Privacy Policy

Last updated: 18 October 2026

This Privacy Policy explains how HEART OF ESC (heartesc.com, "the site", "we", "us") collects, uses and protects personal information when you visit the site or use its features. HEART OF ESC is an independent, unofficial Eurovision fan website and is not affiliated with or endorsed by the European Broadcasting Union (EBU).

1. Who is responsible and how to contact us

HEART OF ESC is responsible for the personal data described in this policy. For any privacy question or request, contact us through our Contact page.

2. Browsing without an account

You can read the site - results, songs, artists, countries, years, statistics and news - without signing in. When you do, our hosting providers (see section 10) process technical data such as your IP address, browser type and the pages requested, in order to deliver the pages and keep the service secure. Cloudflare, which delivers the site, also gives us aggregated traffic statistics derived from these requests. We do not run Cloudflare's "Web Analytics" script in your browser: our pages block it, so it does not measure your visit (your browser may still download the script file from Cloudflare while loading the page).

3. Google sign-in and your account

Some features need you to sign in with your Google account: saving My Top rankings, My Group, liking songs, voting in polls, choosing a username and sending messages through the contact form. Sign-in is handled by Google and Firebase Authentication (a Google service). We receive from Google your name, email address, profile photo address and a unique account identifier. We never receive your Google password.

When you use these features we store, in Google Cloud Firestore:

• Profile: the username you choose, your display name and your profile photo address. Other signed-in visitors may see your username, name and photo, for example in My Group.
• Email lookup: a record linking your email address to your account identifier, so friends can invite you to a My Group.
• My Top rankings: the songs you ranked and when you saved them. Members of your My Group can see your rankings. Rankings are also combined, without names, into community average rankings shown on the site.
• My Group: the group name, its members, invitations and join requests.
• Song likes and poll votes: stored against your account identifier (not your name or email) so each account counts once. Only totals are shown on the site.

4. Contact form and issue reports

Contact form. When you send a message through the Contact page, we store your name and email address (from your Google account), the subject, your message, the site language you used and our replies. You can see your messages and our replies on the Contact page. Only site administrators can read messages.

"Report an issue". When you report incorrect data on a song, artist, year or news page, we store the page, the reason you chose, the details you wrote and the name and email address you enter in the report form (so we can follow up if needed). If you are not signed in, Firebase creates an anonymous account identifier for sending the report. Reports are used only to correct the site.

5. Cookies and similar storage

We use your browser's storage only as described below. Nothing optional is stored or loaded until you agree, and you can change your choices at any time.

You can change or withdraw your choices at any time: Privacy settings (also linked at the bottom of every page). Withdrawing analytics consent stops analytics and deletes the analytics cookies on this site; withdrawing advertising consent means later ads are no longer personalised; withdrawing YouTube stops the player from being loaded. You can also block or delete cookies in your browser settings.

6. Google Analytics

If you accept analytics, we use Google Analytics 4 (provided by Google) to measure visits, pages viewed, approximate location (derived from your IP address), device and browser type and how you arrived at the site. We use Google Consent Mode in its strictest form: until you accept, no Google Analytics code is loaded and nothing is sent to Google. Google signals and the use of analytics data for ad personalisation stay switched off. We use these statistics only to improve the site. More information: How Google uses information from sites that use its services.

7. YouTube songs and videos

Songs on My Top and videos on song pages play through YouTube, a Google service. Nothing is loaded from YouTube's player until you press play and allow it in the short notice that appears; your choice is remembered for 12 months and can be changed in Privacy settings. Once allowed, the player is loaded in YouTube's privacy-enhanced mode (youtube-nocookie.com). YouTube then receives your IP address and information about your device and the video, and may store information on your device, under Google's privacy policy. Privacy-enhanced mode reduces, but does not remove, what YouTube collects. Video preview pictures on song pages are loaded from YouTube's image server (i.ytimg.com), which receives your IP address but sets no cookies.

