Privacy Policy

WavePort — iOS App

WavePort is a DJ utility for iPhone that lets you prepare tracks and copy them to a USB drive without a laptop, analyze and organize your music, take song requests and tips from the crowd, and match public playlists against your local library.

This policy explains, in plain language, exactly what data WavePort handles, where it lives, and what your choices are. We have tried to be precise: we describe only what the app actually does, and we do not claim data is "never collected" where a feature does in fact send data to a server.

The short version: Almost everything WavePort does happens entirely on your iPhone. The only data that leaves your device is (1) the information you deliberately publish for your public song-request page, (2) the song requests and tips your audience submits, (3) requests made to Apple and Spotify to identify or look up music, and (4) optional backups you sync through your own iCloud account. WavePort contains no advertising SDKs, no third-party analytics, and no tracking. The app's privacy manifest declares NSPrivacyTracking = false and no tracking domains.

1. Summary of the data we collect

For clarity, and to match the App Store's privacy labels, this is everything WavePort collects. All of it is used solely to make the app work — none of it is used for tracking, advertising, or profiling, and none of it is sold.

Everything else described below either stays on your device or goes to Apple or Spotify under their own privacy policies.

2. Data that stays on your device

The following is stored locally on your iPhone (using the app's sandboxed storage / AsyncStorage) and is not transmitted to us:

• Prep queue and set lists — the file names and metadata of tracks you line up for a gig.
• Transfer history — a local log of files you have copied to USB.
• Metadata cache — BPM, musical key, genre, energy, hot cues, and waveform data that the app computes from your own audio files, cached so it does not have to re-scan.
• App settings — your preferences (theme, transfer options, filename format, crate mode, language, export toggles, tip-link settings, etc.).
• Venue profiles, USB drive history, and Back-to-Back session data.
• Your set history and identified tracklists (see Section 4).

None of this leaves your device unless you turn on iCloud Sync (Section 5) or use a feature that inherently talks to a server (Sections 3 and 4).

Audio file and USB access

WavePort only accesses audio files you explicitly bring in (via AirDrop, the Files app, cloud import, or USB import). It does not scan your music library in the background. When you grant access to a USB drive through the iOS folder picker, WavePort reads and writes only within the folder you selected.

Location (optional, one-time per use)

When you import USB play history, WavePort can perform a single, one-shot location lookup and reverse-geocode it into a place name, purely to suggest a venue name for that session. The reverse-geocoding is performed by Apple's own location services on your device. The suggested name is stored locally with your gig log; the raw coordinates are not retained and are never sent to us. You can decline the location permission and simply type the venue name yourself. Revoke access any time in iOS Settings → Privacy & Security → Location Services → WavePort.

3. The song-request and tip service (server-side data)

If you enable the Track Requests / Tips feature, WavePort uses a backend hosted by Supabase and a payment layer provided by Stripe. This is the only part of WavePort that stores data on a server we operate.

What is stored on the Supabase backend

When you set up your public request page, the app creates a record for you and can store:

• A random DJ ID (a UUID generated on your device — it is what your QR code / request link points to).
• Your DJ display name.
• Your tip links, if you add them — for example a PayPal, Revolut, Venmo, Cash App, Wise, or custom-URL handle you choose to publish.
• A Stripe account identifier, if you connect card/Apple Pay tipping (see below).
• A private secret generated on your device, used to authenticate your app as the owner of your page. It is never placed in your QR code and is never shown to your audience.
• Push notification tokens (Apple Push Notification service) for the devices you want request alerts on, so we can notify you of new requests.

When a member of your audience submits a request through your public page, the following is stored, associated with your DJ ID:

• The song title and artist they typed.
• A free-text note they optionally added.
• A tip amount they indicated.
• A status (new / played / dismissed) and a timestamp.

Your audience submits this anonymously — the request form does not ask them to create an account, and it does not collect their name, email, or phone number. Please be aware that anything a requester freely types into the note field is stored as-is; you as the DJ see it in your in-app inbox.

Access is locked down. The backend's database is configured with row-level security and zero direct public access; every read and write goes through server functions that check the private secret above before returning anything. Your audience-facing page can only submit a request and read your published tip links — it cannot read your inbox, your secret, or your payout details.

The data described in this section is stored in a project hosted by Supabase, a third-party cloud infrastructure provider, and is governed in transit and at rest by Supabase's Privacy Policy.

Tips and payments (Stripe)

WavePort offers two ways to take tips, and you choose which:

• Tip links — you publish your own PayPal / Revolut / Venmo / Cash App / Wise / custom handle. When a fan taps one, they leave WavePort's page and pay you on that third party's own service, under that service's own privacy policy. WavePort only stores the handle you chose to publish.
• Card and wallet tips via Stripe — if you connect a payout account, your audience can tip directly on the request page. Payment details are entered into a payment form supplied and operated by Stripe, which supports Apple Pay, Google Pay, and cards; where that form cannot be used, the fan is sent to a Stripe-hosted checkout page instead. In both cases Stripe collects and processes the payment details — WavePort never sees or stores card numbers.

To be paid out, you complete Stripe Connect onboarding, in which Stripe collects your identity and bank details directly; that information goes to Stripe, not to us. A platform fee is applied to Stripe tips. Stripe's handling of this data is governed by Stripe's Privacy Policy.

