Privacy Policy
Last updated: October 2026 • Effective immediately
1. Fundamental Architecture: Zero Server Audio Uploads
At SoundWell, our defining product feature and privacy architecture are one and the same: your audio files are never uploaded to our servers, never transmitted across external networks, and never stored in the cloud.
When you drag & drop an audio track into SoundWell, the file is read and decoded entirely within your local browser's memory using the native Web Audio API (AudioContext and OfflineAudioContext). Every digital signal processing operation—resampling, filtering, convolution reverberation, wow/flutter modulation, and final WAV encoding—executes locally on your device hardware.
Because no audio bytes are transmitted to any backend infrastructure, we have no technical ability to listen to, inspect, analyze, copy, or retain your audio tracks.
2. Data We Collect and Why
We only collect personal information when strictly required to authenticate users, facilitate payments, maintain service quotas, or answer customer support requests.
A. Free Visitors (No Login)
- No personal profile data is collected or stored on our servers.
- Local Usage Quota: To enforce the 4-tracks-per-day free tier, a lightweight counter and timestamp are saved in your browser's
localStorage(vibe.free.tracks.v1). A pseudonymous client hash may be verified against our rate-limiting API to prevent bot abuse. - UI Preferences: Your slider values and effect toggle preferences are remembered locally on your device (
vibe.settings.v1.*).
B. Creator Pro Subscribers (Google Sign-In)
If you choose to unlock Creator Pro, authentication is performed via Google OAuth delegated through Supabase Auth. We collect and store:
- Account Identity: Unique Supabase User UUID, email address, display name, and avatar image URL (synchronized from your Google profile).
- Subscription Record: Razorpay customer ID, subscription ID, subscription status (
active,cancelled,past_due), current billing cycle end date, coupon redemption records, and loyalty pricing tier.
C. Contact Form Inquiries
When you submit our support form, we collect your name, email address, subject matter, and message text exclusively to answer your question. This information is retained only for the duration required to resolve your inquiry.
3. Payment Information and Security
Payment transactions for Creator Pro subscriptions are processed securely by Razorpay, an authorized, PCI-DSS Level 1 compliant payment processor.
SoundWell never collects, receives, processes, or stores your credit card numbers, debit card details, CVV codes, net banking passwords, or UPI PINs. All payment credential inputs are captured directly within Razorpay's encrypted checkout iframe.
Our backend receives only cryptographic webhook notifications confirming whether a subscription transaction succeeded, updated, or was cancelled, along with tokenized identifiers required to manage your Pro access.
4. Cookies and Local Storage Inventory
We do not use tracking pixels, advertising cookies, or behavioral trackers. Below is an exhaustive list of client-side storage technologies used on SoundWell:
| Storage Key | Mechanism | Purpose | Classification |
|---|---|---|---|
| sb-*-auth-token | localStorage | Stores Supabase JWT session token to keep logged-in users authenticated across page visits. | Strictly Necessary |
| vibe.settings.v1.* | localStorage | Remembers user slider positions and preset selections across visits. | Functional Preference |
| vibe.free.tracks.v1 | localStorage | Stores the free daily track count and date stamp to enforce daily quotas locally. | Strictly Necessary |
| vibe.user.v1 | localStorage | Caches display name and avatar URL for instantaneous header rendering. | Functional Preference |
| checkout.razorpay.com | Session Cookie | Loaded only on payment checkout page to verify payment fraud prevention. | Strictly Necessary (Payment) |
For further details on controlling or clearing browser storage, see our dedicated Cookie Policy.
5. Third-Party Service Providers
We share only the minimum necessary technical information with trusted third-party cloud infrastructure providers:
- Supabase: Provides cloud authentication services and hosted PostgreSQL database storage for user profiles and subscription status records.
- Razorpay: Processes recurring payments and manages subscription lifecycles.
- Cloudflare / Vercel: Provides secure Content Delivery Network (CDN) edge hosting, DDoS protection, and SSL encryption for website files.
We never sell, rent, monetize, or trade user data to data brokers, ad exchanges, or marketing aggregators under any circumstances.
6. User Rights & Self-Service Account Deletion
You have full ownership of your data. Under applicable privacy frameworks (including GDPR, CCPA, and India's Digital Personal Data Protection Act):
- Right to Erasure / Account Deletion: You can delete your account at any time. When signed in, click your avatar menu in the header and select Delete account. This triggers an immediate, permanent API call (
DELETE /api/account) that deletes your profile row from Supabase, revokes your authentication credentials, and cancels active Razorpay subscriptions. - Right of Access & Portability: You may request an export of any personal account data associated with your profile by contacting support.
- Right to Rectification: Since profile data synchronizes from your Google account, updating your Google profile will update your SoundWell profile upon your next login.
7. Data Retention
- Audio files: 0 seconds retention (never transmitted or saved).
- Free quota counters: Reset automatically at local midnight.
- Account and profile data: Retained for as long as your account remains active or until you initiate account deletion.
- Financial transaction metadata: Retained as required by applicable taxation, accounting, and anti-fraud regulations.
8. Contact Information & Data Officer
If you have any questions about this Privacy Policy, wish to exercise your legal data rights, or have security concerns, please contact our privacy desk:
Email: Not yet provided (Please use our Contact Form)
Attention: Privacy & Data Protection Officer
Inquiries: Direct email is not yet provided. Please submit inquiries via the Contact Form.