Privacy Policy

The short version

The whole policy in three short paragraphs.

We store the files you upload and deliver them to the people you send them to. To do that we hold your account details, your files, the details read from them, and a record of who you sent what to and when they opened or downloaded it.

We do not sell your personal information and do not share it for advertising. There are no ads, no analytics, and no tracking of any kind. Nothing you upload is used to train AI models.

The rest of this page is the detail. Where something is planned but not built, we say so instead of promising it.

Who this policy is for

Three kinds of people show up in WAValt, and this policy covers all of them.

• Account holders, who upload files and send them out.
• Recipients, who get a link and never make an account. There is a section further down written just for you.
• Visitors to wavalt.com, who may join the notify list and nothing more.

What you give us

The information you type in or upload.

This is everything that reaches us because you put it there.

• Your email address. It is how you sign in and where notices go.
• Your username and your display name.
• Your birthday, if you choose to add one. It is optional and signup never asks for it.
• A profile picture, if you upload one.
• Your plan, your connect code, your privacy setting, and any custom colors you pick.
• The files you upload, and the packs you group them into.
• A pack name and its intent line, which is the short note about what the pack is. Recipients are shown the intent line.
• Who you send to. For an email send that is the address you typed. For an in-app send it is the WAValt account you picked.
• The display name that goes out with a send, and any track details you attach before sending, such as artist, album, genre, composer, a contact email, a contact phone number, and cover art.
• Chat messages you send inside the app. These are stored as plain text and are not encrypted by us.
• Your connections, and anyone you block. A block records who blocked whom.

What your files carry

When you upload a file we keep the audio itself plus a set of details about it.

• The original filename.
• The size.
• A SHA-256 checksum of the contents. That is a fixed-length code worked out from the bytes. It is used to tell files apart, and it cannot be turned back into the audio.
• Musical details read out of the filename, such as BPM, key, type, and tags.
• The length of the audio and the waveform shape, which your browser works out so the player can draw it.
• Cover art and track details, when you attach them to a send. Those are stored and delivered with the file.

What gets recorded automatically

Some things the servers record without you typing anything.

• Your IP address, as part of the rate limit records that stop somebody hammering the sign-in form. The IP address forms part of the record key, so it is held in full.
• Your IP address and your browser user agent on security events. Signing in, verifying a code, starting a download, exporting your data, and deleting your account all count as security events. These go to an append-only audit store.
• A trail of actions taken in the app. The audit trail carries account ids and hashed values in the event body, not plain email addresses.
• On wavalt.com, if you join the notify list, your email address, the time, and your IP address.

There is no geolocation, no device fingerprinting, and no analytics of any kind. No analytics script runs on any WAValt page, and no advertising network is present anywhere. We do not build a profile of you and we do not make automated decisions about you.

If someone sent you files and you do not have an account

A WAValt link is not anonymous. Here is exactly what it records.

You do not need an account to receive files, and you are not asked to agree to anything to download them. That is deliberate. But you should know exactly what is recorded.

• Your email address is stored in the send record, because the sender typed it in to reach you. It is also written into every open receipt and every download receipt.
• Opening the download page records an opened event. Reloading does not stack them up: we record at most one open per share per hour.
• Finishing a download records a downloaded event. Every completed download counts, so downloading three times shows as three.
• A download you cancel part way through records no downloaded event. Playing or scrubbing the audio preview counts as nothing at all: it does not use up a download and does not record one.
• Starting a download writes your IP address and your browser user agent to the security audit store. That happens as the download starts, so it is written even if you then cancel. Simply opening the page writes neither one.
• The sender is shown the receipts: who the files went to, when they were first opened, when they were first downloaded, and how many downloads there have been. The sender is not shown your IP address or your user agent.

An open is not proof that a person looked at anything. Automated link scanners inside email systems open pages to check them, and that can record an open with nobody ever seeing the page.

You have no account and no settings screen, so there is no self-serve way to see or remove any of this. Email hello@wavalt.com from the address the files were sent to and say what you want to know or want removed. A receipt is also the sender record of a delivery that happened, so we will tell you plainly what we can and cannot remove before we do anything.

Why we hold each thing

Everything above exists for a reason. Here they are, paired up.

