buy Me a Coffee, and payments are processed by Stripe. The user gives their details directly to those companies. From Buy Me a Coffee the Controller receives: the name or nickname entered, the email address, the message (if one was added), the amount, currency, date, country, transaction ID and the visibility setting of the support. In the Stripe dashboard the Controller has access to what is needed to process the payment and assess fraud risk, including the card type, the country that issued it, the last four digits of its number, and the IP address and country the payment came from. During payment, Stripe also collects information about the device and browser to help detect fraud. The Controller has no access to the full card number.

• Accepting and handling the payment, including refunds and complaints. Legal basis: Art. 6(1)(b) GDPR, performing a contract the user is party to. Retention: until the payment has been dealt with, then as in the next two points.
• Tax and bookkeeping. Legal basis: Art. 6(1)(c) GDPR, obligations under tax law. Retention: for the period those laws require, as a rule 5 years from the end of the calendar year in which the tax payment deadline passed.
• Preventing fraud (such as payments with stolen cards) and handling disputes and chargebacks. Legal basis: Art. 6(1)(f) GDPR, the Controller's legitimate interest in protection against fraud and in establishing, exercising or defending legal claims. Retention: until the dispute is resolved, then until the related claims become time-barred.

Buy Me a Coffee (Publisherr Inc, USA) processes the user's data as a separate controller, as described in its privacy policy. Stripe processes payment data partly on the Controller's behalf and partly, for example to prevent fraud and money laundering, as a separate controller. See the Stripe privacy policy for details.

3.6. Anonymous support counter

After each payment, Buy Me a Coffee sends the Controller's server a notification (webhook) with the payment details, including the supporter's name, email address and message. The server does not store those. It stores only the Buy Me a Coffee payment ID, the amount, currency, date and whether the payment was refunded. The Sponsors page shows the total and number of payments in the last 30 days and the day and amount of each one, with no information about supporters.

• Purpose: an anonymous summary of support on the Sponsors page.
• Legal basis: Art. 6(1)(f) GDPR, the Controller's legitimate interest in showing how the project is supported.
• Retention: the stored data is deleted automatically after 30 days.

3.7. Data stored on the user's device

The Site stores in the browser only what the features in use need. None of it is sent to the Controller, except as described in sections 3.4 and 4.

Cookie NEXT_LOCALE

Remembers the Site language. Removed when the browser is closed.

Local storage (localStorage): keys starting with ats-mini-, and ats-spectrum-labels

App settings: connection type, view, keyboard shortcuts, dismissed hints, favourite station alerts, logbook sharing, the detected radio firmware and the saved location. Kept until the user deletes them.

IndexedDB ats-mini

A copy of the EiBi station schedule for offline use. Kept until deleted or the schedule is refreshed.

IndexedDB ats-mini-logbook

The logbook, including the user's notes. Kept until the user deletes it.

IndexedDB ats-mini-favorites

Favourite stations. Kept until the user deletes them.

Service worker cache: ats-mini-precache-…, ats-mini-runtime-…

Copies of files and visited pages for faster loading and offline use. Kept until the Site is updated or the user deletes them.

This storage is strictly necessary for the services the user requests, so it does not require consent (Art. 399(3) of the Polish Electronic Communications Law of 12 July 2024). In addition, Cloudflare may set its own cookies needed for security, such as cf_clearance after a successful browser check or __cfruid when limiting request rates; they are not used for tracking. The user can delete this data at any time in the browser settings (for example by clearing site data) or block cookies. The Site will still work, but it will not remember settings.

3.8. Location

Weather, sorting stations by distance, PSK Reporter spots and the logbook use the user's location. It can be typed in, or the browser can detect it, in which case the browser always asks for permission. Detected coordinates are rounded to two decimal places (about 1 km) and saved in the browser's local storage. The location leaves the device only in the situations described in sections 3.4 and 4.

3.9. Radio, audio and AI assistants

Communication with the receiver over USB and Bluetooth happens only between the browser and the radio. Audio is processed on the user's device. Recordings, screenshots, logbook exports and firmware backups are saved as files on the user's computer. If the browser supports WebMCP, the app offers the browser's built-in AI assistant tools to read the radio status, memory channels and screenshots. What the assistant does with that data is up to its provider.

4. Other companies' services the browser connects to

Some features fetch data directly from other companies. The user's browser then connects to their servers, which learn at least the IP address. These companies process data under their own rules.

NOAA Space Weather Prediction Center (USA)

The IP address, while the propagation panel is open.

