Harmonic Wave®

Your rights and privacy

Privacy Policy

Last updated: October 2026

Imagine Peak LLC dba Imagine Peak Studios, the operator of Harmonic Wave ("we," "us," or "our"), respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use the Harmonic Wave platform ("Platform"), including our website, API, and MCP server.

1. Information We Collect

1.1 Account Information

  • Email address: Required for account creation and authentication
  • Display name: Optional, provided by you for your profile
  • Account type: Creator or Developer designation
  • Profile information: Bio, links, and presentation preferences (Creators only)

1.2 Upload and Content Metadata

  • IP address: Logged on every upload for abuse prevention and legal compliance
  • Email address: Logged on every upload and linked to the uploader's account
  • File metadata: File type, file size, upload timestamp, content type classification
  • Content metadata: Titles, descriptions, tags, mood settings, and structural data you provide

1.3 Usage Data

  • API usage: Request counts, endpoints called, timestamps, API key used
  • Session data: Session tokens (hashed), login timestamps, expiration times
  • Playback records: Media and experience IDs, time, delivery status, and bytes delivered. Listener email addresses, where available, are stored as hashes; IP addresses are hashed with a salt that changes daily. Playback records are retained for 90 days.
  • Experience access records: Which email addresses have been granted access to which experiences
  • Protected-content access records: When we release a key for protected playback or viewing, we record the content identifier and version, time, request context, and a one-way IP-address hash using a salt that changes daily. A key-release record does not establish that someone played or viewed the content.

1.4 Technical Data

  • IP address: For rate limiting, security, and abuse prevention
  • Request headers: User-agent and origin headers for standard web operation

1.5 Connected Account Data

If you choose to connect a YouTube channel, we receive and store the following from your Google Account:

  • Channel identity: The channel ID, channel title, and channel image URL that YouTube returns for the channel you authorize
  • Authorization credentials: The tokens Google issues so the Platform can act on the channel you authorized. These are encrypted before they are stored, and they are never displayed, exported, logged, or returned by any Platform API
  • Permission record: Which permissions you granted, when the connection was last checked, and its current status

We ask for the narrowest set of permissions a feature needs. Connecting a channel for reporting does not ask for permission to upload videos or to change them.

We identify the channel by asking YouTube which channel your authorization reaches, and we record the channel it names. That establishes which channel you are authorized to manage, which is not the same as owning it: labels, managers, and brand accounts can all hold legitimate access to a channel they do not own. We never accept a channel identifier from a browser as proof of either.

If you connect a Google Ads account, we receive the accessible account list and account details, including account IDs, names, currency, time zone, and access status. When you request reporting, we receive daily campaign figures such as impressions, clicks, cost, video views, and conversions. Authorization tokens are encrypted before storage and are never exposed through the Platform API. See section 7.5.

1.6 Contact and Invite Request Forms

When you contact us, we store your name, email address, inquiry type, and message so we can respond. If you tick the updates box, we also record your consent, its date and wording, and an unsubscribe token, and add you to our updates list. You can unsubscribe using the link in any update email.

2. How We Use Your Information

  • Authentication: To verify your identity via email codes and maintain your session
  • Content delivery: To host, stream, and deliver your content to authorized users and agents
  • Protected delivery: To validate access, operate and troubleshoot protected playback and viewing, and detect abuse
  • Analytics: To provide you with usage statistics for your account and content
  • Abuse prevention: To detect and prevent prohibited content, copyright infringement, and platform abuse
  • Legal compliance: To respond to lawful requests and enforce our Terms of Service
  • Platform operation: To maintain, improve, and secure the Platform infrastructure

3. What We Do NOT Do

We are explicit about what we will never do with your data and content.

  • We never sell your data. Your personal information is not for sale, to anyone, for any reason.
  • We never use your content to train AI models. Your audio, video, images, and text are never used to train a machine learning model or large language model, ours or anyone else's, and our providers are not permitted to train on them. This is a foundational principle of the Platform.
    To be precise about the difference: the Platform is built on generative AI, so when you ask it to produce something, the material you give it is sent to AI services to do that work. That is processing you requested, not training, and the services involved are named in section 7.
  • We never share your data for third parties’ own marketing. We do not sell or supply your personal information to advertisers or data brokers for their own use. If you authorize a promotional campaign for your production, the agreed material is used only to carry out that campaign. Connecting an account alone is not campaign authorization.
  • We do not build our own cross-site profiles of you. We do not use fingerprinting. Our Google tag uses analytics and advertising cookies, and Google receives information about your visits through it, as described in section 6.

