Interwave is a free, open-source desktop music player developed by an independent solo developer operating under the name "Cloaxy" (the "operator," "we," "us," or "our"). The source code is published at github.com/Cloaxyyy/wave and the project's home is interwave.cc. This privacy policy explains, in plain English, what information Interwave collects, how it is used, who it is shared with, and what choices you have.
The short version: the vast majority of your data — your library, playlists, listening history, settings, and search history — lives in a local SQLite database on your own computer and never leaves the device. If you choose to create an optional account, a small amount of information (your email, display name, friends list, and any playlists you choose to share) is stored in our managed backend so that features like friends and shared playlists can work across devices. We do not run advertising, we do not sell, rent, or trade personal information, and we do not collect analytics or telemetry without an explicit action on your part.
We try to collect as little as possible, store it for as short a time as is useful, and be transparent about every external service the app talks to. If anything in this document is unclear, email support@interwave.cc.
When you create an optional Interwave account, you provide an email address and a display name. The email address is used as your login identifier and as the channel through which we can contact you about account-related matters (password resets, security notices, account-deletion confirmations). The display name is what other Interwave users see when they search for you, send friend requests, or view your shared playlists. You may change your display name at any time from the in-app settings.
When you contact support — whether by email to support@interwave.cc or via the in-app "Send feedback" form — we receive the content of your message, your email address, and any attachments you choose to include. If you tick the "Attach diagnostics" checkbox when submitting a ticket, the report will additionally include a snapshot of the app's recent crash log buffer, your app version, your operating system version, and a list of which features were enabled at the time of the report. Diagnostics are never attached unless you explicitly tick the box.
If you submit a friend request, your display name and account ID are visible to the recipient. If you accept a friend request, your account ID becomes visible to that friend in their friends list. If you choose to share a playlist, the playlist's name, cover image, and the list of YouTube video IDs it contains are uploaded as a snapshot to our backend so that the recipient can import it.
Interwave maintains a local SQLite database in your operating system's standard application-data directory (for example, %APPDATA%/Interwave on Windows, ~/Library/Application Support/Interwave on macOS, and ~/.config/Interwave on Linux). This database contains your imported tracks and their metadata, your playlists, your listening history, your in-app settings, your search history, and any cached cover art or artist images. This data never leaves your device unless you explicitly export, share, or attach it to a support ticket. It is not synchronised, backed up, or transmitted to us in any form.
You are in full control of this database. You may delete it at any time by quitting Interwave and removing the application-data directory described above. Uninstalling the app does not always remove the database automatically, so a complete deletion of local data may require both steps.
The Interwave website at interwave.cc is a static site hosted on GitHub Pages and served through Cloudflare. We do not run any analytics, tracking pixels, fingerprinting scripts, or custom logging on the site. However, as is standard for any web service, the hosting and CDN providers automatically receive standard server log information — including your IP address, the URL you requested, the time of the request, your user-agent string, and the referring URL — for the purposes of delivering the page, mitigating abuse, and operating their networks. We do not have access to a fine-grained log of this activity beyond what GitHub and Cloudflare make available in aggregated form.
The desktop app does not contact any "phone-home" endpoint. It does not transmit telemetry, usage statistics, listening data, or device fingerprints to us or to any third party as part of its normal operation. The only outbound network calls the app makes are the ones required to deliver features you have actively used: fetching audio from YouTube, lyrics from LRCLIB, artist information from Wikipedia and MusicBrainz, authentication and friends data from Supabase, and update checks from GitHub Releases. Each of these is documented in Section 5.
We do not purchase, license, or otherwise acquire personal information about you from data brokers, advertising networks, social-media platforms, or other third-party sources. The only information we hold about you is what you have provided directly or what is generated by your direct use of the app.
We use the limited information we collect for narrowly defined purposes, each tied to a feature you have chosen to use:
We do not use your information for advertising, profiling, automated decision-making with legal effect, or training machine-learning models.
For users located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) requires us to identify a legal basis for each category of processing. The bases we rely on are:
Interwave relies on a small number of third-party services to deliver its features. Each is listed below with a description of what the service receives, what it sees about you, and a link to its own privacy policy. We have no control over how these third parties operate, and you are encouraged to review their policies independently.
yt-dlp tool, which connects to YouTube's public web endpoints in the same manner as a web browser. No Google account is used and no YouTube Data API key is involved. YouTube will receive your IP address and user-agent string when audio is streamed, and any metadata YouTube ordinarily logs for an anonymous web visitor. See policies.google.com/privacy.
Website. The interwave.cc website does not set any cookies of our own and does not use any browser storage for tracking or analytics. The hosting providers (GitHub Pages and Cloudflare) may set strictly necessary cookies for content delivery, abuse mitigation, and security; these are operational in nature and outside our control.
Desktop application. Interwave's user interface is rendered in an embedded web view and uses localStorage for internal application state, including a small ring buffer of the most recent fifty error and crash messages so that they can be attached to a support ticket if you choose. This buffer is held entirely on your device and is never transmitted automatically. The app does not place any third-party tracking cookies.
Information stored in the managed backend is retained for as long as your account exists. If you delete your account (see Section 13), the account record, your friends-list edges, and any playlist snapshots you have uploaded are deleted within thirty days. Realtime presence messages are ephemeral — they exist only in transit on the realtime channel and are not written to long-term storage.
