Who is responsible
swave is a social listening service for adults. Controller identity, postal address and a dedicated rights-request contact are pending. They must be provided here before public launch.
What we process
Account email and sign-in provider, profile name, photo URL, username, adult confirmation, founding song and story, identity choices and terms acceptance. We also process connections, blocks, reports, messages, voluntary listening sensations with playback timestamps, notification preferences and activity notifications. Security and hosting services may process IP addresses, device information and operational logs.
Purpose and legal basis
Account, chat, playback coordination and account management are necessary to provide the service you request (contract). Abuse prevention and service security rely on legitimate interests, subject to balancing and your rights. Parish is optional and requires an explicit location choice (consent). Legal obligations may require specific processing. Voluntary sensations are subjective listening signals, not health diagnoses; swave does not infer your overall mood.
Visibility and location
Everyone, Only connections and Nobody control the visibility of your identity. Anonymous aliases do not make public room messages private: visitors can read recent room messages. Direct messaging requires an accepted connection. Parish stores only a coarse geohash of at most five characters, never raw coordinates; you can leave at any time. Map results exclude blocks in both directions. Room presence is temporary live presence.
Providers and local storage
Lovable Cloud provides hosting, account and data services. Apple provides music search, previews and optional Apple Music playback; sign-in providers process their own authentication. Apple Music permission is separate from swave identity. MusicKit manages its music authorization locally; swave does not store music-user tokens in account tables. OpenStreetMap tiles involve requests to the tile provider. Essential browser storage keeps sign-in and music authorization working. This phase adds no advertising cookies or individual affiliate click/subscription tracking.
The controller must confirm provider agreements, processing locations, international-transfer safeguards and the deployed storage/cookie inventory before launch. Where transfers outside the EEA occur, an applicable adequacy decision or appropriate safeguards are required.
Retention and deletion
Public room history shows the last 24 hours; that visibility limit is not an automatic deletion deadline. Older authored echoes can remain stored. Connections, conversations, notification history and moderation data currently remain until deletion or a separately implemented retention process. Parish map visibility expires after six hours. Exact operational log and provider retention periods must be confirmed before launch; a 30-day notification cleanup is not yet implemented.
Deleting your account removes your profile, authored echoes and sensations, Parish presence, connections and their entire direct conversations (including the other participant's messages), blocks, reports by or about you, and notifications received by or attributed to you. Messages that structurally mention you, account-linked username quarantine and admin audit records, and drops you created are also removed. Shared music catalog entries remain. Copies downloaded by other people and independent provider data cannot be remotely erased. Provider-managed backups can persist until their retention expires; deletion does not promise immediate removal from backups.
Your rights
You may request access, correction, erasure, restriction, portability and, where applicable, object to processing. You may withdraw optional location consent by leaving Parish. In My profile you can change your information, download a JSON copy of account data or delete your account. This download excludes passwords, access tokens and other listeners' private account details. Contact details for any rights not handled in-app are pending. GDPR requests normally receive a response within one month, subject to permitted extensions. You may complain to your competent supervisory authority, including Italy's Garante where applicable.
Adults and updates
swave is restricted to people aged 18 or older. If data from a minor is identified, the controller must investigate and take appropriate action. Material policy changes will require an updated notice; terms acceptance is recorded separately from consent to optional location or music permissions.