Privacy Policy

1. Who we are

This privacy policy explains how Formosa Soundworks Studio ("we," "us," "our") collects and handles personal information through the WAVScribe website (wavscribe.com) and the WAVScribe desktop software ("the App").

We are a sole proprietorship based in Kaohsiung, Taiwan (R.O.C.). WAVScribe is currently sold as a one-time purchase. Lemon Squeezy acts as Merchant of Record for every purchase - they handle payment, tax, and customer billing on our behalf.

This policy covers both the website and the App. The two have different data practices and we describe them separately.

2. What we collect - the website

Visiting the site

We have not added Google Analytics, Plausible, Fathom, Matomo, Hotjar, or any behavioral web-analytics tool to the site. The wavscribe.com domain does not set its own cookies (see Section 12 for cookies set by Lemon Squeezy during checkout). There are no embedded tracking pixels, no chat widgets, no third-party comment systems, and no externally loaded fonts - all fonts are self-hosted.

Our web host (Hostinger) and CDN (Bunny.net) automatically process standard server/CDN request data and aggregated hosting/CDN analytics as part of delivering the site. These include requesting IP address, timestamp, requested URL, HTTP method, User-Agent string, referrer, status code, and response size. Retention details are in Section 8. We do not download these logs for our own marketing, profiling, or analytics purposes.

Newsletter signup

If you sign up for the WAVScribe newsletter, your email address, the timestamp of your opt-in, and your IP at signup are transmitted to MailerLite (our newsletter provider, headquartered in Lithuania, EU). MailerLite sends a double-opt-in confirmation email; once you click the confirmation link, your address is added to the WAVScribe list. We use this list only to send product updates and release announcements.

MailerLite also provides standard newsletter analytics - delivery, opens, clicks, bounces, and unsubscribes - for the messages we send through their service. We use these statistics only to operate the mailing list and understand whether product announcements are being delivered and read.

• Legal basis (GDPR / UK GDPR): consent, confirmed by double opt-in.
• You can unsubscribe at any time using the unsubscribe link at the bottom of every newsletter.

Contact form

If you send us a message through the contact form, your name, email, message body, submission timestamp, and IP are transmitted to Web3Forms (our form processor, based in the United States). Web3Forms processes the submission and forwards it to contact@wavscribe.com, our business email account hosted by Namecheap (Private Email). Web3Forms may retain submission-related data according to its own privacy policy.

We use this information only to reply to your inquiry. We do not add contact-form submitters to the newsletter or any other marketing list.

• Legal basis (GDPR / UK GDPR): legitimate interest (responding to a user-initiated message).

What the website does not collect

• We do not collect precise geolocation, biometric data, health information, or government identifiers through the website.
• We do not directly collect or store payment-card details. Card data is handled by Lemon Squeezy and its payment-processing providers.
• We do not knowingly collect personal data from individuals under the age of 16. See Section 10.

We do not intentionally collect special-category personal data (as defined in GDPR Article 9) or sensitive personal information (as defined in the CPRA).

3. What we collect - purchase

When you buy WAVScribe, the checkout opens within the wavscribe.com site using Lemon Squeezy's embedded checkout. Lemon Squeezy collects the personal information needed to process the purchase: your name, email address, billing country, payment details, and any tax information required by your jurisdiction. Card data is handled by Lemon Squeezy and its payment-processing providers - we never see it.

From Lemon Squeezy we receive: your name, email address, and country. Lemon Squeezy sends the initial purchase confirmation and license key directly to you as part of the checkout flow. We use the customer information passed to us to provide post-purchase support - resending a license key on request, troubleshooting activation issues, processing refund inquiries - and to meet our tax and accounting obligations.

Lemon Squeezy acts as Merchant of Record and independent controller for payment, tax, billing, fraud-prevention, and checkout activities. For license-management data handled on our behalf, Lemon Squeezy may also process data under its Data Processing Agreement. Their own privacy policy (lemonsqueezy.com/privacy) governs how they handle data on their side.

4. What we collect - the WAVScribe desktop app

The App is installed on your Windows computer. It makes a small, fixed set of network calls. We describe each of them in concrete terms here.

4.1 License activation, validation, and deactivation

The App communicates with Lemon Squeezy's licensing API at api.lemonsqueezy.com over HTTPS.

• First activation on a machine. The App transmits your license key and your machine's hostname (returned by Python's socket.gethostname() - typically something like DESKTOP-AB123 or whatever you have named your computer). Lemon Squeezy returns a unique installation identifier, which the App stores locally.
• Validation. Once activated, the App validates your license once every 24 hours on launch. It transmits your license key and the installation identifier. Your hostname is not re-transmitted after activation. If the App detects that no network connection is available, validation is skipped. If validation cannot be completed because the server is unreachable or the request fails, the App continues to work during the 30-day grace period.
• Deactivation. When you deactivate an installation via Help → License → Deactivate, the App transmits your license key and the installation identifier, then deletes the local license file. If a refund is processed for a purchase, Lemon Squeezy may also deactivate the associated license server-side.