8. Pictures from other websites

Some pictures are shown directly from the websites that publish them - in particular many artist photos (for example from news and fan sites, music services and image hosts, including Google image thumbnails) and some news pictures. When your browser loads such a picture, that website receives your IP address, browser information and the address of our site, as with any web request; we do not control those websites or what they record. Pictures we have uploaded ourselves, the site's designed news covers, and freely licensed photos we have copied from Wikimedia Commons (credited with their author and licence) are served from our own storage.

9. Advertising

We show ads through Google AdSense. In the EEA, the UK and Switzerland, advertising cookies and personalised ads are only used with your consent, collected through Google's consent tool (IAB Transparency & Consent Framework); without consent, Google may show limited, non-personalised ads. Elsewhere, ads are not personalised unless you accept advertising in our privacy choices. Google and its partners may use cookies or device identifiers to show ads, limit how often you see an ad, measure performance and prevent fraud. You can change your choice at any time with "Privacy settings" at the bottom of every page. See How Google uses information from sites that use its services and Google ad personalisation settings.

10. Service providers and third-party content

• Google - Firebase Authentication, Cloud Firestore, Cloud Storage, Firebase Hosting - sign-in, the site's database, uploaded images and daily backups.
• Cloudflare (Cloudflare Pages) - hosts and delivers the site, protects it from abuse and gives us aggregated traffic statistics (section 2).
• Google Analytics - only with your consent (section 6).
• YouTube (Google) - songs and videos, only after you allow it (section 7).
• Google AdSense - advertising on the site, with Google's consent message in the EEA, the UK and Switzerland (section 9).
• Google Fonts - the site's fonts are loaded from Google's servers, which receive your IP address.
• Other websites' pictures - see section 8.
• News sources - news items link to the original publishers. Their privacy policies apply once you leave our site.

We do not sell your personal information and do not share it with anyone other than these service providers, except where required by law.

11. Why we use your data (legal bases)

Where the EU or UK General Data Protection Regulation (GDPR) or the Swiss Federal Act on Data Protection applies, we rely on:

• Providing the features you ask for (contract) - your account, rankings, My Group, likes, poll votes and contact messages;
• Consent - Google Analytics, advertising cookies and personalised ads, and YouTube. You can withdraw it at any time;
• Legitimate interests - keeping the site secure and working, preventing abuse, and correcting site data from issue reports.

12. International visitors and data transfers

The site is available worldwide. The site's database is stored in Google Cloud's European multi-region, and backups are stored in the European Union. Our service providers (Google and Cloudflare) may also process data in other countries, including the United States. Where data protection law requires it, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as offered by those providers. Websites whose pictures are shown on our pages (section 8) may be located anywhere in the world.

13. How long we keep data

• Account data (profile, rankings, My Group, likes and poll votes) is kept while your account is in use, or until you ask us to delete it.
• Contact messages and issue reports are kept as long as needed to handle them and keep a record of our replies, or until you ask us to delete them.
• Daily backups of the database are kept for 30 days and then deleted automatically.
• Google Analytics data is kept according to the retention setting of our Google Analytics account.
• Google Analytics cookies expire after up to 13 months.
• Data stored in your browser stays until you clear it; your privacy choices are asked again after 12 months.

14. Your rights and deletion requests

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent at any time. You can delete your saved My Top rankings yourself on the My Top page. To delete your whole account or make any other request, contact us through our Contact page from the email address linked to your account, so we can confirm it is you. You also have the right to complain to the data protection authority in your country.

15. Security

Access to the data is limited by Firebase security rules: for example, only you can change your rankings, and only site administrators can read contact messages and reports. All connections to the site use HTTPS. No method of storage or transmission is completely secure, but we work to protect your information.

16. Children

Signing in requires a Google account, which is subject to Google's minimum age rules in your country. If you believe a child has given us personal data without the permission required by law, please contact us and we will delete it.

17. Changes to this policy

We may update this policy, for example when we add or change a service. The date at the top shows the latest version. If a change affects the choices you made, we will ask you again.

This policy is provided in English. האתר זמין גם בעברית; מדיניות הפרטיות מוצגת באנגלית.