Privacy policy

WAF hosts audio and video files and collects timestamped comments. Here, plainly, is what we process and what we do not.

This is a courtesy translation. The French version is the legally binding one. Read the French version

We sell no data, display no advertising and use no third-party audience measurement tool: no Google Analytics, no pixel, no ad network. The only cookies we set are strictly necessary to run the service, or remember a display setting you chose yourself, which is why there is no consent banner.

Our commitments about your files

No artificial intelligence. WAF itself calls no artificial intelligence service: your files, your voice recordings and your comments are not sent to one for analysis, for model training or for transcription. There is a single exception, at YOUR initiative: a voice feedback you send us from the "Feedback" button of your account is transcribed by a third-party service (see "Your feedback on the service").
No resale, no exploitation. Your files, your comments and your data are neither sold, nor rented, nor transferred, nor used for advertising or promotional purposes.
Technical processing only. Your files undergo only the automatic processing needed to run the service: format checking, transcoding into playback renditions, waveforms, thumbnails.
An administration without content. The service's administration interface shows no file title, no share link, no thumbnail and no comment text: a file is identified there only by an internal number, and audience figures are numbers only. Like any operator, the publisher nonetheless keeps technical access to the database and to storage, which is needed to maintain the service.

1. Data controller

Cédric Vanderstraeten, publisher of waf.fm. Any question or request about your data: contact@waf.fm.

2. What we process, and why

If you have an account

Account and credentials

Your email address, your display name, and — if you set one — your password, kept only in hashed form (scrypt, with a salt unique to each account). The plain password is neither stored nor readable, by us included. To this are added your plan (Free, Pro or Studio) and, where applicable, its expiry date.

If you enable two-factor authentication, its secret is kept encrypted (AES-256-GCM) and your recovery codes only in hashed form. The events of that two-factor authentication (enrolment, removal, sign-in, failure, use of a recovery code) are recorded in a security log, with a salted fingerprint of the IP address and never the address in the clear.

An email address is required to create an account: without it, we can neither sign you in nor warn you. Commenting on a shared file, by contrast, does not require one.

Legal basis: performance of the contract; legitimate interest (security) for the security log. Retention: the lifetime of the account — see below on the deletion of unused accounts; security log: 365 days.

Deletion of unused accounts

We do not keep an account nobody uses forever. A Free account that has uploaded no file, owns no folder holding files, belongs to no folder owned by someone else and has recorded no sign-in for 90 days is deleted automatically.

You are warned by email 7 days beforehand, at the account address, and any sign-in during that period cancels the deletion — the account then starts a full cycle again. A second email confirms the deletion once done. Administrator accounts, Pro and Studio accounts, and accounts that have paid for a Miaou Pro purchase (perpetual licence) are never affected. Any comments you left on other people's files remain, detached from your identity.

Legal basis: storage limitation obligation (article 5.1.e GDPR). Retention: 90 days of inactivity, plus the 7-day notice. As things stand, that automatic deletion is not active: our sweeper computes and logs it without applying it. No account is therefore deleted for inactivity; you can have your account deleted at any time, on request.

Shared folders and removal of a member

A folder may bring several people together. Each of them accesses it through their own account; nothing in it is reachable without having been invited.

If your access to a folder is withdrawn, you lose access to that folder and to everything in it — including the files you uploaded there yourself, which belong to the folder and to the person who holds it. You then become a plain visitor of the public share link, if one exists. You keep control of your own comments, however: you can edit or delete them with your account, as before. On a share link protected by a password, your account gives you no particular access: you need the password.

Legal basis: performance of the contract between the folder owner and us; legitimate interest for keeping your comments attributed.

Your files and their metadata

The audio and video files you upload, their technical derivatives (transcoded renditions, waveforms, thumbnails, tracks and stems) and their metadata: file name, title, duration, size, format, upload date, the history of its deliveries.

Deletion. A file you delete first goes to the bin, where it stays recoverable for 30 days; it is then destroyed automatically. "Empty bin" destroys it immediately. Destruction erases its database rows, its comments and the deliveries opened from the dashboard, and starts erasing its storage objects right away. Deliveries received through our programming interfaces (for example from Miaou) survive the file: detached from it and marked "deleted", they keep the client information they carry. Copies may survive in our backups for a limited time, until they are rotated (see § 3).