Hostname disclosure. Some users name their computers in a way that includes their real name (for example, "Jane-MacBook"). If your hostname identifies you and you prefer not to share that with our licensing provider, you can rename the machine in Windows before activating the App.

4.2 Update check

The App checks for new versions by fetching https://wavscribe.com/version.json - a static file on our server. This check runs five seconds after the main window appears on each launch, and also when you click Help → Check for Updates.

The update check is a plain HTTPS GET. The App sends no query parameters, no cookies, no authentication, and no identifying information beyond what any standard web request includes (IP address and User-Agent string, recorded in Hostinger's server access logs).

4.3 Local network probes

When you access an audio file on a mapped network drive (for example, a NAS at 192.168.1.10), the App probes whether the drive is reachable by attempting a TCP connection to port 445 (SMB). This is a local-network operation only - nothing is transmitted to us or to any third party. The probe is performed against your own hardware on your own network.

4.4 Local logs

The App writes operational logs to %LOCALAPPDATA%\WavScribe\logs\wavscribe.log on your computer. These logs rotate at 1 MB and keep three backup files. They stay on your computer. The App has no mechanism to upload these logs to us.

Local logs may include technical events, errors, and local file paths involved in those events. If you choose to email a log to support during troubleshooting, that is your own action.

4.5 Browser launches

A few menu items in the App (the user manual, the EULA, the download page, the homepage) open links in your default web browser. When you click these menu items, the App asks Windows to open the URL in your default browser. From that point, the request is handled by your browser and any browser extensions, settings, cookies, or accounts you use. The App does not embed a browser.

What the App does not do

• No analytics. No telemetry. No feature-usage counters. No A/B testing. No performance metrics.
• No crash-reporting service (Sentry, Bugsnag, Crashlytics, AppCenter, or equivalent). The App does not collect or upload crash dumps.
• No content scanning. The App reads metadata from audio files you open. It does not transmit audio content, file contents, file paths, file names, or metadata to us or to any third party.
• No background phone-home of any kind beyond what is described in Sections 4.1 and 4.2.

During normal launch, the App makes at most one automatic update-check request to our server and, when the 24-hour validation window has elapsed, one automatic license-validation request to Lemon Squeezy. Manual actions - Help → Check for Updates, Help → License → Activate, or Help → License → Deactivate - may create additional requests as described above.

5. How we use information

• To deliver the product. Providing post-purchase support: resending license keys on request, troubleshooting activation issues, processing refund inquiries.
• To validate licenses and prevent abuse. Confirming that an installation is associated with a valid license, and detecting unauthorized sharing or redistribution.
• To communicate. Sending newsletter emails to subscribers who have opted in. We do not send routine transactional emails - purchase confirmation and license key delivery are handled by Lemon Squeezy as part of the checkout flow. In rare cases (urgent security notices, breach notifications, or other communications required by law) we may contact you using the email address associated with your purchase.
• To respond to inquiries. Replying to messages sent through the contact form or directly to our support email.
• To comply with the law. Meeting our tax, accounting, and other legal obligations; responding to valid legal requests.

We do not use personal information for advertising, profiling, automated decision-making, or to train AI/ML systems. We do not sell or share personal information for cross-context behavioral advertising. See Section 9 for the CCPA / CPRA disclosure.

Legal basis (GDPR / UK GDPR)

6. Third-party processors

The services below may handle WAVScribe-related personal data in the ordinary operation of the website, App, purchasing, licensing, newsletter, and support workflows. These providers may use their own subprocessors as described in their privacy policies or data-processing agreements.

We do not intentionally route WAVScribe customer personal data through additional third-party services beyond the services listed above, except where needed for ordinary accounting, legal compliance, or support operations.

7. International data transfers

We are based in Taiwan. Personal data covered by this policy may be transferred to and processed in any of the locations listed in Section 6, including the United States, the European Union, Malaysia, Singapore, and other regions where our CDN edge network operates.

For users in the European Economic Area, the United Kingdom, or Switzerland, our processors rely on standard contractual clauses (SCCs) or equivalent transfer mechanisms recognized under the GDPR. Lemon Squeezy's Data Processing Agreement specifically addresses GDPR-compliant transfers; MailerLite's DPA is linked in Section 6.

For users in California, your personal data may be transferred to and processed in countries outside the United States.

For users in Taiwan, your personal data may be transferred to and processed outside Taiwan, in any of the locations listed in Section 6, as is necessary to operate the website and App.

8. Data retention

9. Your rights

Depending on where you live, you may have some or all of the following rights regarding the personal data we hold about you:

• Access. You can ask for a copy of the personal data we hold about you.
• Correction. You can ask us to correct inaccurate or incomplete information.
• Deletion. You can ask us to delete your personal data, subject to limits required by law (for example, we cannot delete tax-relevant purchase records before the retention period required for accounting compliance has elapsed).
• Portability. You can ask for your data in a structured, commonly used, machine-readable format.
• Objection and restriction. You can object to or restrict our processing in certain circumstances.
• Withdraw consent. Where we rely on consent (newsletter signup), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Complain to a supervisory authority. If you are in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local data-protection authority.

