Privacy policy

In short

• We use your data to run Wavebook for you. We don’t sell it and we don’t show ads.
• Audio is measured in your browser. Your tracks go where you choose: Wavebook’s storage in the EU, your Dropbox or your Google Drive.
• We measure how Wavebook is used only if you say yes, and you can change your mind at any time.
• Write to hello@wavebook.cloud to see, correct, export or delete what we hold about you.

Who is responsible

Wavebook is published by FALAISE.IO, a French simplified joint-stock company (SAS) registered in Paris (RCS Paris 942 687 039), which decides how your data is used: the data controller. Full details are in the legal notice.

For anything about your data, write to hello@wavebook.cloud. We answer within one month, usually much sooner.

Your account

To create your account we need your email address. You can add a display name, your role (mastering engineer, mix engineer, artist, label or producer) and an artist profile. If you sign in with Google, see Google user data.

We use them to sign you in, show your name to the people you work with and fit Wavebook to your role. Legal basis: our contract with you (GDPR art. 6(1)(b)).

Your projects and files

Everything you put into Wavebook: projects, songs, tracks and their versions, sections, notes, tasks, statuses, release details, credits, and the contacts you add for them.

Tracks you upload are stored where you choose: in Wavebook’s storage, in Ireland (EU), in your Dropbox or in your Google Drive. Files you keep on this device stay in your browser and never leave it.

Loudness, spectrum, key and tempo are measured in your browser, and we store the results with the track. A file you drop on the home page to try Wavebook is measured on your device and never uploaded.

Your contact directory is private to your account; credits you add to a song are seen by the people in its project. Only record people you’re entitled to. Legal basis: our contract with you.

Working with others

Project members. When you invite someone, we email them on your behalf with your name and the project’s name. People in a project see each other’s names and roles, and the work shared there.

Listening links. Anyone holding a listening link (and its password, if you set one) can play the versions it opens and leave notes. A listener may add their name to a note; we keep the note and that name with the project.

Drop-off links. Someone sending you files through a drop-off link gives a name and an email address. We email them a code to confirm the address, then keep their name and address with the files they sent, in your project.

Legal basis: our contract with you, and our legitimate interest in letting the people you invite work with you (art. 6(1)(f)).

Dropbox and Google Drive

Connecting a cloud is optional. Once it’s connected, Wavebook lists your folders so you can bring files in, writes the tracks you upload into a Wavebook folder (or the folder you pick), and streams files back for playback and measurement, to you and to the people you share them with.

With Dropbox we ask for your account details and permission to read and write file contents and metadata. For Google Drive, see Google user data.

Access tokens are encrypted (AES-GCM) in our database and used only by our servers, when you or the people you share with ask for something. Disconnect in Configure › Storage at any time: we revoke our access with the provider straight away. The files stay yours, in your own cloud.

Google user data

Sign in with Google. Google shares your email address, your name and your profile picture with us. We use them to create your account, sign you in and show your name to the people you work with. We ask for nothing else from your Google account.

Google Drive. If you connect Google Drive in Configure › Storage, you allow Wavebook to see, create and change files in your Drive (the “drive” permission) and to read your Google account’s email address. We use that access only for the features you use:

• listing your folders and audio files, so you can choose what to bring into Wavebook;
• writing the tracks you upload to a Wavebook folder (Wavebook / project / song) or to the folder you choose;
• streaming your files, for playback and measurement, to you and to the people you share them with;
• showing which Google account is connected.

We don’t open, read or change any other file. Your tokens are encrypted and stored in Ireland (EU). Disconnect in Configure › Storage, or remove Wavebook from your Google account’s connections.

Limited Use. Wavebook’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Google user data for advertising, we don’t sell it, we don’t use it to develop, improve or train AI models, and no one at Wavebook reads it unless you ask us to (for support), security requires it or the law does. We share it only with the providers that host Wavebook, to run the features above.

Emails

We send the emails Wavebook needs: sign-in links and codes, invitations, and notifications about your projects (notes, versions, tasks, files received). They go out through Resend. No newsletters or marketing unless you ask for them.

Waitlist and Questions

Waitlist. To join the beta waitlist you give your email address and, if you like, your role. We keep them with the page’s language and where you joined, and send one email to confirm and one when your invite is ready. Leave the list at any time from either email. Legal basis: your request to join (art. 6(1)(b)).

