Privacy Policy

Effective October 22, 2026

Aerial Radio is made by Benjineering Labs LLC ("we", "us"). This policy covers the Aerial Radio app for iPhone and CarPlay and this website. Aerial Radio was called Emberwave until October 2026.

What stays on your devices

These are stored on your iPhone and synced only through your own private iCloud database, which we can't read:

• Your stations and playlists, including their names, prompts, photos and settings.
• What you played and how it went: plays, skips, replays, likes, dislikes, bans, favorites and skip reasons.
• The scores and learned weights the app builds from that history to choose better songs.
• Your profile, if you fill it in: birthday, gender, a short personality quiz, artists you loved growing up, where you grew up, music at home, instruments you play, languages you understand and how much lyrics matter to you.
• Sound measurements the app takes from Apple Music previews on your device.
• New releases suggested for your playlists, waiting to be added (this iPhone only, not synced; they expire after 30 days).

If you choose "Learn from my library", the app reads your Apple Music library (songs, play counts, ratings) on your device to get a head start on your taste. That summary stays on your device; pick requests carry a sample of its songs and the names of its artists (see below).

If you choose where to look for concerts (Settings > Concerts > Shows near), that choice stays on this device and isn't synced: either your approximate location (the app asks for it only when you pick "Near me", with reduced accuracy, rounded to about a kilometre) or a city you type. A typed city is looked up with Apple Maps, so the text you type goes to Apple. The app sorts an artist's shows by distance on your device.

So it can pick up where you left off after it closes or updates, the app remembers what you were playing: the station, playlist or song, how far into the song you were, and the songs a station had already picked to play next. That stays only on this device and isn't synced. So the car can play before you first unlock your iPhone after a restart, a small copy of the last station (its name, prompt and dials, a few Apple Music song ids and how far into the song you were) is kept where the iPhone can read it before that unlock; it holds nothing else, and Delete my data removes it.

What the app sends to our server

Picking songs happens on our server. When a station or playlist needs songs, the app sends a request with what's needed to choose them well:

• The station or playlist: its prompt, name, intensity and discovery settings, Sound settings, the genres you chose to mix in or keep out, the short description of its photo, its learned weights, and songs it played recently, is playing or has queued next (titles and artists).
• Your taste: the genres you chose to mix in or keep out everywhere (Settings > Genres), favorite artists, banned artists, recent dislikes and the reasons you gave, a sample of songs and artists from your library, the artists you already know (up to 300 names, from your favorite artists, favorite songs, library and what you've played in Aerial Radio) so the Discovery setting can mix artists you know with new ones, a summary of which vibes, artists, decades and tempos you like or don't, and the songs played in this listening session with how each one ended.
• Your profile, only while "Use my profile for picks" is on: your age (never your birthday), gender or your own description, zodiac sign, the decades you grew up in, your personality scores and the other profile answers listed above.
• Your Apple Music storefront (country), so the songs exist where you are.

When you add a photo to a station or playlist, the photo is sent once, to Anthropic only, so Claude can describe its feel in a sentence and a few vibes. Only that description is kept, on your device; the photo is not stored on our server.

When a song has an Apple Music video and videos are on for it, the app sends the song's title, artist, album, length and its tags (energy, tempo and where its sections start) and a few numbers measured on your iPhone from its 30-second preview (tempo, loudness, how much drums there are), so Claude can estimate when the song kicks in and the silent video can start with the music. It carries nothing about you, and the estimate is kept on our server for that song, shared by everyone, not linked to you. Finding a song's video, downloading its preview clip and opening the full video in Apple Music happen between your iPhone and Apple.

While a station looks for a song, Listen shows short, playful lines ("Warming up the tubes…"). Most are built into the app. Every few days, while a station is playing, the app may also ask for lines written for that station: the request carries the station's name, prompt, the genres you chose to mix in or keep out and the vibes read from its photo, and nothing else about you or your listening. Claude writes the lines; our server sends them back without keeping them, and the app keeps them with the station (so they sync through your iCloud like its other settings). Turning off "Use AI to pick songs" stops these requests.

For a playlist with "Add new releases" on that you played or edited in the last three weeks, about once a day (also while the app is in the background), the app sends a request for a few songs released in the past year: the playlist's prompt, name, settings and photo description, its songs (titles and artists), the songs liked and disliked in it, the songs it suggested for that playlist before, and your taste as listed above. Suggestions wait on your iPhone, not in iCloud, until one is added to the playlist (at most one a day); a song added this way, with the short reason it was picked, syncs with the playlist. Removing one counts as a dislike in that playlist. Turning off "Add new releases" for a playlist, or "Use AI to pick songs", stops these requests.