Legal basis: performance of the contract. Retention: Free plan — 30 days after upload, with an email reminder before expiry; Pro and Studio plans — for as long as the account exists and you do not delete them. When a paid subscription ends, the account falls back to Free: your files are kept for 30 days after the end of the paid period, then expire under the Free plan rules.

Multiple uploads and batches. You can upload several files at once and group them into a batch, which gets its own sub-folder and a single share link to hand to a client. An in-progress batch can be stopped and resumed; cancelling a batch revokes its share link and moves its folder to the bin, where it stays recoverable for 30 days. A folder's ZIP archive is never written to our disks nor kept: it is built on the fly, at the moment you download it.

The deadline follows the folder owner, not the uploader. A file uploaded into someone else's folder follows that person's plan: a free upload placed in a Pro account's folder does not expire after 30 days, and a Pro upload does not open a free deadline if it is moved to a Free account. If a folder changes owner, the deadline is recomputed for the new owner and starts from the date of the change, never keeping whichever of the two is the longer: a file that did not expire may then receive a deadline.

If you listen or comment through a share link, without an account

Your comments and the optional email address

The text of your comment, the timecode it is anchored to, and the first name or nickname you type. That name is remembered so it can be pre-filled next time, on the same browser. You can comment without giving any email address.

If you choose Notify me of replies from the bell of a thread, the address asked for is optional and is used only for the notifications of that thread. The subscription is activated only after a double opt-in: you must confirm the address from a single-use link that expires in 30 minutes. It is disclosed neither to the owner of the file, nor to the other people who comment.

Legal basis: performance of the service you ask for. Retention: the lifetime of the file commented on — you can edit or delete your comments at any time from the player. A deleted comment is first masked: the owner of the file can still restore it, and it is erased for good at the latest with the file. For immediate erasure, write to us.

Optional notifications: consent, which you may withdraw at any time. The address stays attached to your visitor identity for as long as that identity exists. Turning notifications off stops the sending, but does not automatically erase the address from the database; you can ask for its erasure at contact@waf.fm.

Your voice comments

In the player, a comment can carry a voice recording instead of (or in addition to) its text. The recording is stored with the comment, in our media storage, and only the sound is kept: no transcription, no voice analysis, no speaker recognition is performed, by us or by a third party. WAF keeps the duration, the format, the size and a waveform (the picture of the sound shown in the player), and converts the recording to MP3 so it plays in every browser; that conversion runs on our machines, with no call to an outside service.

A recording is limited to 2 minutes and 8 MB: beyond that it is refused, not truncated. The capture formats supported by browsers (WebM, M4A, OGG) are accepted.

Who can listen to it: the same people who can see the comment — those who have access to the file through its share link or as folder members, and the file owner. A share link protected by a password, closed or purged does not give access; neither does a simple link (the one that only opens a media file, without the comments). The form offers recording only in the full player: a player embedded in a third-party tool points to "Open full size".

A recording follows exactly the fate of its comment: deleted, it is masked with it and then destroyed under the same rules. It also disappears with the file. A recording counts towards the storage quota of the account that uploaded the commented file, like an upload.

Legal basis: performance of the service you ask for. Retention: that of the comment carrying it.

Visitor identity

On your first interaction that requires recognising you — commenting, approving without an account, or following a thread — a token signed by us is set in two cookies (waf_v and waf_vp) and copied into your browser local storage. Simply loading the player creates none. That token lets you find and edit your comments, including when the player is embedded in a third-party tool such as Miro or Notion. It is passed to no third party and serves only to recognise you as their author.

Legal basis: legitimate interest (the service requested). Retention: 365 days at most from the issuing of the token. Later visits do not push that deadline back. The matching visitor record on our servers (the first name you typed, the optional notification address) is not, as things stand, erased automatically at that deadline; it is erased on simple request.

IP address fingerprint (anti-abuse)

When a comment is saved, we keep a salted cryptographic fingerprint of the IP address (SHA-256 with a secret salt held by the server), and never the address itself. The fingerprint cannot be reversed and serves only to spot abuse. Your IP address is at no point stored in the clear next to your comments.

The IP address is also used transiently, in memory, to rate-limit repeated sign-in attempts and certain sensitive account operations, notably export and deletion; it is not retained on that basis.

Legal basis: legitimate interest (security, anti-spam). Retention: the lifetime of the comment.

For everyone

Internal usage measurement

We count plays, downloads, uploads, share page opens, comments and server errors, to steer the service and spot outages. These events carry the kind of action, the file concerned and the timestamp — no identifier of a person. They stay with us: no third-party analytics tool is used.

