Privacy

The directory itself is public and needs nothing from you: you can browse, search, play a show and export the whole thing as OPML without an account, and none of that is tied to a person.

What an account stores

Signing up creates one row with an email address in it. Alongside it:

• Your email address — the account identity, and where sign-in links are sent. Nothing else is mailed to it: there is no newsletter and no marketing.
• The shows you follow — a list of directory slugs, used to build your following feed.
• A session record — only the SHA-256 hash of your session token, so a copy of the database cannot be replayed as a login.
• Passkeys, if you register one — the public key and a signature counter. A passkey’s private half never leaves your device and is never sent here.
• Sign-in link records — the hash of each magic link, its expiry, and the IP address that asked for it. The IP is kept to rate-limit sign-in attempts and is discarded with the record when it expires.

There is no password to store, because there is no password: signing in is a link in your inbox or a passkey.

Cookies

One cookie, set only once you sign in, holding a random session token. It is HttpOnly, SameSite=Lax and Secure, so it is unreadable to scripts and is not sent along on cross-site requests. Signing out deletes it. Nothing is stored in a cookie for signed-out visitors, so there is no consent banner to click past.

Who else is involved

• Resend delivers sign-in emails, so it processes your address to send them.
• Podcast Index is where the feed metadata comes from. It is a one-way read: nothing about you is sent there.
• Publishers serve their own artwork and audio from their own domains. Playing an episode or loading a cover is a request from your browser to that publisher, which will see it the way any visit to their site would. That is the direct consequence of a directory that hosts nothing itself.
• CrawlProof supplies page analytics and the ad slots. The analytics are aggregate page counts, not per-person profiles.

Nothing is sold, and there is no third-party advertising profile built from you.

Deleting it

Ask, from the address you signed up with, and the account and everything attached to it is deleted — follows, sessions and passkeys included. There is no waiting period and no copy kept afterwards. Write to hello@p0dcasters.com, or see contact.

Changes

If this ever describes something different, the page changes with it rather than quietly staying wrong. Last updated 29 August 2026.