Privacy Policy

1. Who we are and what this covers

This policy describes how Arcwave (operated by an individual operator, reachable at hello@arcwave.app) handles personal data when you use arcwave.app. It should be read together with the Terms of Use.

2. Data we collect

• Account data — when you sign up, our authentication provider (Clerk) collects your email address, optional name and avatar, and sign-in metadata. We reference your account by an internal ID.
• Listening data — chapter progress positions, bookmarks, completed chapters, and per-day listening seconds (used to enforce the free tier's daily limit and to show your quota).
• Requests and votes — titles you request, notes you attach, and votes you cast.
• Billing status — if you subscribe, our payment processor (Whop) sends us your plan, subscription status, and period dates. Card numbers and full payment details stay with the processor; we never receive them.
• Technical data — standard server logs (IP address, user agent, requested URLs) kept briefly by our hosting providers for security and debugging, and error reports (which may include IP and browser details) via our error-monitoring service.
• Usage analytics and conversion measurement — we use PostHog, Google Analytics 4, and Google Ads conversion measurement to measure aggregate, pseudonymous usage (pages viewed, navigation, interactions, scroll depth, web performance, conversion page visits, approximate city/country, device and browser type, and referrer). PostHog uses cookieless, privacy-preserving measurement until you accept persistent analytics. With your consent, PostHog may use first-party storage and Google may set measurement cookies such as _ga. Google otherwise runs in Consent Mode without analytics or ad cookies. We use this data to understand and improve the Service and measure campaigns — not for remarketing or personalized targeting.

We do not use remarketing cookies, personalized-ad targeting cookies, or sell personal data.

3. Why we process it

• To provide the Service (contract): accounts, playback, progress sync, quotas, subscriptions.
• To keep the Service working and safe (legitimate interest): debugging, abuse and fraud prevention, enforcing listening limits.
• To respond to you (legitimate interest / legal obligation): support requests, legal notices, copyright complaints.

We do not use your data for profiling or automated decisions with legal effect.

4. Cookies and local storage

• Essential cookies — set by Clerk to keep you signed in. The Service does not work signed-in without them.
• Measurement cookies and storage — PostHog's first-party analytics storage and Google measurement cookies, such as _ga, are enabled only after you accept in the cookie banner. Until then PostHog uses cookieless measurement and Google tags run in consent mode. Change or withdraw your choice anytime via "Cookie preferences" in the footer, or use your browser controls / Google's opt-out add-on (tools.google.com/dlpage/gaoptout).
• Local storage — your browser stores player preferences and lightweight state (for example bookmarks cache and playback position) locally to make the player feel instant.

We do not use remarketing or personalized-ad targeting cookies.

5. Processors we rely on

Arcwave runs on a small set of infrastructure providers that process data on our behalf:

• Clerk — authentication and account management.
• Whop — payments, subscriptions, and checkout.
• Vercel — web hosting and content delivery.
• Railway — API hosting.
• Neon — database hosting.
• Cloudflare — media storage and delivery (R2/CDN).
• Sentry — error monitoring.
• PostHog — cookieless and consented product/web analytics.
• Google Analytics / Google Ads (Google LLC) — pseudonymous usage analytics and conversion measurement.

These providers are primarily US-based; by using the Service you understand your data may be processed in the United States and other countries with different data-protection laws than your own.

6. Retention

Account and listening data are kept while your account is active. Server logs and error reports are retained on short, provider-default windows. When you delete your account (or ask us to), we delete or de-identify your personal data within a reasonable period, except records we must keep for legal, billing-dispute, or security reasons.

7. Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise any of these, email hello@arcwave.app from the address on your account — we honor these requests regardless of jurisdiction. You may also have the right to complain to your local data-protection authority.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, contact hello@arcwave.app and we will remove it.

9. Changes and contact

We may update this policy as the Service evolves; the date above reflects the current revision, and material changes will be signposted on the site. Privacy questions and requests: hello@arcwave.app.