Privacy policy
Learn how Hearfromyou collects, uses, shares, and protects your information.
Last updated: October 3, 2026
1. Summary at a Glance
This summary is a plain-language overview. It is not a substitute for the full policy below, which is what actually applies.
- No accounts. You do not need to sign up, log in, or give us your name or email to browse or publish a cassette.
- Published cassettes are public and permanent. Anyone with the link, and anyone browsing or searching the site, can see the recipient name, title, message, and music of a published cassette. Users cannot delete them. Please read Section 10 before you publish.
- Drafts and your personal archive stay on your device. Your drafts and your Recurring Names / My Archive record live in your browser and are never sent to our servers (Section 7).
- We use a small set of services to run the site: Cloudflare (hosting, security, bot protection), Google Analytics (usage statistics), Apple iTunes Search and YouTube (music), Meta and Gemini (content moderation), and Redis (rate limiting). See Section 8.
- Moderation is partly automated. The message, title, and recipient name of a cassette are sent to automated moderation tools when you submit. We do not store the results (Section 9).
- We do not sell your personal information. We do not show ads today, but we are planning to in the future. We will update this policy before we do (Sections 6.3 and 20).
- You can contact us about your privacy at [email protected] (Section 24).
2. Introduction and Scope
Hear From You ("we," "us," "our," or "Company") operates the Hear From You website at www.hearfromyou.xyz (the "Service"), a digital cassette tape archive where people can create, publish, and browse cassettes made for others. We are based in the Philippines.
This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and what choices and rights you have. It applies to everyone who visits or uses the Service, including people who only browse and people who create and publish cassettes. It covers the pages of the Service, including Browse, Recurring Names, My Archive, Support, Submit, individual cassette pages, and our About, Terms of Use, and Privacy Policy pages.
This policy should be read together with our Terms of Use, which sets out the rules for using the Service. If the two ever conflict on a privacy matter, this Privacy Policy controls.
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.
3. Information We Collect
We aim to collect as little personal information as possible. No user accounts or registration are required to use Hear From You. The information we handle falls into the categories below.
3.1 Information you provide
- Cassette content: when you publish a cassette, we store the recipient name, the cassette title, the message you write, and your music selection, along with the design choices you make for the cassette (for example its edition, model, and colors). Anything you include in these fields is provided voluntarily by you.
- Reports: if you report a cassette, we record that a report was made against that cassette so that we can count reports and act on them.
- Messages to us: if you contact us by email or social media, we receive your email address or account handle and whatever you choose to tell us, such as a cassette link and the reason for your request.
3.2 Information collected automatically
- Usage and device data: through Google Analytics, we receive information such as the pages you visit, how long you stay, how you arrived at the site, your approximate location (such as country or city), your browser and operating system, screen size, and device type.
- IP addresses: we use your IP address to apply rate limits that protect the Service from spam and abuse. IP addresses are also processed by Cloudflare and Google Analytics as part of their services.
- Server and security logs: our hosting and security providers may record technical information about requests made to the Service, such as timestamps, requested URLs, and error information.
- Bot-protection signals: when you submit a cassette or report, Cloudflare Turnstile may collect limited browser and interaction signals to tell real visitors apart from automated traffic.
- Search terms: when you search the archive (for example for a name or a title), your query is used to return results. Search queries may also appear in analytics or server logs as part of the page address.
3.3 Information from third-party music services
When you choose a song for a cassette, the song search runs through the Apple iTunes Search API and YouTube API Services. We receive song information such as the title, artist, artwork, and a preview or video reference, and we store the music selection you chose with your cassette. When a visitor plays a cassette, music may be streamed from these providers (see Section 8).
3.4 Information stored on your device
Some information is kept only in your own browser and is never sent to us. This is described in detail in Section 7.
3.5 What we do not collect
We do not ask for your name, email address, phone number, or payment details in order to use the Service, and we do not knowingly collect sensitive personal information from you. Please do not include sensitive information, such as government ID numbers, financial details, health information, or private contact details, in a cassette.
