Privacy Policy
This policy explains what information Wavra (“we”, “us”) collects when you use wavra.io, why we collect it, and the control you have over it. Wavra is a platform for storing, versioning and sharing music with collaborators and A&R teams.
Wavra is operated by TPCOMMERCE LTD, a company registered in the United Kingdom (Tomasz Podlaszewski). For any privacy question, contact privacy@wavra.io.
1. What we collect
We only collect what the service needs to work:
- Account information— your email address, username, display name, the role you choose (producer, artist or A&R), and a securely hashed version of your password. We never store your password in readable form.
- Content you upload — audio files, project files (such as DAW projects and stems), album artwork, your profile picture, comments, and messages you send in direct messages and team chats.
- Usage and technical data — play counts on your tracks, a “last seen” timestamp so collaborators and the operator can see who is active, and your IP address, which is used transiently to protect the service against abuse (rate limiting) and is not stored as part of your profile.
- Verification — a short-lived code we email you to confirm your address when you sign up.
We do not use advertising or tracking cookies, we do not run third-party analytics, and we do not sell or rent your personal data to anyone.
2. How we use it
- To create and secure your account and keep you signed in.
- To store your music and make it available to you and the people you share it with.
- To send service email — the verification code, and notifications you have set up.
- To show basic activity (plays, comments, who is online) to you and, where relevant, your collaborators.
- To protect the service from abuse and enforce fair-use limits.
3. Legal bases (UK/EU GDPR)
Where GDPR applies, we rely on: contract (running the account and service you signed up for), legitimate interests (keeping the service secure and functioning), and legal obligation where we must retain or disclose information by law.
4. Cookies and local storage
Wavra sets a single, strictly-necessary cookie — your login session. It is HttpOnly, sent only over HTTPS in production, and exists solely to keep you signed in. Because it is essential to the service, it does not require consent.
We also use your browser’s local storage (not a cookie, and never sent to our servers) to remember small preferences such as your light/dark theme choice and whether you have dismissed onboarding prompts.
5. Who processes your data
We use a small number of infrastructure providers (sub-processors) to run Wavra. They process data on our behalf under their own terms:
- Render — application hosting and the database.
- Cloudflare (R2 and network) — storage of uploaded files and content delivery.
- IONOS — the mail server that sends verification and notification email.
- Google Fonts — fonts are loaded from Google’s servers, which means your browser’s IP address is shared with Google when a page loads. No account data is shared this way.
6. Where your data is stored
Your data is stored on the infrastructure of the providers above and may be processed in the regions where they operate. Where data is transferred internationally, those providers maintain their own safeguards for such transfers.
7. How long we keep it
- Account data and content are kept for as long as your account exists.
- Accounts that never complete email verification are deleted automatically after 7 days.
- Verification codes expire within 15 minutes.
- When you delete your account, we permanently remove your profile, tracks, project files, share links and messages, and the associated files in storage.
8. Your rights
You can:
- Access and correct your information from your profile settings.
- Delete everything yourself, at any time, using the account-deletion tool in Settings — this is permanent and immediate.
- Request a copy of your data, or raise any privacy question, by emailing us.
If you are in the UK or EU and are unhappy with how we handle your data, you have the right to complain to your data protection authority (in the UK, the Information Commissioner’s Office).
9. Security
Passwords are hashed with a per-user salt, traffic is served over HTTPS, sessions use long random tokens, and access to your content is checked on every request. No system is perfectly secure, but we take reasonable measures to protect your information.
10. Children
Wavra is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, please contact us.
11. Changes
We may update this policy as the service evolves. When we do, we will change the date at the top of this page.
12. Contact
Questions about this policy or your data? Email privacy@wavra.io. See also our Terms of Service.