Privacy Policy

What we collect

• Account: email, display name, and password (stored only as a secure hash).
• Your workspace: audio, artwork, projects, client names, emails and photos, comments, and people you invite.
• Share-link listeners: the name you enter and notes you leave. We also record which songs you play and download, and the approximate city and country you play them from, which the project owner can see. If a link only opens for invited emails, we use the email you enter to send you a one-time listening link.
• Technical data: IP addresses (available to administrators for 30 days, then deleted by scheduled cleanup), approximate location (city and country), hashed network identifiers, browser type, pages you visit, and error reports (linked to your account when you're signed in), used for security, fixing bugs, and counting visits.
• Waitlist: name, email, Instagram (optional), and your role.

How we use it

To run WAVDROP: sign you in, store and stream your files, deliver share links and comments, send account emails, prevent abuse, and fix problems. We don't sell your data, show ads, or send marketing email.

We don't use your audio to train AI, and we don't send it to AI services.

Services we use

These providers handle data for us, only to run their part of WAVDROP: Vercel (hosting and website visit counts), Supabase (accounts and database), Cloudflare (file storage, audio delivery, and bot checks), Upstash (rate limiting), Emailit (account emails), PostHog (error, performance, and usage reports), Buildin (waitlist), and Telegram (internal alerts). Creem handles payments for paid plans. Their servers may be outside your country.

We may also share information if the law requires it, or with a company that takes over WAVDROP.

Connected apps

If you connect an AI app like Claude or ChatGPT in Settings › AI connectors, it can see your projects, songs, client names, notes (with the names of who left them), and share link status, including the link itself while it's on. It can make only the changes you approved when connecting. It doesn't receive your audio files, but it can see share links. Those links still follow your password, email access and expiry settings. What reaches that app is handled under its own privacy policy. Disconnect anytime in the same place. We keep a log of what connected apps changed for 90 days.

Cookies

We use cookies to keep you signed in and to make share links and playback work. PostHog and Vercel's visit counter don't use cookies or browser storage to recognize you, and PostHog doesn't run if your browser sends Do Not Track. Your browser also stores small things like your playback queue. We don't use advertising cookies.

How long we keep it

We keep your data while your account is open. Listen activity is cleared after about 90 days. Security logs may be kept longer to protect the service.

Deleting your data

Delete files, projects, or your whole account in the app. Deleting your account removes your workspaces and files, usually within seconds. If it needs our review, we finish within 30 days and email you. Deleted audio can't be recovered. Notes you left in other people's projects stay there unless you ask us to remove them. Account deletion doesn't remove waitlist entries, emails you sent us, security logs, or data already in our providers' logs. Email us if you want any of that removed.

Your rights

You can ask to see, correct, export, or delete your data. Email support@wavdrop.link from your account address and we'll reply within 30 days.

Security

We work hard to protect your data. See our Security page. No system is 100% secure. If a breach affects your data, we'll let you know as the law requires.

Children

WAVDROP isn't for anyone under 16. If you think a child has signed up, email us and we'll delete the account.

Changes

We'll post updates here and email you about important changes.