Legal basis: legitimate interest. Retention: 30 days in detail, then daily aggregated counters only.

Internal audience measurement. The administration dashboard shows usage statistics: listening volume, a funnel from "link opened → comment → download", coarse origin and device, country, and account activation. That page collects nothing new and sets no tracker: it only reads the two measurements described just above and below, already in place for the service. Visitors there are counted through a salted fingerprint, never by name: no name, no file title, no comment text appears in it. It is therefore bounded by their retention periods: 90 days for activity data, 30 days for detailed counters.

Activity log

To check that the service holds up and to know where connections come from, we record every notable action in an internal log: signing in to an account, uploading a file, sending a share link, opening a shared link, commenting, downloading. Each line carries the timestamp, the kind of action, the account concerned, the file concerned, and:

an approximate country and city, derived from the IP address;
a salted cryptographic fingerprint of that address (SHA-256, secret salt held by the server) — never the address itself, and the fingerprint cannot be reversed;
a coarse device type (phone, tablet or computer). Your browser user agent is read then thrown away: it is never kept;
a coarse origin (Miro, Slack, Notion, direct or other). The address of the page you came from is read then thrown away: it is never kept.

The country and city are derived entirely on our own servers, from a database downloaded in advance. Your IP address is sent to no geolocation service, neither during your visit nor later. This product includes GeoLite2 data created by MaxMind, available from maxmind.com. That data is an estimate, never an exact location, and is never used to identify a person.

This log contains no file title, no share link and no comment text: these are counters. No third-party tracker takes part in it.

Legal basis: legitimate interest (security of the service and steering of the business). Retention: 90 days, then automatic daily deletion. Closing an account immediately detaches its lines from its identity.

Email

WAF writes to you for: the passwordless sign-in link, recovery of an anonymous upload, an invitation to a shared folder, the summary of your uploads, the expiry notice for your files, and sending a share link to a recipient you name.

Collaboration notifications cover new threads, replies and mentions. For a visitor without an account, only replies in the confirmed thread are sent, and they are grouped, by default, into a summary after 15 minutes. From the account settings, an owner can choose to be notified as soon as possible, after 15 minutes, hourly, daily, or never. A notification already read inside WAF before the summary is not emailed.

These emails can be turned off at any time: with the bell of the thread, with the management link present in every email or, for an account, from its settings. Turning off can target one thread, one file or all comment emails.

Delivery goes through OVH (France). Comment notifications use a dedicated SMTP channel, separate from sign-in emails, so that a burst of comments never blocks access to accounts. When you send a link to a client, we keep the recipient address and the message you attach, to trace the sending and rate-limit it.

Legal basis: performance of the contract; consent for the optional notifications of a visitor; legitimate interest for rate limiting.

Technical logs

Every server response is logged with the HTTP method, the route pattern (for example /share/:token), the response code and the duration. That choice is deliberate: a share link is a secret, and a raw URL in a log would leak it. Our logs contain neither a real URL nor a share token. Our host keeps its own infrastructure logs on its side, needed for network security.

The technical alerts the publisher receives (email delivery failure, failed encoding, new comment) carry internal numbers only: no file title, no share link, no comment text, no author name, no recipient email address outside accounts. When they travel through a messaging service (Discord, Telegram), that service therefore receives no content data.

Legal basis: legitimate interest (security, diagnostics).

Calls to the programming interface (API). An API key, available with the Studio plan, is kept only in hashed form (SHA-256); the prefix shown in the settings is not enough to authenticate, and the clear key is shown only once, at creation. It does not expire on its own and can be revoked at any time from the settings. Uploads made through the API are recorded in the file owner's log, like an upload from the site: same salted fingerprint, never a clear IP address, and never the key itself. Call rate limiting happens in memory and is not retained.

Your feedback on the service

If you send us feedback from your account, its text or its voice recording is passed, with your email address, your plan and the page you are writing from, to a feedback collection server operated by the publisher. Voice recordings there are transcribed automatically by a third-party service (Groq, United States). Do not attach confidential information about your projects.

Legal basis: legitimate interest (improving the service), at your initiative.

Requests to other domains

Our pages load no font, no script and no tracking image from another domain. One exception is technical: to play or upload a media file, your browser talks directly to our storage provider, Cloudflare R2, using a signed, temporary link — Cloudflare then sees your IP address, as any host does. Two others exist only if YOU trigger them: the player embedded in Miro loads the Miro software development kit, inside Miro; and to show you a sample in the public demonstration player, our server itself fetches a short music clip from a demonstration site (soundhelix.com) — our server makes that connection, never your browser, and your IP address is not passed to it.