Connected payout accounts are currently supported only in countries where our payment platform can create them — the United States, the United Kingdom, the European Economic Area, Canada, and Switzerland. Elsewhere, the tip-link option above remains available.

Promo codes

If you redeem a promotional access code, the backend records the code and a device identifier so the same code can't be redeemed twice on the same device. No other personal data is tied to this.

4. Music identification and lookup

Live Tracklist / microphone (optional)

If you use the automatic set-logging feature, WavePort uses the microphone together with Apple's ShazamKit to identify the tracks playing in the room.

• The audio is turned into a mathematical acoustic signature on your device. That signature — not the audio — is what leaves your phone, and it goes to Apple to be matched against Apple's music catalog.
• No audio is ever recorded, stored, or transmitted, by us or by Apple, and the signature cannot be turned back into sound.
• The matches that come back (title, artist, artwork link, timestamp) are stored locally on your device in your set history. We do not receive them.
• ShazamKit's handling of the signature is governed by Apple's Privacy Policy.

You can revoke microphone access at any time in iOS Settings → Privacy & Security → Microphone → WavePort.

Apple Music search (optional)

WavePort can search the Apple Music catalog so you can add reference tracks to your request lists. These searches are sent to Apple and are governed by Apple's Privacy Policy. WavePort does not transfer Apple Music audio to USB — Apple Music content is protected and is used for search and reference only.

Spotify playlist matching (optional)

WavePort can take a public Spotify playlist link that you paste or share into the app and match its track list against the music already in your own local library.

• There is no Spotify login and no Spotify account connection in this version of the app. WavePort does not ask for your Spotify credentials and does not store any Spotify tokens for you.
• The playlist link you provide is sent to our backend, which fetches that public playlist's track list from Spotify and returns it to your device. Only the link you chose to share is involved.
• WavePort does not download or transfer any music from Spotify (Spotify audio is DRM-protected). Spotify is used for discovery and matching only.
• Spotify's handling of these requests is governed by Spotify's Privacy Policy.

5. Apple services

• iCloud Sync (optional, off by default). If you turn it on, WavePort saves a backup of your own app data (prep queue, set lists, history, settings, metadata cache, venues, B2B, USB drives) into your personal iCloud Key-Value Store. This is tied to your Apple ID and stays within your Apple account; Apple performs the synchronization. We do not have access to it. You can turn it off in Settings → iCloud Sync. iCloud is governed by Apple's Privacy Policy.
• Subscriptions (StoreKit). WavePort Pro is an auto-renewing subscription sold through Apple's In-App Purchase. Apple handles the payment and billing entirely — WavePort never receives or stores your payment method. The app asks Apple's on-device StoreKit service only whether a subscription is currently active, and that answer stays on your device; it is not sent to our backend. Purchases are governed by Apple's Privacy Policy. Manage or cancel any time in iOS Settings → your Apple Account → Subscriptions.
• Push notifications (APNs). With your permission, WavePort registers for Apple Push Notifications so you can be alerted to new song requests (see Section 3).
• App Store review prompt. The app may ask you to rate it using Apple's native review prompt. No personal data is sent to us through it.

6. What we do NOT do

• No advertising and no ad SDKs.
• No third-party analytics, telemetry, crash-reporting, or tracking SDKs (no Firebase, Sentry, Amplitude, Mixpanel, Segment, or similar are bundled in the app).
• No tracking across apps or websites; the app's privacy manifest sets NSPrivacyTracking to false.
• We do not sell your data, and we do not build advertising profiles.

7. Data retention

• On-device data stays until you delete it in the app or uninstall the app.
• Song requests remain in the backend associated with your DJ ID until deleted. The app lets you mark individual requests as played or dismissed, and there is no automatic time-based purge of request rows in the backend; you can erase all of your backend data at any time from within the app (see Section 8).
• Push tokens, tip links, DJ name, and Stripe account reference remain until your DJ record is deleted.
• Payment records held by Stripe are retained by Stripe under its own policies and legal obligations.

8. Your choices and deletion

• On-device data: delete set lists, history, and other items in the app, or delete the entire app to remove all local data.
• iCloud backup: turn off iCloud Sync in Settings; you can also remove WavePort's data in your iCloud settings.
• Request-page / backend data: you can mark individual requests as played or dismissed inside the app. To erase everything the backend holds for you, open the Track Requests screen and tap Delete my request page & data at the bottom. This permanently deletes your DJ record on the server, which cascades to remove all of your stored requests, device (push) tokens, tip links, and Stripe account reference — your on-device tracks are not affected. If you would rather we do it for you, contact us at the address below and we will delete them.
• Stripe: to close a connected payout account or request erasure of the identity/bank data Stripe holds, use Stripe's own tools or contact Stripe.

To make any request about your data, email waveportsupport@gmail.com.

9. Children

WavePort is a professional DJ tool and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided information through the request feature, contact us and we will remove it.

10. Changes to this policy

We may update this policy as the app evolves. When we do, we will change the effective date at the top of this page. Significant changes will be reflected here before they take effect.

11. Contact

Questions about this policy or your data:
waveportsupport@gmail.com

WavePort is developed by Aytac Ataer.

© 2026 Aytac Ataer · WavePort