PSK Reporter

The IP address and four-character locator, when the user chooses the PSK source in spots or the scanner, or shows labels on the spectrum scanner with a saved location.

AliExpress (image servers)

The IP address, without the address of the page the user came from, when opening a product page in the Gear section.

AliExpress (affiliate link)

Clicking a product link takes the user to the shop. AliExpress may set its own cookies to attribute a purchase to its affiliate programme.

GitHub

The IP address and standard browser data, when the user clicks a firmware download link.

The EiBi schedule, solar data from hamqsl.com, POTA and DX Cluster (HamQTH) spots, and the firmware release list from GitHub are fetched by the Controller's server and passed on. It sends no information about the user when doing so.

Weather from the Norwegian Meteorological Institute (MET Norway) is also fetched by the Controller's server, while the propagation and weather panel is open and a location is saved (refreshed every 30 minutes). It passes on only the coordinates rounded to two decimal places (about 1 km), without the user's IP address. The response is kept in Cloudflare's cache under a key containing those coordinates for at most 6 hours, and the request itself appears in the logs described in section 3.1.

5. Recipients of data

• Cloudflare, Inc. (USA): hosting, content delivery, security, the database behind the “Recently heard” feed and the support counter, logs, statistics and email forwarding. Cloudflare processes data on the Controller's behalf under its Data Processing Addendum.
• Google Ireland Limited (Ireland), provider of Gmail: hosts the mailbox that receives messages sent to the contact address. Google processes this data as a separate controller, as described in its privacy policy.
• Buy Me a Coffee (Publisherr Inc, USA) and Stripe (in the European Economic Area: Stripe Payments Europe, Limited, Ireland): handling support and payments as described in section 3.5.
• Norwegian Meteorological Institute (MET Norway, Norway): rounded coordinates needed to fetch the weather (section 4).
• The accounting office that keeps the Controller's books: payment data needed for bookkeeping.
• Public authorities, such as tax authorities, where the law requires it.

The Controller does not sell data or share it for marketing.

6. Transfers outside the European Economic Area

Cloudflare, Stripe and Google may process data in the United States. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for companies certified under it, or on standard contractual clauses adopted by the European Commission. Buy Me a Coffee processes data in the USA as a separate controller, as described in its privacy policy.

These safeguards are publicly available: the Data Privacy Framework list of certified organisations, the Cloudflare Data Processing Addendum, the Stripe Data Processing Agreement, Google's data transfer frameworks and the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.

7. Users' rights

Everyone whose data is processed has the right to:

• access their data and get a copy (Art. 15 GDPR);
• have their data corrected (Art. 16 GDPR);
• have their data erased (Art. 17 GDPR), except data the Controller must keep under tax law;
• restrict processing (Art. 18 GDPR);
• data portability for data processed to perform a contract (Art. 20 GDPR), that is, the data in sections 3.4 and 3.5;
• object to processing based on the Controller's legitimate interest (Art. 21 GDPR);
• lodge a complaint with a supervisory authority. The authority competent for the Controller is the President of the Personal Data Protection Office in Poland (Prezes UODO, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl); a complaint can also be lodged with the supervisory authority in the country where the person lives, works or where the infringement took place.

Requests should be sent to contact@atsminiradio.com. The Controller replies within one month. In exceptional cases this can be extended by two more months, and the requester will be told if that happens.

These rights concern data the Controller can link to a specific person: email correspondence (writing from the same address is enough) and payment data (the email address or the name or nickname used for the payment in Buy Me a Coffee must be given). Entries in the “Recently heard” feed, visitor statistics and technical logs contain nothing that identifies whom they concern, so under Art. 11 GDPR the rights in Arts. 15–20 GDPR can be exercised for them only once information that identifies the data is provided, for example the time and frequency of the entry to be deleted.

8. Is providing data required

Providing data is voluntary. Without an IP address a page cannot technically be delivered. Without the details Buy Me a Coffee and Stripe require, a payment cannot be made, and without an email address no reply to a message can be sent.

9. Automated decisions

The Controller makes no decisions based solely on automated processing that would produce legal effects or similarly significantly affect the user, and does not profile users. Some things do run automatically: Cloudflare's security features, which can block suspicious traffic; a rule that blocks the Sponsors page in some countries, based on the country derived from the IP address; and Stripe's payment risk assessment, which can decline a payment. Anyone who believes they were blocked by mistake can contact the Controller.

10. Changes to this policy

The policy is updated when the Site's features, the services the Controller uses or the law change. The current version is always available on this page, with the date of the last change.