4. How We Use Your Information
We use the limited information we collect for the following purposes:
| Purpose | Information involved |
|---|---|
| Display, host, and maintain published cassettes and make them accessible through their shareable links | Cassette content, design choices, music selection |
| Let visitors browse, search, and play cassettes, including the music associated with them | Cassette content, search terms, music provider data |
| Review submitted content for policy violations and keep the platform safe | Message, title, and recipient name (sent to moderation tools) |
| Protect the Service against spam, bots, scraping, and abuse, including through rate limiting | IP address, bot-protection signals, server logs |
| Handle reports and hide cassettes that receive multiple reports | Report counts per cassette |
| Understand how the Service is used, so we can fix problems and improve features and performance | Analytics and device data |
| Respond to your questions, requests, and privacy concerns | Email address or social handle and message contents |
| Comply with legal obligations and establish, exercise, or defend legal claims | Any of the above, where legally required or necessary |
We do not sell your personal information. As of the date of this policy, we do not use it to build advertising profiles. If that changes, we will update this policy first (see Section 20).
5. Basis for Processing and Consent
We process personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules. Depending on the situation, we rely on:
- Your consent, which you give when you choose to publish a cassette or continue using the Service after reading this policy
- Our legitimate interests in operating a safe, secure, and reliable service, preventing abuse, and understanding how the Service is used
- Legal obligations, where we are required by law or lawful order to retain or disclose information
Where we rely on your consent, you may withdraw it at any time by contacting us, subject to the limits described in Section 10 on published cassettes.
7. Data Stored in Your Browser
Part of the Service works entirely on your device. This information is stored in your browser, is not tied to an account, and is not sent to our servers unless stated below.
| What | Where it is kept | Why | Sent to us? |
|---|---|---|---|
| Cassette drafts | Your browser's local storage | So you can come back to a cassette you have not published yet | No, not unless and until you choose to publish |
| A record of the cassettes you have created | Your browser's IndexedDB storage | To power the Recurring Names and My Archive pages | No |
| Cassettes and tracks you view or play | Your browser's storage and cache | To load pages and playback faster and keep the experience smooth | No |
Because this information lives only on your device, we cannot see it, restore it, or move it for you. Clearing your browser data, using a different browser or device, or using private browsing will erase or hide it. Your drafts will be gone permanently. Your My Archive record will be gone too, although the cassettes themselves remain published and accessible by their links.
You can delete this information at any time by deleting drafts and records within the Service where available, or by clearing site data for www.hearfromyou.xyz in your browser settings.
If you share a computer or browser with other people, they may be able to see your drafts and your My Archive record. Consider clearing site data when you finish using a shared device.
8. Third-Party Services
We rely on the following third-party services to operate the Service. These providers may collect and process personal data, such as your IP address, device information, or the content you submit, under their own terms and privacy policies.
- Cloudflare – Provides infrastructure, hosting, and security for the Service, including Cloudflare Turnstile for bot protection and Cloudflare Workers for serverless computing. Cloudflare's privacy policy.
- Google Analytics – Provides website analytics so we can understand how the Service is used. Google's privacy policy.
- Apple iTunes Search API – Used to search for and retrieve music information and previews when you choose a song for a cassette. Your search terms may be sent to Apple to return results. Apple's privacy policy.
- YouTube API Services – Used to search for and play music. By using features powered by YouTube, you are also agreeing to be bound by the YouTube Terms of Service, and your use of those features is subject to the Google Privacy Policy. Playing a YouTube video may cause YouTube to collect data such as your IP address and viewing activity.
- Meta & Gemini Services – Used to help review user-submitted content for potential policy violations, maintain platform safety, and support certain platform features. See Section 9 for what we send. Meta's community standards and Gemini's use policy.
- Redis – Used to keep short-lived counters tied to IP addresses so we can enforce rate limits and prevent abuse.
- Social platforms (TikTok and Instagram) – We maintain pages on these platforms. If you follow, message, or interact with us there, that platform's own privacy policy applies to that activity.
These third parties maintain their own privacy policies, which govern their data collection and processing practices. We encourage you to review them. We are not responsible for the privacy practices of third-party services.
9. Content Moderation
To keep Hear From You safe, cassettes are reviewed for potential policy violations, such as harassment, hate speech, sexual content, or other harmful material. This review uses automated tools provided by Meta and Gemini.
For this purpose, the message, title, and recipient name of a cassette are sent to these moderation services. We do not send anything else, and we do not store the results of the moderation review.
Moderation works in two layers: automated review when you submit, and community reporting after publication (see Section 11). Neither layer is a guarantee that every cassette is safe or appropriate.
Automated moderation is not perfect. Some content that violates our rules may not be caught, and some acceptable content may be flagged in error. If you think a cassette was wrongly blocked or should have been blocked, please contact us or use the reporting feature.
10. Public Cassettes
Once a cassette is published on Hear From You, it becomes publicly accessible via a shareable link and may appear in browsable areas of the site, including search results and name-based discovery. Any information included in a published cassette (including the recipient's name, the title, the message content, and the music selection) may be viewed, copied, shared, indexed by search engines, and potentially used by others.