4. Data Storage and Infrastructure

The Platform's own storage is Cloudflare infrastructure:

  • Account and metadata: Stored in Cloudflare D1 (SQLite-based database), encrypted at rest
  • Media content: Stored in Cloudflare R2 (object storage), encrypted at rest
  • API and application logic: Runs on Cloudflare Workers (edge computing)

Data is processed at Cloudflare edge locations globally. All data in transit is encrypted via TLS.

Cloudflare is where we store your data. It is not the only place your data goes. The services described in section 7, including the AI providers that generate content, Google Analytics, and YouTube when you connect a channel, receive data in order to do what you asked, and they may retain it under their own terms. We do not control their retention.

5. Content Storage

We store uploaded originals in access-controlled Cloudflare R2 storage. Where protected delivery is enabled, we also store encrypted delivery copies and the key information needed to provide authorized playback or viewing.

Encrypted delivery files may be retrieved without an access check. The Platform checks authorization before releasing the information needed to decrypt them. Authorized playback or viewing decrypts the content in the recipient's browser. Harmonic Wave manages the encryption keys.

Withdrawing access cannot erase content or decryption information already received by a recipient.

You control access through the Platform's experience and access management tools. Changing an experience's status rotates its share link, which stops previously shared URLs from working.

Content is retained until you choose to delete it. When you delete content, it is permanently removed from our storage. Encrypted delivery copies of deleted content, and their key information, are removed by our clean-up process, normally within an hour. Content removed in response to a copyright notice is retained, with its encrypted copies, while restoration remains possible under our DMCA Policy.

Deleting content here does not delete copies published elsewhere. If a finished video has been published to a YouTube channel, deleting the source content on the Platform, disconnecting the channel, or deleting your Platform account does not remove that video from YouTube. Only you can take it down there. Rotating a Harmonic Wave share link likewise has no effect on a copy already published to YouTube.

6. Cookies

We use essential cookies for signing in and early access, plus Google Analytics and Google advertising cookies:

  • Session cookie: httpOnly, secure, SameSite=Lax. Used solely to maintain your authenticated session. It expires after seven days, or when you sign out.
  • Sign-in cookie: signin_nonce, httpOnly, secure, SameSite=Lax. Ties an emailed sign-in code to the browser that asked for it. It expires after 10 minutes.
  • Invite access cookie: wl_bypass allows invited users to access the sign-in flow. It expires after 30 days.

We use Google Analytics to understand how the site is used. The Google tag loads on every page and sets Google Analytics cookies (_ga and _ga_9P3R5YL7SZ), which hold a random identifier so visits from the same browser can be counted together. They last up to two years. Google receives your IP address and browser details with each measurement.

The tag also has Google's advertising features turned on. Google may set or read its own advertising cookies so that we can measure our Google Ads campaigns and show our ads to people who have visited the site, and Google may connect your visit to your Google Account if you are signed in to Google. We also use Google's demographics and interests reports, which show us the age ranges, genders and interests of visitors in aggregate; they never identify an individual. Google's use of this information is governed by the Google Privacy Policy and its explanation of how Google uses information from sites that use its services.

There is no cookie banner. You can block or delete these cookies in your browser settings, turn off personalized ads in My Ad Center, or use Google's Analytics opt-out add-on. The site works the same without them.

We do not use fingerprinting, we do not use advertising networks other than Google's, and we do not sell what these cookies collect.

7. Third-Party Services

We use a limited number of third-party services to operate the Platform:

  • Cloudflare: Infrastructure (Workers, D1, R2). Your data is processed by Cloudflare under their data processing terms.
  • Resend: Authentication emails, contact notifications, and consented update emails. It receives the recipient address and message contents needed to deliver those emails.
  • Stripe (future), Payment processing for premium experiences. Stripe will handle payment data directly; we do not store credit card numbers.
  • Google and YouTube: Channel connection, reporting, and publishing, for creators who choose to connect a YouTube channel. Google Ads account connection and reporting are described in section 7.5. See section 7.1 for YouTube.
  • Google Analytics and Google advertising features: Site usage measurement with analytics cookies, and measuring and showing our Google Ads to people who have visited the site. See section 6.

Our proprietary production process separates audio analysis from visual-story planning. Your master audio goes to Music.ai for initial analysis; the resulting chords, tempo, and transcribed lyrics inform the storyboard. We do not send your master audio to ChatGPT. Services used for generation receive only the instructions or reference material their task needs:

  • Music.ai: Initial audio analysis for chords, tempo, and lyric transcription. It receives the recording for that analysis and may store it under its service terms. We do not opt into training on your material.
  • OpenAI: Text-based interpretation and visual-story planning for production projects. We use transcribed lyrics and musical analysis for this work, not your master audio.
  • Cloudflare Workers AI and AI Gateway: Text and image generation, and the gateway that routes model calls.
  • Google (Gemini and related generative models), Image, video, and music generation.
  • ByteDance / BytePlus ModelArk: Video generation, including Seedance, through an AI gateway or directly for a production project. Receives the scene instructions and reference media needed for the requested render.
  • ElevenLabs: Speech synthesis. Receives the narration text to be spoken.
  • HeyGen: Presenter video. Receives the still image and the audio to animate.
  • Anthropic (future), Metadata generation. Not in use today.