About once a day, the app may send a summary of how its scoring has been working (how strongly each kind of feature, such as tempo or mood, separated songs you liked from songs you skipped, per station) so Claude can suggest better weights. It includes your station names and prompts, but no song titles.

When you open an artist's page, the app asks our server for that artist's upcoming shows with only the artist's name and Apple Music id: never your location, history or anything about you. The About text on artist and album pages is Apple Music's own, read on your device from Apple.

A Blend station (one made from someone's shared taste) also sends that person's taste summary, as described under "Sharing" below, with each of its requests.

Requests are tied to an anonymous key that Apple's App Attest creates on your device to prove the request comes from the real app. It isn't linked to your name, email or Apple Account.

Sharing stations, songs and your taste

You can share a station, a playlist or your taste as a link. Everything those links carry is inside the link itself, in the part after the "#", which browsers never send to a server, so we never receive it when someone opens it. A song link works differently, as described below.

• Sharing a station puts its name, prompt, the short description of its photo (not the photo), its kickoff song, its intensity and discovery settings and its Sound in the link, and your first name if you've added one in About you. Not its likes, history or what it has learned.
• Sharing a playlist puts its name, prompt, the short description of its photo (not the photo), its intensity and discovery settings, its genres and its songs in order (each song's Apple Music id, title and artist; a very long playlist shares its first songs) in the link, and your first name if you've added one in About you. Not its likes, plays or what it has learned. Adding it saves a copy of your own; Play plays it without saving.
• Sharing your taste (Settings > Share my taste) puts a short summary in the link: artists, genres and vibes you like most, the decades you lean toward, the typical energy of what you love, and, while "Use my profile for picks" is on, the artists you grew up on, the languages you understand and how much lyrics matter to you. Plus your first name if you choose. Never your birthday, age, gender, sign, personality answers, plays, skips or song titles. The app shows you exactly what's in it before you send it.
• Sharing a song (Share in a song's menu) makes a link like aerialradio.app/song/us/1440935808: your Apple Music storefront (country) and the song's Apple Music id, nothing else. Not your name, the station or playlist it played in, or anything about you. Because the song is in the address, opening the link without the app asks our server for the song's page, as described under "Shared song pages" below. With Aerial Radio installed, the link opens the app, which looks the song up in Apple Music on the phone.
• A Blend station made from someone's taste link keeps their summary with that station, on your devices and in your iCloud like your other stations. Its pick requests send their summary with yours, so the AI services described below process it too. Remove it any time in the station's settings.

Anyone you send a link to can pass it on, and the page at aerialradio.app shows what's in it to whoever opens it. Share links the way you'd share a playlist.

Shared song pages

The page at a song link shows the song's title, artist, album and art, plays Apple's 30-second preview straight from Apple, and lists where else the song is (Apple Music, Spotify, YouTube Music and others). To make it, our server looks the song's id up in the Apple Music catalog, then, once per song, asks MusicBrainz, an open music database, which other services have it, by the song's ISRC (a standard code for the recording). Nothing about the person who shared it or opened it is sent. Where no service is known, the page links to a search for the song's title and artist on that service instead.

The page counts that it was viewed and which service's button was tapped (never which song, and never who), in our own usage stats. It has no ads, trackers or third-party scripts; its font comes from Google Fonts, like the rest of aerialradio.app.

Party mode and shared playlists

You can open the station you're playing as a party, or share a playlist with guests, so friends add songs from their phone's browser at aerialradio.app without the app or an account.

• What the owner's app sends. While you share, our server keeps the station's or playlist's name, your first name if you've added one in About you, your Apple Music storefront (so guests search the songs you can play), and what guests see: the song playing, what's up next and what has played since sharing started (each song's Apple Music id, title, artist and artwork, and who picked it), and for a playlist its songs. If the station or playlist has a photo, a small copy of it is kept too and shown on the join page to anyone with the link, before they join (remove the photo and it's removed there). A 4-digit PIN, when you turn it on, is kept only as a one-way scrambled form (the app keeps the PIN itself on your device to show you). When you share the link with the PIN, the PIN travels inside the link, so anyone who has that link can join; share the link only (without the PIN) to keep the PIN separate.
• What guests send. A display name they choose (others in the share see it), the PIN if there is one, their song searches (sent to Apple Music to find songs, not kept), the songs they add, remove, move or give a thumbs up, and a random id their browser makes so you can block that browser. With "Verify emails" on, they also give an email address: we send it a one-time sign-in code through Amazon Web Services (Amazon SES), and keep the address with that guest so the owner can see who is who and remove or block them. Emails are used only for sign-in codes and blocking, never for marketing, and never shown to other guests. Our server also uses a scrambled form of the guest's IP address to limit wrong PINs and code emails; the address itself isn't stored.
• What the owner sees. Each guest's display name and, when verified, their email, when they joined, the songs they picked and how many played, and (for a playlist) what each guest added, removed or moved.
• How long it's kept. Guests' names, emails, songs, the photo and the shared state are deleted when the owner stops sharing or ends the party, and a party ends by itself 3 hours after its station last played. A guest can leave at any time: their place in the share is deleted then, and songs they added keep their name until the share ends. A playlist share stays open until its owner stops it (its data expires 180 days after the owner's app last used it). If the owner blocks someone, the block keeps that guest's name and email (or browser id) and a one-way scrambled form of the email while the share exists, so they can't rejoin, until the owner unblocks them, clears the list or deletes the share. "Delete my data" deletes every share you own.
• Your taste. Songs guests add never count toward what Aerial Radio learns about you or uses to pick songs, and History marks them as added by a guest.
• Song previews. The guest page plays Apple's 30-second song previews straight from Apple, with a link to the song on Apple Music. We don't store or relay the audio.