Published cassettes are permanent and cannot be deleted by users. Because we do not use accounts, we cannot verify who created a cassette, and we cannot remove one on request except as described in Section 11. Please think carefully before you publish, and do not include information you would not want to be public permanently.
10.1 What anyone can see
- Anyone with the cassette link, with no login required
- Visitors browsing the archive or searching by name or title
- Search engines and other automated services that index public web pages, which may keep copies or snippets even after a cassette is hidden
- Anyone you or the recipient share the link with, including on social media
10.2 Before you publish: a short checklist
- Use a first name, nickname, or initial for the recipient rather than a full name, if you can.
- Leave out phone numbers, addresses, social handles, school or workplace names, and other details that could identify or locate someone.
- Do not include government ID numbers, financial details, or health information.
- Think about how the recipient, or anyone who might recognize themselves in your message, would feel reading it in public.
- Remember that you cannot edit or delete the cassette after you publish it.
10.3 If you are named in a cassette
If you find a cassette that names you or includes your personal information and you did not agree to it, you can report it or contact us (see Sections 11 and 17). We will take requests involving private information, safety concerns, and rule violations seriously.
10.4 Your responsibility toward others
If you include another person's name or personal details in a cassette, you are responsible for making sure you are allowed to do so. Please be considerate of the people you mention.
11. Reporting, Hidden Cassettes, and Removal Requests
Anyone can report a cassette that they believe is inappropriate, harmful, or violates the rules of the Service, using the reporting feature. When a cassette receives more than three reports, it is automatically hidden from the platform.
Automatic hiding is a safety measure and is not a finding that a cassette broke any rule. We may review hidden cassettes, restore them, or keep them hidden, and we may retain hidden cassettes on our servers where needed for safety, abuse prevention, or legal reasons.
11.1 When to use the report button and when to email us
| Situation | Best route |
|---|---|
| A cassette is rude, spammy, or breaks the rules | Use the reporting feature on the cassette |
| A cassette exposes your private information (for example a phone number or address) | Email us right away with the cassette link |
| A cassette threatens your safety or someone else's | Email us right away with the cassette link. If anyone is in immediate danger, contact local emergency services first. |
| A cassette uses your name and you want it reviewed | Email us with the cassette link and explain your concern |
11.2 What we may do
After reviewing a report or request, we may:
- leave the cassette as it is,
- hide the cassette from the platform,
- remove or restrict the cassette where it contains private information, creates a safety risk, or violates our rules, or
- ask you for more information to help us find or assess the cassette.
Because published cassettes are meant to be permanent, we do not promise to delete a cassette just because someone asks. We do consider each serious request on its merits.
13. International Data Transfers
We are based in the Philippines, but the providers we use, such as Cloudflare, Google, Apple, and Meta, operate globally. As a result, your information may be processed or stored in countries other than your own, including countries whose data protection laws differ from those in your country. We take reasonable steps to work with providers that maintain appropriate safeguards. By using the Service, you understand that your information may be transferred and processed in this way.
14. Data Retention
We keep information only for as long as it is needed for the purposes described in this policy:
| Information | How long we keep it |
|---|---|
| Published cassettes (recipient name, title, message, music selection, design choices) | Indefinitely, to maintain their permanent nature |
| Hidden cassettes | Kept on our servers for as long as needed for safety, abuse prevention, or legal reasons |
| Local drafts and your Recurring Names / My Archive record (in your browser) | On your device only, until you clear your browser data or delete them |
| Rate-limiting counters (IP-based, in Redis) | Only as long as needed to apply rate limits and prevent abuse |
| Moderation results | Not stored by us |
| Analytics data | According to the retention settings we configure in Google Analytics and Google's policies |
| Server logs and security data | As needed for service improvement, security, and troubleshooting, and as long as required by law |
| Emails and messages to us | As long as needed to respond and keep a record of the request |
When information is no longer needed, we delete it or de-identify it where reasonably possible. Some copies may remain for a limited time in backups or with third-party providers under their own retention practices.
15. Data Security
We implement appropriate technical and organizational measures to protect the data we maintain against unauthorized access, alteration, disclosure, or destruction. These include using secure connections (HTTPS), bot and abuse protection, rate limiting, and limiting access to our systems.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to use industry-standard protections, we cannot guarantee absolute security. Content in published cassettes is public by design and is not protected by these measures.