None of these providers is permitted to train on what we send, and we do not send them anything you have not asked the Platform to work on.

Apart from the sharing you direct yourself, described in 7.3, we do not share your data with any other third-party services.

7.1 YouTube API Services

The Platform uses YouTube API Services.

We use data obtained through YouTube API Services only to provide the features you connected a channel for. We do not sell it, we do not share it with other creators, and we do not use it to train machine learning models.

On advertising, two different things are worth separating. We do not use data from a connected YouTube channel or Google account to target advertising, to build advertising audiences, or for any advertising purpose of our own. If you separately authorize a promotional campaign for your own production, that campaign uses the agreed material only to carry out what you asked for. Its scope and any required permissions are agreed before it begins. A production agreement does not authorize additional access to a connected Google or YouTube account.

Stored YouTube data is limited to the channel identity and permission record described in 1.5, together with the reports described below.

When you authorize channel reporting, the Platform retrieves and stores reports for your connected channel and its videos. These can include views and impressions, watch time and average view duration, engagement, and traffic sources.

Reports contain aggregate performance figures, not individual viewer identities. Reports and measurement captures are retained for 24 months. You can delete stored reports. Disconnecting the channel deletes them, once the seven-day period described below ends, and deleting your account deletes them too.

Connecting a channel does not itself request or store a performance report. Reporting requires the relevant permission and a report request or collection schedule you authorize.

7.2 Deletion and the one thing we keep

When you disconnect a channel, the Platform stops using it immediately and the stored credentials are erased.

One thing is kept deliberately, and only one: an encrypted copy of the credential needed to ask Google to withdraw the permission. Without it, a withdrawal that has not yet succeeded could never be completed. It is never used for anything else, and it is erased as soon as Google confirms the withdrawal.

If the withdrawal has still not been confirmed after seven days, we erase that credential anyway and stop trying. What remains is a record that a withdrawal was requested and was not confirmed. It holds no credential and no usable credential or report data, and its purpose is so that we can tell you the truth about what happened rather than assume it.

The disconnected channel's record stays visible to you for up to seven days so you can see what happened to it, and is then removed.

If you withdraw access at Google rather than here, we check authorization periodically and during channel operations. Once we confirm access is no longer valid, we promptly remove the stored connection data. If you revoked by accident, connect the channel again and it is set up fresh.

7.3 Sharing you direct

The Platform is designed to be driven by AI agents as well as by people. If you issue an API key, or connect an external agent or application through the Platform's agent interface, that agent can read the content and experience data your key permits, and it operates under whoever runs it rather than under us. That is sharing you initiated, and you control it by issuing and revoking keys.

Credentials are never included. An agent cannot read your connected-account tokens, your encryption keys, or any third-party credential the Platform holds, and no agent path exposes them.

7.4 Approved production and promotional use

A separate production agreement may authorize publication of a finished work and excerpts on Harmonic Wave channels, our website, social media, or in presentations and paid promotion. These uses require your express written permission for that project. Supplying a song, requesting an invite, or connecting a channel does not grant permission to use your work to market the Platform.

7.5 Google Ads and Google API Data

Creators can connect a Google Ads account to view accessible accounts and request campaign reporting. Stored daily figures include impressions, clicks, cost, video views, and conversions, with the account currency and time zone needed to interpret them. These figures do not identify individual viewers.

Connecting an account creates no campaigns and spends nothing. Campaign creation or changes require a separate authorized action. Disconnecting stops the Platform’s access; it does not pause or stop a campaign already running in Google Ads. Manage those campaigns in Google Ads.

Report snapshots are retained for 24 months. Disconnecting does not delete them, so your campaign history stays readable; deleting your account deletes them, together with campaign, experiment and switch records. A snapshot preserved as evidence for an experiment can remain while that evidence record is retained.

Credentials are encrypted before storage. On disconnect, usable credentials are erased and we ask Google to withdraw access. An encrypted credential needed to complete an outstanding withdrawal can remain for up to seven days, solely for that purpose, as described in section 7.2.

