Privacy Policy

Introduction and scope

This Privacy Policy explains how Wavabout, Inc. ("Wavabout", "we", "us") collects, uses, shares, and protects personal information when you use the Wavabout website, applications, and services (the "Service"). Wavabout, Inc. is an audio-first social service operated from the United States and is the controller of the personal information described here. For privacy questions or to exercise your rights, contact elliottdevs@gmail.com.

Wavabout is a social platform built around publicly shareable audio. Content you choose to make public — including your audio, profile, handle, captions, and the machine-generated transcripts of your audio — is by design visible and audible to others and may appear in search and recommendations. Do not record, upload, or post anything you are not entitled or willing to share.

Information we collect

We collect the following categories of information:

• Account and identity: your email address and the handle and display name you choose. If you sign in with Google, Apple, or Discord, we receive basic profile information from that provider (such as your email and a provider identifier).
• Profile: anything you add to your profile, such as an avatar image and a voice or text bio.
• Content you create: audio you record or upload; the machine-generated transcripts of that audio; captions, comments, reactions, and the sounds, remixes, and pad kits you make; and voice and text messages you send through the Service.
• Marketplace and payments: if you buy or sell a sound license, our payment processor (Stripe) collects and processes your payment details. We do not store full card numbers; we receive limited transaction information such as confirmation, amounts, and license records.
• Usage and device: how you interact with the Service (for example, plays, follows, and feature use); your IP address (used for security, abuse prevention, and rate-limiting, held only briefly for those purposes and not used in raw form for general analytics); approximate region; and basic device, browser, and log data.
• Analytics: product-analytics events about how the app is used, to understand and improve features.
• Communications: messages you send us for support, feedback, or reports, and content you submit through our community channels.
• Inferred data: limited signals we derive to rank content, recommend sounds, and detect abuse.

How we use information, and our legal bases

We use personal information to:

• Provide the Service — host, transcode, transcribe, stream, and display your audio; run search, captions, the feed, messaging, live rooms, the marketplace, and other features; and maintain your account. Legal basis: performance of our contract with you.
• Keep the Service safe — moderate content, match audio against copyrighted recordings, prevent spam, fraud, and abuse, enforce our Terms, and secure our systems. Legal basis: our legitimate interests in a safe Service, and compliance with legal obligations.
• Communicate with you — send sign-in links, service and security notices, and respond to your requests. Legal basis: contract and our legitimate interests.
• Process payments — complete marketplace transactions and keep license and tax records. Legal basis: contract and legal obligation.
• Improve and develop the Service — analyze usage, troubleshoot, and build new features, using aggregated or de-identified data where we can. Legal basis: our legitimate interests.
• Comply with law — respond to lawful requests, handle copyright notices, and protect rights and safety. Legal basis: legal obligation and legitimate interests, and vital interests where someone's safety is at risk.

Where we rely on consent (for example, certain optional features or non-essential cookies), you may withdraw it at any time. We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

How we share information

We share personal information only as described here. We do not sell it. We share it with service providers ("subprocessors") who process it on our behalf and under contract, each receiving only what it needs:

• Fly.io — application hosting and compute.
• Neon — cloud Postgres database for application data.
• Cloudflare — object storage (R2) for your audio files, plus content delivery (CDN).
• Deepgram — speech-to-text transcription of audio for search, captions, and accessibility.
• ACRCloud — audio fingerprinting to detect potentially copyrighted recordings.
• OpenAI — automated content moderation to screen for prohibited content.
• ElevenLabs — AI voice generation, and — for the Pro voice changer — speech-to-speech conversion of audio recordings you submit.
• PostHog — product analytics.
• Stripe — payment processing for the marketplace.
• Google, Apple, and Discord — optional third-party sign-in (authentication).
• Email delivery provider — to send your sign-in links and service emails.
• Discord — our community, support, and feedback channels, if you choose to use them.

We also share information: with other users, to the extent you post or send it (public Content is visible to others, and recipients receive your messages); when required to comply with law, legal process, or lawful government requests, or to protect the rights, safety, or property of Wavabout, our users, or the public; and in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy. We may share aggregated or de-identified information that does not identify you for any purpose. A current subprocessor list is maintained above and available on request at elliottdevs@gmail.com.

