Privacy Notice

What we hold about you, why, and what we do not hold at all.

Last updated September 4, 2026

The short version

Your station's own data never reaches us. Cartwright runs on your machine and its database stays there. What we hold is the small amount needed to sell and support a license: who you are, what you bought, and whether your email address works.

We do not sell your information. We do not share it for advertising. There is no analytics script, no advertising pixel and no third-party tracker anywhere on this site — a test in our source code fails the build if one appears.

What we hold, exactly

Your account: the email address you signed up with, your name, your station name if you gave one, and your password stored as a salted hash we cannot reverse.
Your sign-ins: a session cookie so you stay signed in, and a count of failed sign-in attempts so we can slow down somebody guessing at your password.
Your licenses: the reference, station name, edition and dates of every license issued to you, and the signed key itself so you can fetch it back without asking us.
Your payments: the Stripe customer, subscription and invoice identifiers that connect a license to what paid for it. We never see or store your card number — it goes straight to Stripe, who are a certified payment processor, and we could not retrieve it if we wanted to.
Email we have sent you: the address, the time and whether it worked, so we can tell whether your confirmation actually arrived.
That a download happened: which version and when, and one bit saying whether the person was signed in — never who. It tells us how much of the field is on an old build, which is the only reason to ask.
Support you send us: whatever you write in an email or say on the phone.
Whether you want release announcements: one setting, and the link at the bottom of those emails turns it off without signing in. Nothing else in this list is affected by it — you will still get your license keys and password resets, because those are not marketing and you cannot unsubscribe from being sent the thing you bought.
When you accepted these terms: the date, and which version you accepted. Recorded because an agreement nobody can evidence is not much of an agreement.

What we do not hold

Your advertisers, contacts, orders, contracts, invoices, traffic logs, audio or listener records. All of that is on your machine. The one exception is a spot you choose to send an advertiser for approval, which has to leave your machine to reach them — see below for exactly what that involves.
Any usage telemetry from the software. The application does not report what you do in it, does not phone home, and checks its license offline — an internet outage has never stopped a log going to air, and that is a design property rather than a promise.
Card numbers, bank details, or anything a payment processor holds.
Cookies for advertising or analytics. The only cookie the site sets is the one that keeps you signed in.

When you send a spot to your advertiser

Cartwright can send a finished commercial to your advertiser to hear and approve. That is the only feature that puts anything of yours on our servers, and it has to: your traffic computer sits behind your own router, so a link pointing at it would open for nobody outside your building.

While a proof is out, we hold the audio file, the advertiser name and spot title you typed, your station name and contact details so the page looks like you, and the address you sent it to. When they answer we hold their name, what they chose, and anything they wrote asking for a change.

We never contact your advertiser for our own purposes. Not marketing, not onboarding, not a survey, not a satisfaction email, not ever. The only message that reaches them is the one you sent, about their own advertising. Nothing else we do will ever put our name in front of your client.

The page they open carries your station name, your colour and your contact details. We are not named on it at all unless the link is on our address rather than one of your own, in which case a single line explains who we are so that seeing an unfamiliar domain does not leave them guessing.

A proof link stops working after sixty days. The audio is kept only as long as the proof, and the advertiser is never asked to sign up, create a password, accept anything, or install anything.

Email we send you

Two kinds, and they are treated differently on purpose.

The ones you cannot turn off are the ones you asked for by buying or signing up: your license key, a password reset, a confirmation, a receipt. Switching those off would mean withholding the thing you paid for.
Release announcements are optional. We send one when there is a new version worth telling you about — never on a schedule, and never automatically. Every one carries an unsubscribe link that works without signing in, and we act on it immediately.

We do not sell your address, and we do not send you anything on behalf of anybody else.

Who else touches it

Three companies, each doing one job, none of them given your information for their own purposes:

Stripe processes payments and holds the card details we never see.
Our email provider delivers the confirmations, password resets and license keys we send you.
Our web host runs this website and the database behind it.
Nobody else. We do not sell, rent or trade your information, and we have no advertising partners.

If we are ever legally compelled to hand something over, we will tell you unless we are forbidden to.

How long we keep it

Your account and license history stay while your account exists, because a license you bought two years ago is a thing you may need to prove. Ask us to close your account and we will delete it and everything attached to it, keeping only what we must for tax and accounting — the record that an invoice was paid, which the law requires us to keep for several years.

Failed sign-in records are cleared when you sign in successfully.

What you can ask for

Whoever and wherever you are, you can ask us to tell you what we hold about you, correct it if it is wrong, delete it, or send you a copy. Write to hello@cartwright.fm and we will answer within thirty days. We do not charge for this and we will not treat you differently for asking.

California residents have specific rights, set out in our California Privacy Notice.

Children

This is software sold to radio stations. It is not directed at children and we do not knowingly collect anything from anyone under 16.

Security, honestly stated

Passwords are stored as salted scrypt hashes. Session tokens and email links are stored hashed, so a copy of our database is not a set of working logins. The site is HTTPS only. Access to the database behind it is limited to the people who run the company, and administrative actions are logged with the name of whoever took them.

No system is perfectly secure. If we ever suffer a breach affecting your information, we will tell you promptly and plainly, including what we know and what we do not yet know.

Asking us anything

Martian Creative, LLC · hello@cartwright.fm · (707) 505-8885. A person answers both.