• Your email address and your session: to sign you in and keep you signed in.
• Your profile, plan, and settings: to run your account and show the app the way you set it up.
• Your files and their details: to store them, to list, search and sort them, and to deliver them to the people you choose.
• Send records and receipts: to deliver the files, and to show you what happened after you hit send.
• IP addresses in rate limits and security events: to stop abuse of the sign-in form and to have a record if something goes wrong.
• Chat messages, connections, and blocks: to run the messaging and connection features you asked for.
• The notify list on wavalt.com: to email you when WAValt opens, and nothing else.

What we do not do

Some of these are worth stating out loud rather than leaving to silence.

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising, which is the kind of sharing that lets advertisers follow you between websites.
• We do not give your personal information to anyone else for their own direct marketing.
• We hold two kinds of information the law calls sensitive: the credentials that get you into your account, and the contents of communications where we are not the intended recipient, such as your chat messages, your notes to recipients, and your files. We do not use any of it to work out or infer characteristics about you.
• We do not use your audio, your filenames, or your metadata to train AI models. There is no machine learning anywhere in the service. If an opt-in for that is ever offered, it stays off unless you turn it on yourself.

Do Not Track and other browser signals

California asks for this answer, so here it is.

We do not track you over time or across other websites, so a Do Not Track signal has nothing to switch off. We do not change our behavior for a Do Not Track header, and we do not change it for a Global Privacy Control signal either, because nothing is tracked, sold, or shared in the first place.

The law also asks whether anyone else can collect information about what you do across other websites while you use WAValt. The answer is no. Fonts, styles, scripts, and images all load from WAValt servers, so a page here does not hand your IP address to a third party.

One company is unavoidably in the path. Cloudflare runs the network everything passes through, so it sees every request by the nature of the arrangement. It is our infrastructure provider, acting on our instructions, and it is not an advertising or analytics company here.

Cookies and browser storage

We set no cookies of our own. Not in the app, not on the API, not on wavalt.com.

The app does keep things in your browser storage: your sign-in token, a copy of some of your own account data, and your display preferences. Signing out clears almost all of it from that browser.

Cloudflare runs the platform and may set its own security cookies on the WAValt domain. We do not set those and do not read them.

The Cookie Policy covers all of this properly, item by item, and it is the place to look for the full list of what sits in your browser and why.

Companies that handle data for us

WAValt is run by one person and depends on two service providers to work at all. They handle data on our instructions, to deliver the service, and are not free to use it for their own purposes.

• Cloudflare. Effectively the entire platform: the servers that run the code, the database holding your account and your records, the storage holding your file bytes and the audit trail, the queues, and the bot check on the wavalt.com signup form. Everything described in this policy passes through Cloudflare.
• Resend. This sends every email we send. Resend receives the recipient address, the subject line, and the whole body of the message. For a delivery email that body includes your name as sender, the pack and file names, the intent line, your note to the recipient, and the live share link, which means Resend is technically able to reach the files behind that link. For a sign-in email it includes the six digit code and the one-click sign-in link.

That is the whole list. There is no analytics provider, no advertising network, no font or asset host, no customer support tool, and no AI vendor anywhere in the path. There is no payment processor, because nothing is charged for yet. If that list ever grows, this section is where it will show up.

When we would hand something over

What you store is yours and stays private. We keep the exceptions narrow on purpose. They are:

• When valid legal process requires it, such as a lawful subpoena, warrant, or court order.
• When you ask us to, or you have given permission.
• In an emergency involving a risk of death or serious physical injury.

We do not reserve a broad right to read your files or pass them to anybody who asks. That list is the whole of it.

If a copyright owner sends a takedown notice, that is handled under the Copyright and DMCA Policy. It means acting on the file. It does not mean handing your files to the person who complained.

Where your data is held

WAValt is run from California, in the United States.

The service runs on the Cloudflare network and email goes through Resend. We have not pinned our storage to a single country, so we do not claim your data stays in one place. Treat it as handled in the United States and across Cloudflare infrastructure, and if that matters to you it is better to know before you upload than after.

How long we keep things

A nightly job removes dead records on this schedule.

A job runs every night whose whole purpose is to remove records once they are dead. It is deleting, not counting: an earlier version of this section said it ran in counting mode and deleted nothing, and that is no longer true.

Each period below is how long a record survives past the moment it became dead, not how long it lives in total. A sign-in code is dead once you use it. A share link is dead once it expires or you revoke it.