Support tickets, including their content and any attached diagnostics, are retained indefinitely by default so that we have a record of prior correspondence and can recognise recurring issues. You may at any time request that we delete the contents of any support thread you have initiated; we will honour such requests within thirty days unless retention is required to defend against, or to comply with, a legal claim.
Local data on your device is retained for as long as you keep it. Uninstalling the application does not always remove the local SQLite database; complete removal requires deleting the application-data directory described in Section 2.2.
Server logs maintained by our hosting and infrastructure providers are subject to those providers' own retention schedules, which are typically measured in days to weeks.
We do not sell, rent, lease, or trade your personal information. We do not share it with advertising networks, data brokers, or marketing partners. The only circumstances in which your information may be shared with third parties are:
Depending on where you live, applicable data-protection law may give you a number of rights with respect to the information we hold about you. These include, without limitation, the rights described in the European Union's GDPR, the United Kingdom's UK GDPR, the California Consumer Privacy Act (CCPA / CPRA), Canada's PIPEDA, Brazil's LGPD, and similar laws elsewhere. The rights that may apply to you include:
To exercise any of these rights, email support@interwave.cc from the email address associated with your account. We may need to verify your identity before acting on a request; verification typically consists of confirming control of the registered email address. We will respond within the period required by applicable law, ordinarily within thirty days.
Interwave is not directed to children under the age of thirteen (or the equivalent minimum age in your jurisdiction, where higher). We do not knowingly collect personal information from children under that age. If you are a parent or guardian and you believe that a child has provided personal information to us, please contact support@interwave.cc and we will take reasonable steps to delete that information promptly. Where applicable law requires verifiable parental consent for processing the personal data of minors above the age of thirteen, we do not knowingly process such data without that consent.
Interwave is operated by an individual developer and its backend is hosted by Supabase in regions selected by Supabase. Depending on the region in which your data is stored and the country from which you access the service, your personal information may be transferred to, processed in, and stored in countries other than your country of residence, including jurisdictions whose data-protection laws may differ from those of your home country. By creating an account and using the service, you acknowledge and consent to such transfers to the extent permitted by applicable law.
Where personal information is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism as appropriate, typically as incorporated into our data-processing agreements with our service providers.
We take reasonable technical and organisational measures designed to protect the information we hold against unauthorised access, alteration, disclosure, or destruction. Account passwords are never stored in plaintext; they are hashed by Supabase Auth using bcrypt before being written to the database. All traffic between the desktop application and the backend, and between the website and visitors' browsers, is encrypted in transit using HTTPS / TLS. Access to administrative interfaces is protected by strong authentication.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In particular, the local SQLite database is not encrypted at rest by default; anyone with access to your computer or to a backup of it can read its contents. You are responsible for the physical and logical security of your own device, including the use of full-disk encryption and an appropriate operating-system account password. If you become aware of an actual or suspected security incident affecting your Interwave account, please contact support@interwave.cc immediately.
To delete your account, email support@interwave.cc from the address registered to the account and ask us to delete it. We will confirm the request, perform the deletion within thirty days, and notify you when it is complete. Deletion removes your account record, your display name, your friends-list edges, your uploaded playlist snapshots, and any other account-bound data from the backend. Support-ticket history may be retained as described in Section 7; you may ask us to redact or delete it as part of the same request.
Deleting your account does not delete the local SQLite database on your device. To remove local data, quit Interwave, uninstall the application, and delete the application-data directory described in Section 2.2.
We may revise this policy from time to time to reflect changes in the service, in applicable law, or in our practices. The "Last updated" date at the top of this page will always reflect the date of the most recent revision. For material changes — for example, a change to the categories of information collected, the purposes for which it is used, or the third parties with which it is shared — we will provide additional notice through an in-app banner, a notice on the website, and, where we have your email address and the change is significant, by email. Continued use of the service after a change takes effect constitutes acceptance of the revised policy. If you do not agree with a revision, you should stop using the service and, if you wish, delete your account as described above.
For any privacy-related question, request, or complaint, the primary contact is support@interwave.cc. We will do our best to respond within a reasonable period, typically within a few business days for routine inquiries and within thirty days (or as otherwise required by applicable law) for formal rights requests.
For non-sensitive technical questions about the application itself, you are also welcome to open an issue on the public repository at github.com/Cloaxyyy/wave. Please do not include account credentials, personal information, or anything you would not want to be publicly readable in a GitHub issue.
Interwave is operated by an independent individual developer rather than a registered company. A postal address suitable for formal legal correspondence can be provided on request to the email address above.
This privacy policy is provided in good faith and reflects the operator's honest description of how Interwave handles personal information at the date stated above. Interwave is a free, non-commercial, hobbyist software project distributed at no cost and without warranty. Nothing in this document is legal advice. The operator is not a lawyer, makes no representation that this policy satisfies the requirements of any particular jurisdiction's data-protection law, and disclaims, to the maximum extent permitted by applicable law, any liability arising from reliance on it.
If you have specific legal concerns about your use of Interwave or about the processing of your personal information, you should consult qualified counsel in your own jurisdiction. If any provision of this policy is found to be unenforceable, the remaining provisions will continue in full force and effect.