Privacy Policy

privacy policy

last updated: July 1, 2026

thewav (“we,” “us”) built this page so you know exactly what we collect, why, and how to get it deleted. No filler.

This policy covers thewav.music, operated by Puya Ventures (“thewav”), a [PLACEHOLDER — entity type, e.g., LLC] based in the US.

The short version: we collect what we need to run profiles, show discovery, and EPKs. We never sell your personal data. You can ask us to delete your data any time at support@thewav.music.

1. what we collect

Account data. Email address, and if you sign in with Spotify, your Spotify user ID and basic profile info (see section 2). We also store your password hash if you use email/password, or nothing if you use magic-link-only sign-in.

Profile data. Whatever you choose to add: display name, handle, bio, profile photo, links, artist/venue details, EPK content (photos, press, tech riders, streaming links), and show listings you create.

Location data. City-level location, either entered by you or inferred from IP address at signup, used to power local show discovery and “scenes.” We don’t collect precise GPS location.

Taste and follow data. Artists, venues, and users you follow; shows you save or mark interested in; and (if you connect Spotify) listening data used to power recommendations — see section 2 for exactly what that includes.

Analytics data. Standard usage data: pages viewed, features used, device/browser type, IP address, approximate location derived from IP, and referral source. We use this to fix bugs and understand what’s working.

Content you post. Bios, links, show listings, and (later) posts — see the terms of service for how this is licensed.

Communications. If you email support@thewav.music, we keep that correspondence to help you and improve support.

We do not knowingly collect payment card numbers directly — if we add payments later, that’ll go through a PCI-compliant processor and this policy will be updated first.

2. Spotify OAuth data handling

When you sign in with Spotify, we request the minimum OAuth scopes needed to power your thewav profile and recommendations — for example, your Spotify user ID, display name, profile image, and top artists/tracks. We do not request scopes for playback control, playlist modification, or private data we don’t need.

What we do with it:

  • we use it to pre-fill and enrich your profile (e.g., showing your top artists) and to power taste-based discovery
  • we store only what’s needed for those features, refreshed periodically via your OAuth token
  • we never sell or license Spotify data to third parties, and we don’t use it for advertising profiles outside thewav

You can disconnect Spotify at any time from account settings. Disconnecting revokes our access token and stops future syncs; we’ll delete previously synced Spotify-derived data on request (see section 6).

Our use of Spotify data complies with Spotify’s Developer Policy. If you have concerns about our Spotify integration specifically, contact support@thewav.music.

3. email use

We use your email address to:

  • send magic-link sign-in emails
  • send account and security notices (e.g., password reset, login alerts)
  • respond to support requests
  • send product updates or announcements, if you opt in — you can unsubscribe from anything non-essential at any time

We don’t sell your email address or share it with third parties for their own marketing.

4. cookies

We use cookies and similar technologies (like local storage) for:

  • essential functions — keeping you signed in, remembering session state
  • analytics — understanding aggregate usage so we can improve the product

We don’t currently use third-party advertising cookies. If that changes, we’ll update this policy and give you a way to opt out where required by law.

5. who we share data with

We share data only with:

  • service providers who help us run thewav (e.g., hosting, email delivery, analytics) — under contracts that limit their use of your data to providing the service to us
  • Spotify, to the extent needed to maintain the OAuth connection you set up
  • other users, for the parts of your profile and content you’ve made public (that’s the point of a public profile)
  • law enforcement or legal process, only when required by valid legal request, or to protect the rights, safety, or property of thewav or our users

We never sell your personal data. Full stop — no data brokers, no ad-network resale, no exceptions.

If thewav is acquired or merged, your data may transfer as part of that deal, subject to this policy (or a policy with equivalent protections).

6. data deletion and access requests

You can delete your account yourself from account settings, or request deletion, a copy of your data, or a correction by emailing support@thewav.music.

We’ll act on deletion requests within a reasonable time (typically within 30 days) and confirm once complete. Some data may be retained briefly in backups or as required by law (e.g., records needed for legal compliance or fraud prevention), but it will be excluded from active use.

If you’re in a state with specific privacy rights (e.g., California’s CCPA/CPRA), those rights apply to you in addition to what’s described here — email us and we’ll honor applicable state-specific requests.

7. children under 13

thewav is not for children under 13. We don’t knowingly collect personal information from anyone under 13. If we learn that we have, we’ll delete it promptly. If you believe a child under 13 has created an account, email support@thewav.music and we’ll investigate and remove it.

8. data security

We use industry-standard safeguards (encryption in transit, access controls) to protect your data. No system is 100% secure, and we can’t guarantee absolute security — but we treat breaches seriously and will notify affected users as required by law if one occurs.

9. changes to this policy

We’ll update this page as thewav evolves and post a new “last updated” date. Material changes (e.g., new categories of data, new sharing partners) will be flagged with reasonable notice — email or in-app.

10. contact

Questions, deletion requests, or anything else: support@thewav.music. See our contact page for response times.

This document is a working draft prepared for launch planning. It has not been reviewed by a lawyer and does not yet reflect a final legal entity, state, or complete list of subprocessors.