• Sign-in codes, which carry the email address the code was sent to: 24 hours after the code is used or expires.
• Rate limit records, which contain IP addresses: 7 days.
• Sessions: 90 days after the session ends, whether you signed out or it timed out.
• The record of a file you deleted, and of a pack you deleted: 30 days.
• Share links, after they expire or you revoke them: 90 days. The link stops working immediately; this is only the record of it.
• Cover art uploaded for a send that never went out: 30 days.
• Security audit records, including the recipient IP address and user agent captured when a download starts: 24 months.

Four things are deliberately on no timer at all. Your files stay until you delete them or your account is deleted. Send records and receipts stay, because they are your delivery history and a timer that quietly erased them would take away the one thing the product exists to give you. Chat messages stay. All three go when the account goes. And the notify list on wavalt.com is kept until you ask for removal.

Two consequences of keeping receipts, which we would rather you heard from us. A recipient email address stays in the send record and in every receipt for as long as your account exists. And a file record and its share record stay for as long as a send or a receipt points at them, even after the file itself is deleted.

What deleting a file does

Deleting a file removes the stored audio straight away and permanently. The bytes go and they do not come back. There is no trash can, there is no version history, and we cannot restore a deleted file. Keep your own copies of anything you cannot afford to lose.

Deleting a file does not remove everything about it. These are kept:

• The filename.
• The size.
• The content checksum.
• The musical details.
• Every send record, including the email address of every recipient it went to.
• Every open receipt and every download receipt.

A delivery record is a record of something that happened. Deleting the file does not un-happen it, which is why the records above survive. Revoking a share link stops future downloads and does nothing about copies a recipient already took.

Closing your account

Settings, Your data, Delete my account. Here is exactly what it does.

You can close your account yourself, and you type DELETE to confirm. Take an export first, because the moment you confirm:

• You are signed out on every device and cannot sign back in.
• Every share link you handed out is revoked immediately and for good. It does not come back, even if the account does.
• Thirty days later everything we hold for your account is permanently removed, your files included: the file bytes, the file records, packs, sends, receipts, messages, connections, sessions, your consent history, and the account record itself.
• What goes includes things partly belonging to somebody else: a whole conversation with both halves in it, the line in another person’s send history naming you, and the receipts showing you opened or downloaded something.
• What stays: security audit records, which carry account ids rather than email addresses, and rate limit counters, which are keyed on an IP address. Anything a recipient already downloaded stays on their machine.

Inside those 30 days you can ask us to undo it, by emailing hello@wavalt.com from the address the account uses. There is no self-serve undo, on purpose, so somebody who got into your account cannot delete it and quietly put it back. Restoring an account does not bring its share links back, because we keep no record of which ones we revoked. After 30 days nothing of your account is left to restore.

One exception, and it is not ours to undo: a file you sent that somebody chose to keep stays in their library. That copy became theirs when they kept it, so closing your account does not remove it, any more than closing it would reach a file they had already downloaded. Everything that identifies you goes; the audio they hold does not.

Closing your account is never conditional on accepting a new version of any policy. Decline one and both the export and the deletion still work.

Your consent record

When you accept one of these documents, your account keeps a record of which document you accepted, which version, and the date and time.

The record is history, not a setting. Accepting a new version adds a new entry beside the old one rather than replacing it, so the account can always show what was agreed and when.

No IP address is stored with that record. That was a deliberate choice. If it ever changes, this policy changes in the same release.

What you can ask for

What the product actually does, not a list copied out of a statute.

Four of these you can do yourself, right now, without asking anyone.

• See what is held about you. Most of it is already on screen: your profile in Settings, your files in your library, and the receipts on each send you made.
• Change it. Open Settings and edit your profile. For anything you cannot change there yourself, ask by email.
• Get a copy. Settings, Your data, Download my data. One file, holding your account record, library details, packs, sends and their recipients, share links, receipts, connections, messages, sessions, and consent history. The audio is not in it, and the file carries its own list of what it leaves out. Three exports a day.
• Delete a file. You can do that yourself and it is immediate. Read the section above first, because it does not remove the delivery records.
• Close your account and have its data removed. Settings, Your data, Delete my account. The section above says exactly what that does.

None of it costs anything and none of it requires a form. There is no published response clock for anything you ask by email, because promising a deadline we might miss would be worse than saying plainly that there is not one.