Questions. A question asked on the home page goes to Anthropic, whose model, Claude, writes the answer from public facts about Wavebook. We keep each question as typed, its language and how it was answered, for 12 months, to improve Wavebook, its answers and our FAQ. An FAQ entry may draw on a question, never on who asked it. Please don’t type personal details there. Legal basis: our legitimate interest in answering visitors and learning what they need.

Limits. To prevent abuse, both use a keyed fingerprint of your network address (a one-way hash, never the address itself), kept for one day.

Beta feedback

Beta testers can send us a note from anywhere in the app. It comes with the page’s address, your window size, your browser and a screenshot of the page. We keep it in Wavebook and copy it to Linear, the tool we track issues in. Only the Wavebook team sees it, and screenshots are deleted after 60 days. Legal basis: our legitimate interest in fixing and improving Wavebook.

Usage analytics

Only with your yes. Until you choose, nothing about it loads.

With your yes, PostHog, on its EU servers, records the pages you open, the features you use (a project created, a comparison played, a link shared…) and the errors Wavebook runs into, with your browser and device type. Your network address is used to estimate a rough location (country, city) and isn’t kept. Once you sign in, these events are linked to your account and email address, so we can see how Wavebook serves each role.

PostHog also records how pages change as you use them (session replays), with everything you type and your notes masked, and without the browser’s console or network traffic. Replays are kept 30 days. Nothing is recorded on pages opened from a listening or drop-off link.

It all goes through Wavebook’s own address, never to advertisers, and is never used to follow you across other sites. Your choice holds for six months on this device; change it here or in Configure › Preferences. Legal basis: your consent (art. 6(1)(a)).

On your device

Wavebook keeps a few things in your browser:

Sign-in session

Keeps you signed in. Necessary.

Preferences

Your language and display choices, and the last email address you signed in with, to fill in the form next time.

Audio and cover cache

Copies of the tracks and covers you’ve played, so they start faster.

Files on this device

Tracks you keep on this device only. They never leave your browser.

Your analytics choice

Your yes or no, for six months.

Analytics (PostHog)

A cookie and a storage entry whose names start with “ph_”, only after your yes. Saying no removes them.

No advertising cookies, and no cookies from other sites.

Who helps us run Wavebook

These companies process data for us, under contracts that bind them to use it only for this:

Supabase

Database, sign-in, file storage and server functions. Servers in Ireland (EU).

Vercel

Hosts the website and the app, and runs the Questions answers and the analytics relay. Global network, US company.

Resend

Sends our emails. United States.

PostHog

Usage analytics, only with your yes. EU servers.

Anthropic

Writes the answers to Questions on the home page. United States.

Linear

Our issue tracker: beta feedback and issue reports. United States.

Google and Dropbox handle your data under your own account with them, and only if you sign in with Google or connect a cloud.

When a provider is in the United States, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the European Commission’s standard contractual clauses. We never sell your data, and we share it with authorities only when the law requires it.

How long we keep it

Your account and what’s in it

As long as your account exists. Deleted within 30 days of your request, then from backups as they roll over.

Files in your Dropbox or Google Drive

Yours, in your cloud. Leaving Wavebook doesn’t delete them.

What arrives through your links

Notes and names from listening links, files and senders from drop-off links: as long as the project keeps them.

Waitlist

Until you leave the list or ask us.

Questions on the home page

12 months.

Fingerprints for limits

One day.

Beta feedback

Screenshots, 60 days. The note, as long as it helps us fix what it raises.

Usage analytics

12 months; session replays, 30 days.

Your analytics choice

Six months.

Server logs at our hosts

A few days to a few weeks, as each host sets them, for security.

Your rights

You can ask to see the data we hold about you, correct it, delete it, receive it in a common format, restrict how we use it, or object to a use based on our legitimate interest. You can withdraw a consent at any time; it doesn’t affect what was done before.

Write to hello@wavebook.cloud, from your account’s address if you have one. To delete your account, just say so: we delete it and your data within 30 days, and tell you first about anything shared with others that would go with it. We answer every request within one month.

If you think we’ve got something wrong, you can complain to the CNIL in France, or to the data protection authority where you live, such as IMY in Sweden.

Security

Everything travels encrypted (HTTPS). Access to each project is enforced in the database, so only its members and the links you create reach it. Cloud tokens are encrypted at rest. Only the Wavebook team can reach your data, to help you or keep the service running. If a breach puts your data at risk, we’ll tell you, and the CNIL, as the law requires.

Age

Wavebook is for people aged 16 and over. If you think someone younger has given us their data, write to us and we’ll delete it.

Changes to this policy

When this policy changes, so does the date at the top. If a change matters, we’ll tell you by email or in the app before it applies.