Privacy Policy

This Privacy Policy explains how WaveCanvas (“we”, “us”, or “our”), operated by Grateful Today Ltd (trading as wavecanvas.io), collects, uses, and stores information when you use our audio visualiser and video creation platform.

1. Information We Collect

Account Data

• Email address and display name when you register
• Encrypted password (handled by Firebase Authentication — we never see your raw password)
• Account creation date and subscription tier (Free, Pro)

Files You Upload

• Audio files and images you upload are stored in your media manager and remain stored for as long as you choose to keep them
• Generated videos are stored for 7 days and then automatically deleted
• You can delete your media assets at any time individually, or they will be removed if you delete your account
• We do not access, view, or monitor your uploaded content

Usage & Render Data

• A record of each video render you create (render ID, settings, timestamps)
• Monthly render count for rate-limiting purposes

YouTube Integration Data

• If you choose to connect a YouTube channel, we store an OAuth access token and refresh token in your account record in Firestore
• We also store your channel ID, channel title, and channel thumbnail URL
• These tokens are used solely to upload videos and Shorts to your YouTube channel on your instruction
• You can disconnect YouTube at any time from your account settings, which removes all stored tokens

Payment Data

• Payment processing is handled by Stripe. We do not store your card details
• We store your Stripe Customer ID and (if applicable) Stripe Subscription ID in your account record
• Subscription status (active, cancelled, past due) and plan type are also stored

Analytics Data

• We may use analytics tools to understand how visitors use our site
• This includes anonymous usage patterns, clicks, and navigation behaviour
• You can opt out by declining cookies in our cookie banner

2. How Your Data is Processed

When you create a video:

• Audio and image files are processed in your browser for preview
• When you render a video, files are uploaded to Firebase Storage
• Video rendering happens either in your browser or on cloud servers (Remotion Lambda on AWS)
• Generated videos are stored in Firebase Storage with a unique URL
• You receive a download link that remains active for 7 days

When you use AI-powered features (such as lyric transcription or prompt generation):

• Relevant content (e.g. audio or text) may be sent to our AI provider (Anthropic) to generate results
• This data is used solely to fulfil your request and is not used to train AI models

When you upload to YouTube via WaveCanvas:

• Your stored OAuth token is used to authenticate the upload request with the YouTube Data API
• Video metadata (title, description, tags, privacy setting) you provide is sent directly to YouTube
• We do not retain a copy of uploaded video metadata beyond your render record

3. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Firebase authentication session cookies, required for login to function
• Analytics cookies: Anonymous usage data to help us improve the product (optional — requires your consent)
• Support chat: Crisp embeds a chat widget which may set its own cookies
• Cookie preferences: Your cookie consent choice is stored in browser local storage

We do not use advertising cookies or sell your data to third parties.

4. Third-Party Services

WaveCanvas uses the following third-party services:

• Firebase / Google: Authentication, Firestore database, and Firebase Storage for files and account data
• Remotion Lambda / AWS: Cloud rendering for high-quality videos
• YouTube Data API (Google): Used when you choose to publish videos to your YouTube channel
• Stripe: Payment processing for Pro subscriptions
• Anthropic: AI-powered features (lyric transcription, prompt generation)
• Mailgun: Transactional emails (account verification, receipts)
• Crisp: In-app support chat
• Vercel: Website hosting and content delivery

We do not sell your data or share it with advertising networks.

5. Data Security

• All data in transit is protected with HTTPS/TLS encryption
• Passwords are never stored in plain text — authentication is managed by Firebase
• YouTube OAuth tokens are stored server-side in Firestore and are not exposed to the browser
• Firebase Storage uses industry-standard access controls
• Download URLs are unique and non-guessable
• Generated videos are automatically deleted after 7 days

6. Your Rights

You have the following rights regarding your data:

• Access: You can view your account information and render history in your dashboard
• Deletion: You can delete your account at any time; this removes your profile data, render history, and YouTube tokens
• YouTube disconnection: You can revoke WaveCanvas's access to your YouTube account from your account settings at any time
• Opt-out of analytics: Decline analytics cookies via the cookie banner
• Data portability: Download your videos at any time via the link provided
• Contact: To request data export or deletion, contact us via the contact page

7. Data Retention

• Generated videos are automatically deleted after 7 days
• Uploaded media assets (audio files and images) are retained in your media manager for as long as you keep them
• Account data is retained while your account is active
• YouTube OAuth tokens are retained until you disconnect your channel or delete your account
• Stripe billing records are retained as required by financial regulations

8. Children's Privacy

WaveCanvas is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, please contact us and we will remove it promptly.

9. Changes to This Policy

We may update this privacy policy from time to time. Any significant changes will be communicated via email or an in-app notice. The latest version will always be available at wavecanvas.io/privacy.

10. Company Information

WaveCanvas is operated by:

11. Contact

If you have questions about this privacy policy or wish to exercise your data rights, please contact us via our contact page or write to us at the registered address shown above.