You can help protect yourself by not putting sensitive information in cassettes, by keeping your browser and device up to date, and by being careful about who you share cassette links with.
If a security incident affects your personal data in a way that creates a real risk of serious harm, we will notify affected individuals and the relevant authorities as required by applicable law, including the Philippine National Privacy Commission.
16. Your Rights and Choices
Under the Philippine Data Privacy Act of 2012, you have the following rights regarding your personal data, subject to the exceptions and limits allowed by law:
- Right to be informed about how your personal data is collected and processed, which is the purpose of this policy
- Right to access the personal data we hold about you
- Right to object to processing of your personal data, including where we rely on consent or legitimate interests
- Right to rectification of inaccurate or incomplete personal data
- Right to erasure or blocking of personal data that is unlawfully obtained, no longer necessary, or used in violation of your rights
- Right to data portability where applicable
- Right to damages if you are harmed by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data
- Right to file a complaint with the Philippine National Privacy Commission (privacy.gov.ph) if you believe your data privacy rights have been violated
In addition, you can:
- Delete local drafts, and your Recurring Names / My Archive record, from your device at any time
- Clear or block cookies through your browser settings, and opt out of Google Analytics using Google's opt-out add-on
- Report inappropriate cassettes through the reporting feature
- Request information about data we maintain regarding you
- Contact us with privacy concerns or requests
These rights have limits. For example, because we do not use accounts, we may not be able to confirm that a cassette was written by you, and because published cassettes are permanent, we may decline to delete them (see Sections 10 and 11).
17. How to Make a Request
Email is the best way to make a privacy request. Here is how to make it easy for us to help you:
- Email [email protected] with a clear subject line, such as "Privacy request" or "Cassette removal request."
- Include the link to the cassette you are asking about. Each cassette has its own link, which helps us find it quickly.
- Tell us what you are asking for (for example access, correction, objection, or review of a cassette) and why.
- If your request is about private information in a cassette, describe which part of it is private. Please do not send us extra sensitive documents unless we ask.
- We may ask you for more details to verify your request or to confirm that the cassette relates to you.
We will respond within a reasonable time. Because cassettes are published without accounts, we may not be able to confirm who wrote a cassette. Because published cassettes are permanent, we may decline to delete them, but we will consider requests that involve your own private information, safety concerns, or content that violates our rules.
If you are not satisfied with our response, you also have the right to complain to the Philippine National Privacy Commission (see Section 16).
18. Visitors From Outside the Philippines
The Service can be accessed from anywhere, and we handle personal data in the same way for all visitors. If you live in a region with its own privacy laws, such as the European Economic Area, the United Kingdom, or California, you may have additional rights, such as the right to access, correct, delete, or restrict the use of your personal data, or to object to its processing.
You can exercise these rights by contacting us. We do not sell personal information and do not share it for cross-context behavioral advertising. Please note that we may be limited in what we can do for published cassettes, as explained in Section 10.
19. Children's Privacy
Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information from our servers. If you believe that we might have any information from or about a child under 18, please report it or contact us.
20. Advertising
We may incorporate advertising into the Service, for example through Google AdSense, to help keep the Service free. Before we do, we will update this Privacy Policy to explain which advertising partners are involved, what information they collect, and how you can opt out. See Section 6.3 for how advertising cookies would work.
When ads are introduced, we expect to:
- update this policy and the "Last updated" date before ads go live,
- list the advertising partners and the cookies or identifiers they use,
- ask for your consent where the law requires it, and
- give you clear ways to opt out of personalized advertising.
Until we do, the statements in this policy about not building advertising profiles apply to the Service as it currently operates.
21. Links to Other Websites
The Service may contain links to other websites, such as our social media pages, music platforms, or the third-party sites listed above. We do not control these sites and are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any site you visit.
22. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after any modifications constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.
Examples of changes we would consider material include starting to show advertising, adding a new service provider that receives your information, changing what we send for moderation, or changing how long we keep information.
23. Frequently Asked Questions
Answers to common questions about privacy, cookies, drafts, My Archive, published cassettes, and reporting are on our FAQ page. The FAQ is a friendly guide only. If it ever differs from this Privacy Policy, this Privacy Policy applies.
24. Contact Us
If you have any questions about this Privacy Policy or our privacy practices, or if you want to make a request about your data, you can contact us through:
- Email: [email protected]
- TikTok: @hearfromyou.xyz
- Instagram: @hearfromyou.xyz
Email is the best way to reach us for privacy requests. Social media messages may take longer to reach the right person, and public comments are not a safe place to share personal information.