Privacy

Your account is an email address

Creating an account requires exactly one piece of personal data: your email address, used to send one-time sign-in links. There are no passwords to store, so none are stored. You can add a display name; it is public next to anything you publish.

While you are signed in, your listening on the site — plays, likes, favorites, playlists — is linked to your account so your library works and your ratings can feed the catalog ranking.

Listening stats from apps are anonymous by design

Third-party players built on our API report listening events (played, completed, skipped, liked) so that good music can rise in the ranking. These reports carry only two identifiers: the app’s API client id and an opaque session id the app makes up for each listener. No personal data ever arrives with them — not a name, not an email, not an address. We could not tell you who an external listener is, because the design makes it impossible for us to know.

Download counting

To count unique downloads without keeping addresses, we store a salted hash of the downloader’s IP — a one-way fingerprint that lets us skip double-counting but cannot be turned back into the address itself.

No trackers

• No ad trackers. There are no ads, so there is nothing to track for them.
• No analytics cookies in v1 — no Google Analytics, no pixels, no fingerprinting scripts.
• The only cookie we set is the session cookie that keeps you signed in. No account, no cookie.
• Player preferences (volume, queue) live in your own browser’s local storage and are never sent to us.

A note on development and self-hosted instances

Openwaves can run locally or on someone’s own server. In development mode, sign-in emails are not actually sent — they land in a local dev mailbox on that machine, and all data stays in that instance’s own database. If you are using an instance run by someone else, the operator of that instance is the one holding the data described on this page.

What we share and how to reach us

We do not sell or share personal data with anyone. What you choose to publish — tracks and public playlists — is public by definition, along with your display name. Rights complaints go through the takedown page; if you want your account and its data removed, contact us from your account email and we will delete it.