If you are in California

WAValt is a California business and sits well under the size thresholds that trigger the California Consumer Privacy Act. So this policy does not claim to be a CCPA policy and does not recite the machinery that comes with one. Reciting rules that do not apply would invent obligations and tell you nothing true.

What we honor whatever the thresholds say: you can see what is held about you, get a copy of it, correct it, delete it, and close your account. The sections above say how each one works today.

Two statements the law wants said out loud, and we can say both plainly. We do not sell or share your personal information. We do not use sensitive information to infer characteristics about you. Because both are true, there is no Do Not Sell or Share My Personal Information link on the site, and none is needed.

This section describes what we do. It is not legal advice.

If a privacy law like the GDPR applies to you

WAValt is aimed at the United States market, priced in dollars, and offered in English. It is not targeted at people in Europe or the United Kingdom. Somebody there may still sign up.

If a law like the GDPR does apply to you, the grounds we rely on are these. Performing the agreement with you, which covers running your account and delivering your files. Legitimate interests, which covers keeping the service working and stopping abuse. Complying with a legal obligation. And your consent, where you were actually asked for it, such as joining the notify list.

Ask by email for anything you want to see, correct, or remove, and say where you are, so the request is handled under the right rules.

Keeping your data safe

In factual terms, this is what protects your account.

• There are no passwords. We never ask you to make one and never store one, so there is nothing to steal, guess, or reuse.
• You sign in with a six digit code emailed to you, or with the one-click link in the same email.
• A session is a long random token. Only a hash of it is stored, so what sits in the database cannot be turned back into a working session.
• How long a session lasts is your choice at sign-in. With "Keep me signed in" checked it ends after 30 days without use, and 365 days no matter what. With it cleared it ends after 12 hours without use, and 24 hours no matter what, and closing the browser ends it there and then.
• Uploads are checked by reading the actual first bytes of the file, not by trusting the filename or the type your browser declares.
• Everything runs over HTTPS.

What encryption we do and do not have

Plenty of services are vague about this. We will not be.

We do not encrypt your file contents ourselves. Your files sit in Cloudflare storage and rely on Cloudflare encryption at rest. WAValt is not end-to-end encrypted and you should not treat it as though it were. We are technically able to read what you store.

What we do not do with that ability: there is no content scanning, no fingerprinting against any music database, and no machine learning of any kind. Automated systems do read the bytes to do the jobs you ask for, such as building a zip or writing your track details into a delivered file. The Terms of Service says what to do if you need a file nobody here could open.

If there is ever a breach

If a breach affects your information, we will tell you. The notice will say what happened, what information was involved, and what to do about it.

California law sets the deadline at 30 calendar days from discovering a breach, and we apply that same deadline to everyone, not only to Californians.

Two things we hold are exactly what makes that duty bite: an email address together with something that opens the account, and the contents of communications. Both are here, which is why this section exists instead of being boilerplate.

Children and the age minimum

You must be at least 13. WAValt is a professional tool for people who make music, and it is not aimed at children.

Signup does not ask for your birthday. The birthday on your profile is optional, and if you enter a date that would make you under 13, we refuse it rather than quietly recording it.

If we learn that an account belongs to somebody under 13, that account and its data are deleted. There is no waiting period and no 30 day grace on that one.

If you are a parent or guardian and you believe a child under 13 has an account, email hello@wavalt.com with enough detail to find it. The account and the data held with it will be deleted.

Changes to this policy

This version takes effect on 22 August 2026, and the version date shown with the document always tells you which one you are reading.

When we change this policy in a way that matters, we post the new version and email the address on your account before it takes effect. Small corrections, such as fixing a typo or a broken link, are made without an email.

This policy forms part of the Terms of Service, so changes that alter the agreement itself go through the acceptance flow described there.

If you do not agree with a change, you can take a copy of your data and close your account, and neither depends on your accepting anything first.

How to reach us

Email hello@wavalt.com. Put the word Privacy in the subject line so it gets to the right place quickly.

That is the address for everything here: seeing what is held, correcting something, undoing a deletion inside the 30 days, a recipient asking about their own record, and a parent asking about a child account.

WAValt is run from California by one person. There is no privacy department to escalate through, which also means the person reading your email is the one who can do something about it.