Privacy policy

1Who we are

Lisnora FM is an English audio-story app, together with its website, lisnorafm.com. Both are run by Anvil Digital Labs, based in India. When this policy says “we”, “us” or “our”, it means Anvil Digital Labs.

We decide how your personal data is used, so we are responsible for it (the “controller” under laws such as the GDPR, and the “data fiduciary” under India’s data protection law).

At launch, the app is offered in Google Play and the App Store outside the European Economic Area (EEA), the UK and Switzerland. Wherever you live, you still have the GDPR-style rights described in section 10.

Questions about your privacy? Write to us at support@lisnorafm.com. A real person reads every message and usually replies within 2 business days.

2What we collect

Some information you give us, some the app sends while you use it, and some comes from Google or Apple when you sign in or buy something.

• Your account. There are no passwords. When you sign in with Google or Apple, we receive your name, email address and profile photo (if you have one). If you sign in with Apple and choose to hide your email, Apple gives us a private relay address instead of your real one, and our emails reach you through Apple.
• Guest mode. You can listen without signing in. A guest account has no name or email; it belongs to that phone, and so does its progress. If you link Google or Apple later, your guest progress moves into that account.
• Listening activity. The stories and episodes you play, how far you got, how many minutes you listen each day, what you unlock and how (free, ads, coins, Binge Pass or VIP), what you download, your library, and the stories you follow and rate. This keeps your place and syncs it across your devices. We also use your listening minutes to count your listening streak and the VIP free episode (a day counts when you listen 15 minutes or more), and how much of an episode you finished to check that the ad unlock for the next episode comes after at least 90% of it.
• Coins and rewards. Your coin balance and its history: purchased coins (everything a coin pack gives you, its bonus included), free coins from your listening streak and invites, when free coins expire, and what you spend coins on. If you invite a friend, or join through a friend’s invite, we also record who invited whom and the device the new account joined on, so the right people get the reward and invites can’t be faked.
• Purchases. Coin packs and VIP are paid for through Google Play or the App Store. We receive the order ID, the product, the date and the store’s receipt, so we can check the purchase is real and give you what you paid for. We never receive your card number or other payment details.
• Your device. Device model, operating system and app version; an install ID (a random code created when you install the app, which we use for the 3-device limit); a push token and a Firebase installation ID, so we can send the notifications you turned on through Firebase Cloud Messaging; and your IP address, which we use for security and to work out your approximate country.
• App and device checks. When you add a device, about once a day after that, and before purchases and rewards, the app asks Google Play Integrity (Android) or Apple App Attest or DeviceCheck (iPhone) to confirm that the app and the phone are genuine. It also looks for signs such as a rooted or jailbroken phone, an emulator or a modified app. The result decides which rewards that device can earn and which ways of unlocking episodes it can use.
• Protecting the stories. Episodes you play can carry an inaudible mark linked to your account, so if a copy is leaked we can tell which account it came from. We use it only to protect the stories.
• How you use the app. Which screens and features you use, and what you search for in the app. We use this to fix problems, improve the app and suggest stories.
• Ads data. In the free tier, your device’s advertising ID (on iPhone, only if you allow tracking) and ad events, such as an ad being shown or a rewarded ad being finished, through Unity LevelPlay. See section 4.
• Comments and reports. If you comment on an episode, we store the comment with your display name, and other listeners can see it. We also store the comments you like and your reactions to episodes. If you report a comment, we keep the report, and if you block another listener, we keep that block so their comments stay hidden from you.
• Support messages. What you send us by email or through the forms on our website, and our replies.
• Crash reports. If the app crashes, a report goes to our crash-reporting provider: what the app was doing, plus the device model, operating system and app version. We use it only to fix problems, and keep it for up to 90 days.

When you visit lisnorafm.com

The website has no ads and no advertising or analytics trackers, and it doesn’t use cookies to follow you around. Cloudflare, which runs the site for us, processes your IP address and basic browser details to deliver pages and block attacks, and it may set a cookie that is strictly needed for that security. If you send us a form (for support or to delete your account), we receive what you type into it, and Cloudflare Turnstile runs a quick check on your browser to make sure a person, not a bot, is sending it.

What we don’t collect

We don’t collect your precise location, contacts, photos or other files on your phone, microphone recordings, card or bank details, or government ID numbers.

3How we use it

• To run the app: sign you in, play stories, remember your place and sync it across your devices, and apply the 3-device and 1-stream limits.
• To give you what you unlocked or bought, and to keep your coin balance right.
• To send notifications you turned on, such as new episodes of stories you follow.
• To prevent fraud and abuse, such as fake purchases, bots, reward farming and leaked copies of stories, and to keep accounts safe.
• To find and fix crashes and other problems.
• To improve the app and suggest stories, for example by seeing which features are used and recommending stories based on what you listen to.
• To show and measure ads in the free tier, for example to confirm a rewarded ad finished so you get the reward.
• To answer your messages and handle requests about your data.
• To meet legal duties, such as keeping purchase records for tax and accounting.

