Privacy Policy

Applies to the current Wavluma early-access service. Updated November 7, 2026.

Projects on your device

Lyric drafts, imported audio, editing settings and local projects are stored in browser localStorage or IndexedDB. Audio imported for local editing is not automatically uploaded. Clearing browser data deletes local projects; export a backup first.

Information sent for generation

When you generate, your text, style and task type are sent to our backend and models hosted on Replicate. Avoid sensitive information and content you do not have permission to use. We retain task identifiers, input, status and output to recover tasks after refresh and provide downloads.

Sessions and trial limits

Sessions use HttpOnly cookies; the server stores a token hash and expiry. Sign-in stores your verified email and provider account identifier and can transfer guest generation records to your account. Email codes are stored as hashes and expire after 10 minutes. Network address hashes support abuse controls; hashed identifiers are not fully anonymous data.

Website analytics

We use Google Analytics 4 to understand page visits, traffic sources and usage. Analytics uses cookies to distinguish browsers and measure sessions, processing page paths, titles, referrers, device information and approximate location. We do not send email addresses, verification codes, lyrics, generation prompts or audio. Analytics URLs exclude query strings and fragments; advertising personalization and automatic form measurement are disabled. Browser tracking protection or Google's opt-out extension can block analytics.

Google privacy policy · Google Analytics opt-out

Retention and deletion

Local projects can be deleted from the project list. Server generation records and audio in this test environment remain until environment cleanup or manual deletion; automatic expiry and self-service server deletion are not yet available. Request server deletion through the maintainer contact profile with your task ID, never your access token.

Third parties and contact

Replicate privacy policy · Maintainer contact profile

Once configured, the email provider delivers verification codes and Google/Apple handle their respective sign-ins. Clink handles checkout and payment details. We store orders, subscription status and credit history, not payment card details. Payment integration is currently sandbox-only and service credentials are awaiting configuration. The operating entity and dedicated privacy contact will be specified before commercial launch.