Who processes those requests

• OpenAI. Our server sends the song request described above to OpenAI's API, and an OpenAI model suggests songs. Requests are sent with OpenAI's storage turned off, and OpenAI does not train its models on API data; it may keep API data for up to 30 days to detect abuse, then deletes it.
• Anthropic (Claude). Our server sends the same request to Anthropic's API, where Claude reviews the suggested songs (and suggests songs itself when OpenAI can't answer), describes station photos, tags songs, estimates when songs kick in, writes the lines shown while a station looks for a song and proposes scoring weights. Anthropic processes this data under its commercial terms, which do not allow it to train its models on it.
• Apple. Our server looks up song titles and artists in the Apple Music catalog to make sure each pick exists. Playback, your Apple Music subscription, iCloud sync and App Attest are provided by Apple under Apple's own privacy policy.
• MusicBrainz (the MetaBrainz Foundation). For a shared song's page, our server sends MusicBrainz the song's ISRC, and nothing about you or whoever shared or opened it.
• Ticketmaster. For upcoming shows, our server sends Ticketmaster's Discovery API the artist's name, and nothing about you, then the matching Ticketmaster artist id to list their events. When you tap Tickets, the event opens on Ticketmaster's site in Safari, under Ticketmaster's own terms and privacy policy; the link may carry a tag saying you came from Aerial Radio (an affiliate link), which lets Ticketmaster credit us for a purchase. We never see what you buy.
• Amazon Web Services. Our server runs on AWS in the United States.

What our server keeps

Our server is built not to keep anything about your taste or history:

• Requests are not saved. A request that takes longer (a full set of songs, or the daily weights summary) is held only until it finishes, and its result is deleted within 24 hours.
• We keep the anonymous App Attest key for your device and daily usage counts (how many requests and how much processing), so the service can be metered and protected from abuse. To keep any one account from asking for too many songs at once, we also keep the times of its requests for songs from the last hour; they expire on their own after that hour.
• We keep facts about songs, such as their tags, Apple Music ids and when they kick in, shared by everyone and not linked to you.
• We keep each shared song's page details (the song as Apple Music lists it, and where else it is) for 30 days, shared by everyone and not linked to who shared or opened it. The pages themselves are cached for a day.
• We keep each artist's upcoming shows for 6 hours (or that none were found, for 24 hours), shared by everyone and not linked to you or to who asked.
• For the free plan (2 hours of radio a month and up to 4 stations or playlists) and Unlimited: an anonymous App Store id for your purchases (Apple's app transaction id, which says nothing about who you are), how many seconds of AI-picked songs played this month, how many stations and playlists you've made on the free plan (a count, kept until you delete your data, never what they are), and, if you subscribe, which plan and when it renews or ends. Usage counts are kept per month for up to 400 days. Apple also tells our server when a subscription is refunded, so it stops counting as active.
• For party mode and shared playlists, what's described under "Party mode and shared playlists" above, for as long as described there.
• Logs record request ids, timings, counts and error codes for 14 days. They never contain your prompts, songs or profile.
• For each request we record how well picking went: how many songs were suggested, found in Apple Music and kept after review, how many rounds it took, which model answered, how many tokens it used, what it cost and how long it took. These quality numbers carry no device key, no request content and no songs, so they can't be tied to you.