We do not sell your personal data. Our fraud checks are automatic. If one ever blocks a reward or limits your account and you think it got it wrong, write to us and a person will look at it.

Our legal reasons (UK, EU and similar laws)

We use your data to provide the service you asked for (our contract with you); to keep it secure, prevent fraud, fix bugs, improve it and suggest stories (our legitimate interests, which we always weigh against your rights); to keep tax and accounting records (a legal obligation); and, where the law requires it, for personalised ads and push notifications (your consent, which you can withdraw at any time). If you are in India, we rely on your consent, which you can withdraw at any time, and on the uses Indian law allows without consent, such as meeting legal duties.

4Ads and tracking

Ads are what keep free listening free. In the free tier you may see:

• Rewarded videos, only when you choose to watch them, to unlock the next episode after you finish one. Ads never give coins.
• Banners on the Home and Now Playing screens.
• A full-screen ad between episodes, at most once every 3 episodes.

New listeners get an ad-free start for their first 10 episodes or 3 days. VIP members see no ads.

Our ad partners

We use Unity LevelPlay, which chooses which ad network fills each ad space (this is called mediation), and the networks it works with, including Google AdMob and Unity Ads. You can ask us for the current list of networks at any time.

These partners receive your advertising ID, IP address, device details and how you interact with ads. They use this to show ads, limit how often you see the same one, measure results and prevent ad fraud, and some may use it to personalise ads. They handle it under their own privacy policies: Unity and Google.

Your controls

If you turn personalisation off, you still see ads in the free tier; they just aren’t based on your activity in other apps and websites.

5Who we share it with

We share personal data only with the companies that help us run Lisnora FM, and only what each one needs:

• Cloudflare: runs our website, stores our audio and images, routes our email and protects the service from attacks.
• Hostinger: hosts our servers and database, in the USA.
• Google: Google Sign-In, Google Play billing, Play Integrity device checks, Firebase Cloud Messaging (which delivers our push notifications on Android and iPhone) and Gmail, where our support email is kept.
• Apple: Sign in with Apple, App Store billing, App Attest and DeviceCheck device checks, and delivery of push notifications to iPhones.
• Unity (LevelPlay) and the ad networks it uses, including Google AdMob and Unity Ads: showing and measuring ads (see section 4).
• Our crash-reporting provider: receiving crash reports so we can fix bugs.

We share data only with companies that give it the same or equal protection as this policy, and only for the purposes listed here. Google, Apple and our ad partners also handle the data they receive under their own privacy policies.

We also share data in two other cases:

• When the law requires it. We share data with the police, courts or other authorities only when we are legally required to, and only what is required.
• If the business changes hands. If Anvil Digital Labs or Lisnora FM is sold, merged or reorganised, your data may pass to the new owner, who must keep protecting it as this policy says. We will tell you before that happens.

Other listeners can see the comments you post and the display name shown with them.

6Where your data is stored

Our servers are in the USA (with Hostinger), Cloudflare stores and delivers files through its worldwide network, and we run Lisnora FM from India. So your data may be handled in the USA, India and other countries where our providers work, which may have different data protection laws from yours.

When data moves across borders, we rely on our providers’ data protection terms, including standard contractual clauses where the law calls for them, and we protect it as this policy describes wherever it is.

7How we keep it safe

• Encrypted in transit. The app and the website talk to our servers only over encrypted connections (HTTPS).
• Encrypted backups. Database backups are encrypted before they are stored.
• Limited access. Only the people who run Lisnora FM can reach personal data, only when their work needs it, and our admin tools sit behind sign-in checks.

No system is perfectly secure. If a breach ever puts your data at risk, we will tell you, and the authorities, as the law requires.

8How long we keep it

An account is deleted when its 7-day grace period ends, and its data is erased within the 7 days after that, so by day 14 after your request at the latest (see section 11).

9Children

Lisnora FM is not for children. You must be 13 or older to use it, or 16 where local law sets a higher age.

We don’t knowingly collect personal data from children under 13 (or under the higher local age). If you are a parent or guardian and believe your child has given us personal data, write to us at support@lisnorafm.com and we will delete it.

10Your rights and choices

Wherever you live, you can ask us to:

• See the personal data we hold about you.
• Correct anything that is wrong.
• Export a copy of your data in a common, machine-readable file.
• Delete your data and your account.
• Object to or limit how we use it (for example for ad personalisation), or withdraw consent you gave earlier.