To exercise any of these rights, email contact@wavscribe.com with your request. We will respond within 30 days. We may ask you to verify your identity before processing the request, to make sure we do not disclose your information to the wrong person.

California residents - CCPA / CPRA

WAVScribe is not currently expected to meet the statutory thresholds for mandatory coverage under the California Consumer Privacy Act (as amended by the California Privacy Rights Act). Even so, we do not sell personal information, and we do not share personal information for cross-context behavioral advertising - as those terms are defined in the CCPA. We have not done so in the past 12 months and have no plans to do so.

To the extent the CCPA / CPRA applies to WAVScribe, California residents have the following rights:

• The right to know what personal information we collect and how we use it (this policy).
• The right to access and delete your personal information.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of your personal information.
• The right to non-discrimination for exercising your rights.

There is no "Do Not Sell or Share My Personal Information" link because there is no such activity to opt out of. To exercise any of the rights above, email contact@wavscribe.com.

Taiwan residents - Personal Data Protection Act

If you are a Taiwan resident, you may exercise the rights granted by the Personal Data Protection Act - including the rights to access, correct, delete, and request the cessation of collection or processing of your personal data - by emailing contact@wavscribe.com.

For Taiwan PDPA notice purposes:

• Purposes of collection: product delivery, licensing, customer support, newsletter delivery, website operation, security and abuse prevention, accounting, and legal compliance.
• Categories of personal data: contact information (name, email), purchase and license records, support messages, newsletter signup records, and technical access logs.
• Processing locations: Taiwan, the United States, the European Union, Malaysia, Singapore, and other locations where our processors operate (see Section 6).
• Consequences of not providing data: refusing to provide the information needed to purchase, license, or support the App may prevent us from completing those activities for you.

10. Children's privacy

WAVScribe is a professional audio tool aimed at sound designers, field recordists, library producers, and post-production engineers. The website and App are not directed at children under 16, and we do not knowingly solicit or intentionally collect personal data from them.

If you believe a child under 16 has provided us with personal data, please contact us at contact@wavscribe.com and we will delete it.

11. Security

• In transit. All communication between your computer and our servers (and our processors' servers) is encrypted with TLS.
• At rest. We rely on our processors' published security practices and contractual commitments for data stored in their systems.
• Payment cards. We never see or store payment-card data. Card processing is handled by Lemon Squeezy and its payment-processing providers.

No system is perfectly secure. We will notify affected users without undue delay if we learn of a personal-data breach affecting their information, in accordance with applicable law.

12. Cookies and tracking

The wavscribe.com domain does not set its own cookies for analytics or tracking. During checkout, Lemon Squeezy's embedded checkout opens within the wavscribe.com site, and Lemon Squeezy may set its own cookies - either on the wavscribe.com domain or on lemonsqueezy.com, depending on the integration mode active at the time - to maintain the purchase session. Those cookies are managed by Lemon Squeezy and governed by its privacy policy.

Other third-party processors may set cookies when you interact with them on their own domains (for example, Lemon Squeezy's customer portal or post-purchase pages). Those cookies are governed by the respective processor's privacy policy, linked in Section 6.

We do not use Google Analytics, behavioral tracking analytics, advertising analytics, or cross-site profiling tools.

Because we do not track our users across third-party websites or engage in behavioral tracking on wavscribe.com, our website does not change its behavior in response to "Do Not Track" (DNT) browser signals.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision, and the version number is bumped on every material change.

Material changes include:

• Adding a new category of personal data we collect (for example, if a future version of the App started collecting crash reports or anonymous usage statistics).
• Adding a new third-party processor, or replacing an existing one with a different vendor.
• Using already-collected data for a new purpose beyond what is described here.
• Significantly extending retention periods.
• Adding new international transfers to jurisdictions not already disclosed.
• Any reduction in your rights or the ways you can exercise them.

How we notify you of material changes:

• For changes that materially affect data we have already collected from you - for example, if we began using newsletter addresses for a purpose you did not opt into - we will notify you by email at the address we hold for you, where required by law or where practical.
• For changes that only affect data collected going forward - for example, adding a new analytics tool to the website - the updated policy on this page is the notification. You see the current policy when you visit the site or read it from within the App, and you can decide whether to continue.

Non-material changes (typo corrections, clarifying wording that does not change the underlying practice, updated links, structural reorganization, additional disclosure detail) may be posted without separate notice, with only the "Last updated" date bumped.

14. Contact

For privacy-related requests, questions, or complaints:

Formosa Soundworks Studio
Kaohsiung, Taiwan (R.O.C.)
Email: contact@wavscribe.com