Privacy Policy

Reverie Audio ("we", "us", "our") operates Reverie Pitch and is the controller of personal data processed in connection with the Service. This Privacy Policy explains what data we collect, why, and your rights.

1. Data We Collect

1.1 Account data

When you create an account, we collect your email address and a password (stored as a salted hash by our authentication provider - we never see your password in clear text).

If you choose Google sign-in, Google sends us basic account information needed to create or access your account, such as your email address, name or display name, profile image URL, Google account identifier, and provider metadata handled by Supabase Auth. We do not receive your Google password. We do not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google account content.

1.2 App usage and product analytics

While you use the Service, we collect usage data tied to your account so the app can save progress and so we can understand whether the product is working well. This includes:

• Exercise progress, scores, difficulty preferences, and streaks
• Daily free-round usage counts used to enforce the Free plan limit
• Subscription tier and status (free or Pro)
• Product analytics events such as "login completed", "pricing viewed", "exercise started", "answer submitted", "upgrade modal shown", and "checkout started"
• Event properties such as exercise name, round number, correct/incorrect result, selected difficulty, and checkout plan

Product analytics events are recorded only for signed-in users. We do not use these events for third-party advertising, and we do not sell them.

1.3 Admin analytics dashboard

Authorized admins can view an internal analytics dashboard built from account, subscription, and product-usage data. The dashboard is used to see aggregate metrics such as signups, active users, exercise starts, answer volume, activation, and subscription conversion. The dashboard does not expose raw payment card data.

1.4 Error and diagnostic data

When something crashes, we may collect:

• Error messages and stack traces
• Browser, device, operating system, and app release details
• Request or referrer URLs related to the error
• Console breadcrumbs that help us understand what happened before the error

We configure error monitoring with default PII collection turned off and session replay disabled. Error reports are for debugging, not advertising.

1.5 Website traffic and performance data

We use Cloudflare to host, secure, and deliver the website. Cloudflare provides aggregate traffic, security, and performance analytics such as page views, referring sites, countries, load timing, Core Web Vitals, and request-level security/performance signals. Cloudflare Web Analytics uses a lightweight performance beacon and is designed to work without cookies, localStorage, or cross-site tracking.

1.6 Payment data

Payments are processed by Paddle.com Market Limited, our Merchant of Record. Paddle is the controller of your payment data, including card details, billing address, and tax information. We do not see or store your card number. We only receive subscription status, plan, period, cancellation, and Paddle customer/subscription identifiers associated with your account. See Paddle's Privacy Policy for details on how Paddle handles your payment information.

2. How We Use Your Data

• To provide the Service (run exercises, save your progress)
• To authenticate you, including through Google sign-in when you choose it, and keep your account secure
• To process subscriptions and entitlements
• To enforce the Free plan's daily submitted-round allowance
• To improve the Service - measure which features are used, fix bugs, and prioritize what to build next
• To communicate essential account messages (password resets, billing receipts, security notices, material policy changes)

We do not sell your personal data, and we do not show third-party advertising on the Service.

3. Service Providers (Sub-Processors)

We use the following third parties to operate the Service. Each is bound by their own data-processing terms.

• Supabase - database, authentication, file storage, and authentication-related emails. Hosted in the EU.
• Google - optional Google sign-in identity provider. Google provides basic account information for authentication; we do not request access to Google account content.
• Cloudflare - frontend hosting, content delivery, security, Cloudflare Web Analytics, and aggregate traffic/performance analytics through its global edge network.
• Paddle - payment processing and sales tax / VAT collection (Merchant of Record).
• Sentry - error monitoring (collects crash reports, stack traces, and diagnostic context).

4. Cookies and Local Storage

We use browser local storage to keep you signed in across sessions (an authentication token issued by Supabase). We do not use third-party advertising cookies or marketing pixels. Our current product analytics are stored server-side after you sign in. Cloudflare Web Analytics does not rely on cookies or browser storage. If we later add analytics or marketing tools that set non-essential cookies or use similar tracking technologies, we will update this Policy and ask for consent where required before those tools run.

5. Data Retention

We retain account data for as long as your account is active. When you delete your account, we delete your personal data within 30 days, except for limited records we are required to retain for tax, accounting, or legal compliance (e.g. invoices - retained 7 years per Israeli tax law).

Product analytics events linked to your account are deleted with your account. Aggregate statistics that no longer identify you may remain in internal reports.

Google-derived account metadata, such as your Google account identifier and profile details used for sign-in, is deleted with your account.

Daily free-round usage rows are retained for up to 90 days, then pruned automatically.

6. International Transfers

Your data may be processed in countries other than your own (e.g. Supabase regions, Cloudflare's global CDN). Where applicable, we rely on standard contractual clauses or equivalent safeguards approved under GDPR and other applicable privacy laws.

7. Your Rights

You may, at any time:

• Access your personal data - most of it is visible in your Account page; for everything else, email us.
• Correct inaccurate data - change your email or other details from Account.
• Delete your account and personal data. Free accounts can request deletion from the Account page. Active Pro accounts must cancel Pro first and wait until paid access ends, or contact support for urgent deletion help.
• Export your data in a portable format - email us and we will send a JSON export within 30 days.
• Object to certain processing or withdraw consent. Note that some processing is necessary to operate the Service; we may not be able to maintain your account if you object to that processing.
• Lodge a complaint with a data protection authority. EU residents may contact their local DPA; Israeli residents may contact the Privacy Protection Authority.

8. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before they take effect.

10. Contact

For privacy questions or to exercise your rights, contact us at support@reverieaudio.com.