1. Who is responsible
Milestone Radio is the controller of personal information handled through Milestone Radio, except where a provider such as Google or Paddle acts under its own privacy notice for its part of the service.
This notice applies to organizers, contributors, recipients, and visitors. An organizer who supplies information about another person, including a child recipient, must be authorized to do so and must share this notice with them or their parent or guardian where appropriate.
2. Information we collect
Organizers provide an occasion, recipient or group name, event date, prompt, collection deadline, locale, timezone, and email. Birthday projects also include an age and whether it is a current or upcoming age. Organizers must sign in with Google, which supplies an account identifier, email, display name, and optional profile image.
Contributors do not need a Google login or Milestone Radio account. They use a private invitation and provide a display name, optional relationship, consent record, and one audio recording of up to 90 seconds. A recording may naturally reveal personal information about the speaker or another person. Do not submit unnecessary medical, financial, government-identifier, precise-location, or other highly sensitive information.
We also receive technical and service information such as file type and duration, upload and render status, browser and device details, approximate event time, IP-derived security data, request logs, and private-link use. We do not ask for an address book or guest email list.
Paddle handles checkout, tax, and receipts. We receive the order state, amount, currency, and transaction identifiers needed to reconcile delivery and support; we do not receive raw card details.
3. Purposes and legal bases
We process account, project, contribution, and order information to provide the service and perform our contract with organizers; to act on a contributor's request to submit or remove a recording; and to take steps requested before a purchase.
We rely on legitimate interests where appropriate to secure private links, prevent fraud and abuse, diagnose failures, improve reliability, and answer support requests. Those interests are balanced against the limited, private nature of the service. We rely on legal obligations for tax, accounting, consumer, fraud, dispute, and regulatory records. Where applicable law requires consent for a particular use, we ask for it separately and it may be withdrawn for future processing.
Voice recordings are used only to receive, validate, normalize, assemble, host, play, download, rebuild, and delete the private gift. We do not sell recordings or personal information, use them for targeted advertising, train AI models with them, identify a speaker biometrically, or infer health or other sensitive traits.
4. Access, sharing, and international processing
An organizer can see contributor names, manage inclusion and order, and access or download the finished radio. A recipient, and anyone given the private listening link, can hear the finished radio. Anyone holding a contribution link can submit while collection is open. Private links act as credentials and should be shared only with the intended people.
We use service providers only for the work they perform. Depending on the feature used, these include Alibaba Cloud for application delivery, hosting, database, and private object storage; Google for organizer sign-in; Paddle for checkout and payment support; and an email delivery provider when we send essential service messages. We may also disclose limited information to professional advisers, regulators, courts, or law enforcement when lawfully required, or in connection with a business reorganization subject to appropriate protections.
These providers may process information outside the country where it was collected. Where transfer rules apply, we use an available legal mechanism such as an adequacy decision or approved contractual safeguards. Contact us to request more information about safeguards relevant to your data.
5. Retention
| Information | Typical retention | Why |
|---|---|---|
| Original uploads | Queued for deletion 30 days after the first final render | Short recovery and rebuild window |
| Processed chapters and final MP3 | Hosted for 90 days, then queued for deletion | Private playback and download |
| Unpaid unfinished projects | Project details are redacted and associated audio is queued for deletion 30 days after the collection deadline | Short recovery without indefinite storage |
| Active and completed project metadata | Recipient, occasion, prompt, contributor, consent, status, and project-history records remain while the organizer account is active, including after hosted audio expires. A project deletion immediately replaces the main personal project and contributor fields and revokes private links. A second retention pass removes or redacts remaining project content 30 days after the completed deletion, once physical media cleanup is confirmed. Versioned consent evidence may remain linked to the organizer account until account deletion. | Library history, support, deletion evidence, and order delivery |
| Organizer account and profile | While the account is active, then deleted on account deletion except for required records | Sign-in, library, and account support |
| Essential email delivery records | Recipient address, subject, body, provider message identifier, and last error are purged 30 days after a message reaches a terminal sent or failed state. A minimal notification type, status, attempt count, and timestamps remain with the related account until account deletion. The email provider may keep its own delivery records under its documented retention rules. | Deliver essential links and hosted-expiry reminders |
| Security and diagnostic logs | Application operational events are deleted after 30 days; security events are deleted after 90 days. Alibaba Cloud and other infrastructure providers may retain their own access or security logs under separately configured provider periods. | Protect and troubleshoot the service |
| Payment and webhook integrity records | Order and transaction references, amount, currency, status, event identifiers, body hashes, and timestamps are not governed by the 30- or 90-day audio periods. No automatic deletion period is currently applied to processed Paddle webhook integrity records or the de-linked minimal payment ledger. They are preserved for payment reconciliation, tax, accounting, fraud prevention, disputes, consumer rights, and legal obligations until a legally reviewed period is adopted. | Reconciliation and legal obligations |
The 30- and 90-day periods above apply to audio and abandoned-project cleanup, not to every account, support, security, or transaction record. Those other records use the separate purpose-based criteria stated in the table.
Deletion is asynchronous and failed cleanup attempts are retried. Provider backups may persist for a limited recovery cycle before being overwritten. We may preserve information subject to a legal hold, active dispute, or binding legal requirement, and delete or de-identify it when that exception ends.
6. Cookies and browser storage
We use an essential session cookie for secure sign-in and browser storage for create-flow and checkout recovery. We do not currently use advertising or optional analytics cookies. The Cookie notice identifies each category, purpose, duration, and available control.
7. Your controls
A contributor receives a separate private removal link. Removing a voice before final render removes it from the project. Removing it later revokes the hosted version and queues a clean rebuild without that chapter where technically possible. A downloaded copy on another person's device cannot be remotely recalled.
Organizers can delete a project or permanently delete their account from the Account page. If payment confirmation is in progress, account or project deletion may be delayed briefly and can be retried after the transaction settles. A completed project deletion revokes that project's private links, redacts its personal project and contributor details, and queues associated audio for deletion. A completed account deletion also signs out sessions, deletes the local account, and removes the remaining project records. A minimal payment ledger may remain as described above. It is disconnected from the local account and project but may remain linkable to Paddle's transaction records for reconciliation, legal, fraud, tax, accounting, dispute, and consumer-protection purposes; it is not described as anonymous.
8. Privacy rights
Depending on where you live, you may have rights to know or access your information, receive a portable copy, correct it, delete it, restrict or object to processing, withdraw consent, and appeal a decision. You may also complain to your local privacy regulator. We do not discriminate against anyone for exercising a privacy right.
We do not sell personal information or share it for cross-context behavioral advertising, so there is no sale or targeted-advertising opt-out to exercise. We do not use solely automated decisions that produce legal or similarly significant effects.
Submit a request through Contact us. We may need to verify your identity or possession of the relevant private link. An authorized agent may submit a request where local law allows. We respond within the period required by applicable law.
9. Security and changes
We use administrative, technical, and organizational safeguards designed for the sensitivity of private voice content, including encrypted transport, restricted service access, role-specific random links, file validation, rate limits, and signature-verified payment events. No system is completely secure, so keep private links secret and contact us if one may have been exposed.
The service is intended for adult organizers and contributors, not for children to create accounts or submit recordings. We may update this notice when our service or legal obligations change. Material changes will be posted here and, where appropriate, communicated directly. The effective date above identifies the version in force.