Privacy Policy

Rewave (rewave.net) is operated by TokenMade LLC, A Wyoming limited liability company. TokenMade LLC is the controller of the personal data described here.

This policy is published in English; the English text governs. For any privacy question, write to support@rewave.net.

Account details. If you register with an email address, we store that address, a display name derived from it, and a hashed password — never the password itself. If you sign in with Google, we receive your name, email address and profile picture from Google; we never receive your Google password.

What you create. The prompts, lyrics, style descriptions and settings you submit, and the tracks, stems and MIDI files generated from them, are stored so you can find them again in your history.

Audio you upload. Files you upload for stem separation, vocal removal, MIDI extraction or extension are stored in our object storage together with the file name and size. See section 6 for exactly where they go.

Payments. Checkout runs on Stripe. Stripe sends us the outcome, the amount, the plan and an identifier for the transaction. We never see or store your full card number.

Usage data. Our analytics records page views, which features are used, and coarse device and browser information. Analytics events deliberately exclude your email address and the text you write — prompts and lyrics never enter them.

Support. If you email us, we keep the message and our reply.

• To run the Service — generating and processing audio, showing your history, applying your credit balance, issuing licence certificates. Basis: performance of our contract with you.
• To take payment and keep billing records. Basis: contract, and our legal obligations.
• To keep the Service working and safe — diagnosing errors, preventing abuse, enforcing credit limits. Basis: our legitimate interests.
• To understand how the Service is used and decide what to build next. Basis: our legitimate interests in improving the product.
• To contact you about your account, and — if you have asked for them — product updates. Basis: contract, and consent for marketing email.

We do not use your prompts, lyrics, uploads or generated tracks to train our own models, and we do not sell them.

We rely on a small number of providers to operate the Service. They may process your data only on our instructions and only for the purpose listed.

• Cloudflare, Inc. — hosting, database, object storage, background job queues and outbound email. Effectively all data described here is stored on Cloudflare's infrastructure.
• Stripe, Inc. — payment processing, subscription billing and invoices. Stripe acts as its own controller for payment data; see Stripe's privacy policy.
• AI model providers — third-party services that carry out music generation and audio processing. They receive the prompt, lyrics and style settings for a task, and — for upload tools — a link to the audio file you uploaded.
• Language model provider — receives the text you enter when you ask for lyric or style suggestions, and returns the suggestion.
• Google — only if you choose to sign in with Google, and only to authenticate you.

Our analytics is self-hosted on infrastructure we control; usage data is not sent to a third-party analytics company or to any advertising network.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Beyond the providers listed above, we disclose data only:

• When you make something public yourself — for example by sharing a licence verification link, which shows the certificate holder’s name and the track title
• To comply with law, a court order or a valid legal request
• To investigate suspected fraud, abuse, or breaches of our Terms, or to protect the rights and safety of users and the public
• To a buyer or successor if the business is sold or reorganised — you will be told before your data is transferred to a different controller

Generated tracks and uploaded files are stored in Cloudflare R2 object storage under an address containing a random identifier. That address is unlisted, but readable by anyone who has it — it has to be, because the AI provider fetches the file from there in order to process it. The addresses are not indexed and are not published, but they are not password-protected.

Do not upload recordings that are confidential or that you would not want reachable by someone holding the link.

Account details, your generated tracks and the files you have uploaded are kept while your account exists, so that your history and your licence certificates stay available. Ask us to close your account and we delete them, except where we must keep something longer.

Billing records are kept for as long as tax and accounting law requires. Records of issued commercial licence certificates are kept indefinitely — a certificate is meant to be verifiable years after it was issued, and deleting the record would make it worthless. Analytics data is retained in aggregate.

To request deletion, write to support@rewave.net from the address on your account.

TokenMade LLC is based in the United States, and our providers operate globally. If you use the Service from the European Economic Area, the United Kingdom or Switzerland, your data will be transferred to and processed in the United States and other countries. Those transfers take place under the data processing terms of the providers listed above, which include the safeguards those providers make available for international transfers.

We set a cookie to keep you signed in and to remember your language and preferences. These are essential to the Service and cannot be turned off while you are using an account. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser, but you will not be able to stay signed in.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a portable copy, to object to or restrict certain processing, and to withdraw consent you have given.

If you are in the EEA, the UK or Switzerland, these rights come from the GDPR and you may also complain to your local supervisory authority. If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct and opt out of sale or sharing — as stated above, we do not sell or share personal information, and we will not discriminate against you for exercising any right.

Write to support@rewave.net from the email address on your account and we will respond within the period required by the law that applies to you.

Data is encrypted in transit with TLS and at rest by our storage providers, passwords are stored only as salted hashes, and access to production systems is limited. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us personal data, contact support@rewave.net and we will delete it. Purchases require an adult — see our Terms of Service.

We may update this policy. When a change is material we will update the effective date above, and where practical we will also flag it in the Service. Continuing to use Rewave after a change means you accept the updated policy.

TokenMade LLC, operator of Rewave (rewave.net). Privacy questions, data requests and complaints: support@rewave.net.