Anonymous usage stats

While "Use AI to pick songs" is on, the app sends anonymous usage stats to our own analytics server (on AWS, run by us, not a third-party analytics company), so we can tell whether stations pick songs you like and how quickly they start:

• When a station starts: whether it's one of yours, a preset (and which) or a workout.
• How each song ended: played through, skipped or stopped, how much of it you heard, the skip reason you picked (such as "Too slow"), and whether it came from a station or a playlist.
• That you liked, loved, disliked or banned something, and where (a station, a playlist or everywhere).
• That you watched a song's music video instead of the song, how much of the video, and whether the song came from a station or a playlist.
• How long the first song took to start, how long a skip waited for the next song, and when the app picked up where you left off.
• That the Unlimited screen opened, that a free trial or subscription started (monthly or yearly), that a purchase didn't complete, that Restore Purchases ran and whether it found one, and that the free month's AI listening ran out. Never a price, a receipt or a transaction id.
• That an About note was expanded (on an artist or album page), how many upcoming shows an artist page listed and how many were near you (a count, never where), and that a ticket link was opened (and whether the show was near you). Never which artist or show.
• That a new release was added to a playlist, removed (and how many days after it was added) or played through while it was still new. Never which song or playlist.
• That a song was shared and where in the app (Listen, History, an album or artist page, search or a playlist), and that a song link was opened and whether Apple Music has the song where you are. Never which song.
• That a playlist was shared or a playlist link was opened, how many songs the link held and whether that was only the playlist's first songs. Never which playlist or songs.
• That an hourly limit on skips, new stations or new playlists was reached, and whether the app or our server applied it.
• That a party or shared playlist started or ended (and whether it asked for a PIN or verified emails), how many guests joined and how many songs they added. Never names, emails, songs or which station or playlist.
• Which look (Afterglow or Hearth) and motion level you picked in Settings > Appearance, when you change them.
• That you used a control in the Apple Watch app (such as play, skip or thumbs up), and which one. Never which song or station. Everything else between the watch and your iPhone stays on the two devices.
• Whether you were on your iPhone or in CarPlay, the onboarding steps you finished, and the app and iOS version.

They're tied to a random id made on your device (only a scrambled version of it is sent), not to your Apple Account, your iCloud data or the App Attest key. They never include song titles, artists, station names, prompts, photos, profile answers or anything you type. Turn them off with "Use AI to pick songs" in Settings > AI & privacy. Individual stats are kept for 90 days, and the date the anonymous id was first seen for about 13 months; daily totals (counts, not individual stats) are kept.

What we don't do

• No advertising, and no third-party ad or analytics SDKs in the app. The anonymous usage stats above go only to our own server.
• No tracking across other companies' apps or websites.
• No selling or sharing of your data for anyone's marketing.
• No location on our server. The app asks for your approximate location only if you choose "Near me" for concerts, and it never leaves your device.

Subscriptions

If you subscribe, Apple handles the purchase. We never see your payment details; Apple tells the app only whether your subscription is active.

Your choices

• Aerial Radio asks before it first sends anything to OpenAI or Anthropic. You can turn that off in Settings > AI & privacy; stations then play only from your library and what you've heard before.
• Turn off "Use my profile for picks", or clear your profile, in Settings > About you.
• Delete a station, playlist, like, dislike or play in the app; deletions sync to your other devices through iCloud.
• Delete my data in Settings > AI & privacy deletes everything at once: on this iPhone (stations, playlists, history, likes, dislikes, bans, photos, your profile, the library summary, where you left off, the app's settings and diagnostics), in your iCloud (the whole Aerial Radio zone, so your other devices delete their copies too instead of syncing it back), and on our server (your device's App Attest key, its daily usage counts, its link to your anonymous App Store id, that id's monthly free-listening counts and its count of stations and playlists made, any request still being held, and test captures). Wake-up alarms are cancelled. The app then starts over as if newly installed, with a new anonymous id for usage stats. It doesn't touch Apple Music, workouts saved in Apple Health, the app's permissions or your subscription: that's with Apple, and when you turn AI picks back on the app links it again (which stores a new link). If Apple refunded a subscription, our server keeps the note that that purchase was refunded (Apple's transaction id and the date, nothing else) so it can't count as active again; once the link is deleted nothing ties it to you, and later messages from Apple about that purchase only update that note. The 14-day server logs and earlier anonymous usage stats, which can't be tied to you, expire on their own. To show your other devices that the data was deleted, iCloud keeps one small record with a random id and no data.
• You can also remove the app's iCloud data (listed as Aerial) in your iPhone's Settings > your name > iCloud > Manage Storage, and delete the app to remove what's on the device.

Children

Aerial Radio isn't directed to children under 13, and we don't knowingly collect information from them.

Changes

If this policy changes, we'll update it here and change the date at the top. If a change affects how your data is used in a meaningful way, we'll tell you in the app before it applies.

Contact

Questions or requests: contact@benjineeringlabs.com.
Benjineering Labs LLC