Desktop application

WAF offers a desktop application that uploads files and follows a delivery from your computer. It sends us no telemetry: no machine identifier, no hardware fingerprint, no crash report, no version of your system. This statement covers the behaviour of the application we distribute; on the server side it is verifiable: WAF exposes no telemetry collection route. Its only exchanges with us are the ones you trigger: your sign-in, the files you send and the deliveries you follow. Its updates are served by waf.fm (from our storage provider), not by a third-party service. The number of downloads per platform is counted in memory and is tied to no person: it does not survive a server restart and is not kept.

Legal basis: performance of the contract. Note: what the application stores on your own computer is not passed to us and is not covered by this page.

3. Where your data lives

Database — a SQLite database on a persistent Fly.io volume, in the Paris region. Fly.io encrypts its volumes at rest by default.
Media files — Cloudflare R2. Cloudflare encrypts at rest all R2 objects and their metadata (AES-256). No restriction of location to the European Union is enabled on our space to date: its location is therefore not guaranteed.
Transcoding — playback renditions, thumbnails and waveforms are produced either on the application server, or on transcoding machines owned and operated by the publisher, outside our providers' data centres. Those machines download the source file over HTTPS, send their results back, and erase their temporary files at the end of each job. They have no access to the database.
Backup — the database is replicated continuously to Cloudflare object storage, over HTTPS. A fresh machine restores the latest backup at start-up. Those backups, and the ones our host makes on its side, are renewed by rotation: a deleted item may survive in them for a limited time.
Transport — every exchange with the service happens over HTTPS, and the browser is required never to fall back to HTTP (HSTS).

4. Recipients

Your data is processed by our technical providers, who act as processors within the meaning of article 28 GDPR and do not use it on their own behalf:

Fly.io, Inc. (United States) — hosting of the application and of the database, on servers located in Paris.
Cloudflare, Inc. (United States) — storage of media files, database backups and the desktop application's installer files.
OVH SAS (France) — delivery of transactional email and of comment notifications, through separate SMTP accounts.

Two of these providers are United States companies. Any transfers to the United States are framed by the standard contractual clauses of the European Commission and, where they rely on them, by the applicable adequacy mechanisms. The database is stored in Paris; for media files, see § 3.

This list is kept up to date on this page; the date of its last change appears at the bottom.

Payment. WAF collects no payment today: no banking data is processed and no payment provider receives your data. The paid plans will open after the publisher is registered; this policy will then be updated to name the payment provider and the data passed to it, before any money is taken.

Other recipients, depending on what you use. These exchanges happen only in the cases described, and none of them receives data beyond what is necessary:

Slack (United States) — only if you connect a Slack workspace to WAF. Slack then receives the file title, the delivery label and its technical id, the share link, the thumbnail URL, the embedded player URL and, depending on the link's download settings, the download button URLs — which carry the same share token — as well as the audio track label, in order to unfurl the link in the conversation. No media is sent to Slack.
Miro (United States) — only when the WAF panel is open in a Miro board: the panel loads the Miro software development kit from the miro.com domain, inside Miro. The title, the waveform and the comments are then displayed in Miro, which processes them under its own rules.
Our feedback server, then Groq (United States) — only if you send us feedback from your account. Your text or voice recording, your email address, your plan and the sending page are passed to it; a voice feedback there is transcribed by a third-party service (Groq).
An internal messaging service (Discord or Telegram) — only if the publisher has configured one, and never with content: those technical alerts carry internal numbers and counters only (see "Technical logs").
MaxMind (United States) — the GeoLite2 database used to estimate a country and a city is downloaded from download.maxmind.com. No IP address is passed to it, neither during your visit nor after: the deduction happens on our side.

When you embed a player in a third-party tool (Miro, Notion...) or a link in a message, the information shown by that player or that preview (title, waveform, comments as the case may be) is rendered inside that tool, which processes it under its own rules.

The creators you exchange with see the first name you type and your comments — that is the very point of the service. Your notification address is never disclosed to the creator or to other users.