Audio, transcripts, and public content

Audio you post publicly is, by design, audible to others and is transcribed automatically so it can be searched and captioned. Profiles, handles, public posts, and their transcripts can be viewed by anyone and may appear in search and recommendations. Messages are visible to the people you send them to. Do not include in any recording or post information you are not entitled to share, and do not record or post another person's voice, likeness, or private information without their consent.

Cookies and tracking

We use a strictly necessary cookie to keep you signed in and to secure your session, and limited analytics where permitted. You can decline non-essential cookies and can control cookies through your browser. Where required, we obtain consent for non-essential cookies. We honor recognized opt-out preference signals, such as Global Privacy Control (GPC), where applicable law requires.

International data transfers

We and our subprocessors process information in the United States and other countries that may not provide the same level of data protection as your home country. Where we transfer personal information out of the EEA, UK, or other regions with transfer restrictions, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. You may request more information about these safeguards using the contact details below.

Data retention

We keep your account and Content until you delete them or close your account, after which we delete or de-identify the associated personal information within a commercially reasonable time, except where we must retain certain records longer — for example, safety and abuse logs, transaction and tax records, and information needed to comply with law, resolve disputes, or enforce our agreements. Salted IP hashes and similar security data are kept only as long as needed for abuse prevention. Residual copies may persist briefly in routine backups before being overwritten. Content others have reposted, remixed, downloaded, or licensed may remain available to them as described in our Terms.

How we protect information

We use technical and organizational measures designed to protect personal information, including encryption of data in transit (TLS), encryption at rest by our storage providers, hashing of secrets and sign-in tokens, salted-hash storage of IP addresses, access controls, and the principle of least privilege. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities as required by applicable law. Help protect your own account by keeping access to your email and connected logins secure.

Your rights and choices

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access it and obtain a copy; to correct inaccurate information; to delete it; to port it to another service; to restrict or object to certain processing; and to withdraw consent where processing is based on consent. To exercise any of these, email elliottdevs@gmail.com, or delete your account in the app. We will verify your request and respond within the time required by applicable law. You will not be discriminated against for exercising your rights. If you disagree with our decision, you may ask us to reconsider, and you may have the right to complain to your local data-protection authority.

U.S. state privacy rights (California and others)

If you are a California resident, the CCPA/CPRA gives you the right to know and access the personal information we collect, the sources, the purposes, and the categories of recipients; to delete and to correct your personal information; and to opt out of the "sale" or "sharing" of personal information and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics. In the past 12 months we have collected the categories described under "Information we collect" (identifiers, audio and electronic content, commercial/transaction information, internet and usage activity, approximate location, and inferences) and disclosed them to the subprocessors listed above to provide and secure the Service. You may exercise these rights, including through an authorized agent, by contacting elliottdevs@gmail.com, and we honor Global Privacy Control signals where required. Residents of other U.S. states with privacy laws may have similar rights, which we extend to you where those laws apply.

EEA and UK information

If you are in the EEA or UK, Wavabout is the controller of your personal information, our legal bases are described under "How we use information," and you have the rights described under "Your rights and choices," including the right to lodge a complaint with your supervisory authority. Where processing is based on legitimate interests, we have balanced those interests against your rights; contact us for more information or to object.

Children

Wavabout is not directed to children under 13, and we do not knowingly collect personal information from them. Some jurisdictions set a higher age of digital consent (for example, 16 in parts of the EEA); in those places, users below that age may use the Service only with verifiable parental or guardian consent. If you believe a child has provided us personal information without the required consent, contact elliottdevs@gmail.com and we will delete the account and information.

Automated processing

We use automated systems to transcribe audio, moderate content, match potential copyright, rank and recommend content, and detect abuse. These systems may restrict, remove, or limit Content or accounts. We do not use solely-automated processing that produces legal or similarly significant effects about you without a way to seek human review; if an automated decision affects your account or content, you may contact us to request that a person review it.

Changes to this Policy

We will update this Policy as the Service evolves and revise the "Last updated" date above. For material changes, we will provide notice in-app or by other reasonable means. Your continued use of the Service after an update takes effect means you acknowledge the revised Policy.

Contact

For privacy questions or to exercise your rights, contact elliottdevs@gmail.com. Wavabout, Inc.