Harmonic Wave’s use and transfer of data received from Google APIs, including YouTube and Google Ads, adheres to the Google API Services User Data Policy, including its Limited Use requirements. Connected-account data is used for the features you authorize. It is not sold, used to train AI models, or used to build advertising audiences. Human access is limited to your affirmative permission, security needs, legal obligations, or permitted aggregate internal operations.

8. Data Retention

  • Content: Retained until you delete it through the Platform
  • Account data: Retained until you delete your account
  • Authentication codes: Automatically expire after 10 minutes
  • Session tokens: Expire based on session duration settings
  • API usage records: Retained for 90 days for usage reporting and abuse prevention
  • Playback records: Retained for 90 days
  • Protected-content access records: Retained for 90 days for delivery diagnostics, security, and abuse prevention, or removed earlier when required by our account-deletion procedures
  • Encrypted delivery copies and associated key information: Follow the retention rules for their source content. When source content is deleted, these copies and key information are also removed through our cleanup process
  • Connected-account reports: Normally retained for 24 months, with the deletion behavior and experiment-evidence exception described in sections 7.1 and 7.5
  • Enquiries and invite requests: Retained until we delete them. You can ask us to delete yours at any time
  • Updates list: Until you unsubscribe or ask us to remove you
  • Upload IP logs: Retained for legal compliance and abuse prevention

When you delete your account (via the dashboard or the delete_account MCP tool), your associated data is permanently removed, including your profile, content, API keys, access records, and sessions.

Two things survive an account deletion. The first is the DMCA audit record: where a takedown or counter-notice action was taken on your content, the record of that action is not tied to your account and is retained for legal compliance, as our DMCA Policy describes. The content itself, its upload metadata, and any counter-notice you filed are removed with your account. The second is described in sections 7.2 and 7.5. If you had connected a YouTube or Google Ads account and a permission withdrawal is still outstanding, the encrypted credential needed to complete that withdrawal survives the deletion for no more than seven days. It is used for nothing else. After that it is erased whether or not the withdrawal succeeded, and what remains is a record that it was requested and not confirmed, holding no credential and no usable credential or report data.

9. Your Rights

You have the right to:

  • Access your data: View all data associated with your account through the Platform dashboard or API
  • Delete your data: Permanently delete your account and all associated data at any time
  • Download your media: Download your media through the Platform
  • Correct your data: Update your profile, content metadata, and account information at any time
  • Withdraw consent: Stop using the Platform and delete your account at any time
  • Disconnect a connected account: Remove a connected YouTube or Google Ads account. Disconnecting stops access and asks Google to withdraw the permission. It does not remove published videos or stop running Ads campaigns

You can also revoke the Platform's access directly in your Google Account permissions, without using the Platform at all.

If you delete your account, we remove your stored connection records and ask Google to withdraw any permission you granted.

If a withdrawal is not confirmed, we report it as unresolved rather than as complete. We retry temporary failures for a limited number of attempts. Other failures, and any failure that is still unresolved after seven days, need either our intervention or, more reliably, your own removal of the Platform in your Google Account permissions. We will not tell you a permission has been withdrawn when we have not been able to confirm it.

Two things can outlive an account deletion, and section 8 lists both. The first is described in sections 7.2 and 7.5: the encrypted credential needed to complete an outstanding withdrawal, kept for no more than seven days, and afterwards a record holding no credential and no usable credential or report data. The second is the DMCA audit record described in section 8 and in our DMCA Policy.

Revoking access at Google may affect more than one permission you granted to Harmonic Wave from the same Google Account, because Google groups them by application. If you use more than one connected channel, check the rest after revoking.

To exercise any of these rights, use the Platform directly or contact us at hello@harmonicwave.ai.

10. Children's Privacy

The Platform is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

If you believe a child under 13 has provided us with personal information, please contact us at hello@harmonicwave.ai.

11. Security Measures

We implement appropriate technical and organizational measures to protect your data:

  • Platform-issued API keys are stored as SHA-256 hashes (we never store the raw key)
  • Passwordless authentication eliminates password-related attack vectors
  • Session tokens are hashed before storage
  • Rate limiting protects against brute-force attacks
  • IP and email blacklisting for abuse prevention
  • All data encrypted in transit (TLS) and at rest
  • Authorization checks before releasing decryption keys for protected delivery, with encryption keys stored separately from delivery files
  • File type validation including magic byte verification on uploads

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify registered users via email. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

That does not apply to your connected accounts. Continuing to use the Platform is never treated as permission to access additional data from a connected Google or YouTube account, or to use data already obtained from one for a new purpose. Either of those requires a new authorization from you, requested at the time, and we will not obtain it by revising this page.

13. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at:

hello@harmonicwave.ai