5. Cookies

No advertising cookie, no audience measurement cookie, no social network cookie. The cookies we set are strictly necessary to the service, or remember a display setting you chose yourself:

waf_session — keeps you signed in to your account. Lifetime: 30 days.
waf_2fa — the intermediate step of signing in when two-factor authentication is active; on its own it opens no right. Lifetime: 5 minutes.
waf_sg and waf_sgp — remember that you entered the password of a protected link, so you are not asked for it on every listen. waf_sgp is the partitioned variant, for embedded players. Lifetime: 12 hours.
waf_slack_oauth — secure the connection of a Slack workspace, for the duration of the authorisation. Lifetime: 10 minutes.
waf_ap — the appearance you chose (dark, light or system, and the voice-note animation). Lifetime: 1 year.
waf_dash_plat — the presentation you chose for your files page. Lifetime: a little over 13 months.
waf_v and waf_vp — the visitor token described above. waf_vp is its partitioned variant, needed for the player embedded in a third-party tool to keep recognising you as the author of your comments. They are created only on the first interaction that needs them, never on a simple read. Lifetime: 365 days at most from issuing, with no extension on later visits. A copy of the same token and the same deadline is kept in the browser local storage, because some browsers block cookies inside third-party iframes.

The browser's local storage also keeps your playback and display preferences (volume, timecode format, presentation of the files list...) and the first name you typed to comment, so it can be pre-filled. That data stays in your browser: it is not passed to us on that basis.

As these trackers are strictly necessary to the service you ask for, or limited to remembering a display choice you made, they are exempt from consent: no banner is shown. You can delete them at any time from your browser — you will then lose control over the comments you posted without an account.

6. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability over your data, the right to withdraw consent at any time without affecting processing already carried out, and the right to give instructions on what happens to your data after your death. To exercise them, write to contact@waf.fm. We answer within one month.

We carry out no profiling. The only automatic operations concerning you are the application of the retention periods described on this page.

Inside the product, without writing to us:

you can edit or delete your own comments from the player;
you can turn notifications off from the bell of a thread or the management link in every email; account owners also have global and per-file settings;
account owners can download from the settings a self-service portability export in JSON: profile, preferences, metadata of uploaded files and contributions attached to the account. Media stay downloadable separately, and unclaimed visitor comments are not attributed automatically;
account owners can delete their files at any time, then empty the bin to destroy them without waiting;
account owners can delete their account from the danger zone of the settings, after re-validating their identity.

This self-service export does not replace a full right-of-access request. For that, or for any data outside this scope, write to contact@waf.fm.

Deleting your account: first delete your files from the dashboard, then empty the bin — that path also erases their storage objects —, then use Delete my account in the settings. The exact email address, the word SUPPRIMER and, if the account has one, the current password are required. A subscription still in force, a live Miaou payment or purchase, a direct send in progress or a folder holding someone else's work will block the operation until settled.

The content of your comments and decisions on other people's files stays in the conversation, under the name Deleted account, with no link to your account, visitor id or IP fingerprint. Proof of transactions and audit logs subject to a legal obligation may be kept for the applicable period. If you are blocked, write to contact@waf.fm.

Erasing your account and all its content on request: write to contact@waf.fm. From your request, the account is closed at once: no more sign-in, its API keys are refused and its share links answer as closed. Everything is then erased for good 30 days after the request — the database and the storage objects of every version (sources, MP3, waveforms, posters, stems, attachments) —, and during those 30 days you can still change your mind. Our administration log then keeps only a keyed fingerprint (HMAC) of your email address, never the address itself: it lets us confirm that an address was erased, not read it back.

You may at any time lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertes (cnil.fr).

7. Security

Encrypted exchanges (HTTPS, HSTS); encryption at rest of the database volume and of files at our hosts.
Salted password hashes; sign-in links sent by email are single-use, time-limited, and stored only in hashed form.
Two-factor authentication available; its secret is encrypted (AES-256-GCM), recovery codes and API keys are kept only in hashed form.
Share links drawn at random (128 bits), excluded from search engine indexing and never passed as a referrer; password, closing date and link renewal available.
Commenters' IP addresses never kept in the clear.
Share tokens never written to the logs.
An administration interface showing no file title or content, and no comment text.
Continuous replication of the database.

In the event of a data breach likely to create a risk to your rights, we will notify the CNIL within 72 hours and inform you directly if the risk is high.

8. Minimum age

The service is aimed at a professional audience and is reserved for people aged at least 15.

9. Changes to this policy

Any substantial change will be flagged on this page, and announced by email to account owners for major changes.

Last updated: October 12, 2026