How to ask: write to us at support@lisnorafm.com, ideally from the email linked to your account. To protect you, we may ask you to confirm the request is really yours, for example by signing in to the app. It’s free, we usually reply within 2 business days, and we complete requests within the time the law allows (one month in the UK and EU, 45 days in California).

Choices in the app and on your phone

• Notifications: turn them on or off in the app’s settings or your phone’s settings.
• Ad personalisation: see section 4, or choose VIP for no ads.
• Deleting your account: see section 11.

If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to the data protection authority where you live (in India, the Data Protection Board of India).

11Deleting your account

You can delete your account in two ways:

• In the app: Profile → Delete account.
• On the web, without the app: lisnorafm.com/delete-account.

After you ask, there is a 7-day grace period. Changed your mind? Just sign in again during those 7 days and the deletion is cancelled. When the grace period ends, your account is deleted, and we erase its data within the next 7 days (so by day 14 after your request at the latest). The only things we keep are purchase records without your name or email (up to 8 years, for tax and accounting) and support emails (up to 2 years). Encrypted backups roll off within 60 days.

Guest accounts have no email address, so the web form can’t find them. Delete a guest account in the app (Profile → Delete account) before you remove the app. If you have already removed it, write to us at support@lisnorafm.com and we’ll help if we can find the account. A guest account with no activity for 12 months is deleted automatically.

12US state privacy rights

If you live in California or another US state with a privacy law, this section gives you the extra details those laws ask for. Your rights are the same ones listed in section 10, and we honour them on the same request.

What we collect, and who receives it

Identifiers

Includes: name, email address, account ID, install ID, push token, Firebase installation ID, advertising ID, IP address.

Received by: our service providers (section 5); ad partners receive the advertising ID and IP address.

Commercial information

Includes: purchases (order ID, product, date, store receipt) and your coin history.

Received by: Google or Apple, which process the payment, and our hosting providers.

Internet or other electronic network activity

Includes: listening activity, follows and ratings, comments, likes and reactions, invites, what you search for and how you use the app, ads shown and tapped, crash reports.

Received by: our service providers; ad partners receive ad interactions.

Inferences

Includes: the kinds of stories you may like, worked out from your listening, and a fraud-risk level for your account and devices, worked out from the app and device checks.

Received by: our hosting providers.

Approximate location

Includes: your country, worked out from your IP address. Never your precise location.

Received by: our service providers; ad partners can work it out from your IP address.

Messages you send us

Includes: support emails, website form messages and comment reports.

Received by: our email and hosting providers.

We get this information from you, from your device, and from Google or Apple when you sign in or buy. We use it for the purposes in section 3 and keep it for the times in section 8. We don’t collect sensitive personal information (such as precise location, government IDs, financial account details or health data). We use your listening to suggest stories in the app, and automatic checks to spot fraud. You can ask a person to review any decision those checks make about your account.

“Selling” and “sharing”

We don’t sell your personal information for money, and we don’t give anyone our listener lists. But when the free tier shows ads, our ad partners receive your advertising ID, IP address and ad interactions, and some of them may use that for cross-context behavioural advertising (ads based on what you do across different apps and websites). California law can count that as “sharing”, and some other states treat it as “targeted advertising” or a “sale”. You can opt out at any time:

• On iPhone, don’t allow tracking; on Android, delete your advertising ID (see section 4). This stops ad partners getting the ID at all.
• Or write to support@lisnorafm.com with “Do not sell or share my personal information” in the subject. We will turn this sharing off for your account within 15 business days, and from then on the ads you see in the free tier won’t be based on your activity in other apps and websites.

Lisnora FM is for listeners aged 13 and over, and we don’t ask your exact age. If you are under 16, please turn off tracking on iPhone or delete your advertising ID on Android (see section 4), or write to us and we will turn this sharing off for your account. We don’t share personal information with anyone for their own direct marketing.

Agents, appeals and fair treatment

• Authorised agents: someone you choose can make a request for you. We will ask for proof that you gave them permission, and may ask you to confirm your identity.
• Appeals: if we turn down a request, you can appeal by replying to our answer. If you are still not satisfied, you can contact your state’s attorney general.
• No discrimination: we will never charge you more, give you a worse service or refuse you anything because you used your privacy rights.

13Changes to this policy

We will update this policy when the app or the law changes. The date at the top always shows the latest version. If a change is important, we will tell you in the app before it takes effect.

14Contact us

For anything about your privacy or this policy, write to us at support@lisnorafm.com. We are Anvil Digital Labs, India. A real person answers, usually within 2 business days.