Last updated: 2 November 2026
Music Waveform is built to be private by design. The short version: your audio files never leave your browser, we don't ask you to sign up, and we don't collect personal data. This policy explains exactly what happens to any information involved when you use the tool at music-waveform.com (the "Service").
When you open an audio file, it is decoded, analyzed, rendered and encoded to MP4 entirely within your browser, on your own device. Your files are never uploaded to, transmitted to, or stored on any server we operate or any third party. When you close or reload the page, the in-memory audio data is discarded.
We use Vercel Analytics and Vercel Speed Insights to understand aggregate, anonymous usage (for example, how many people visit a page, and general performance metrics). This collection is cookie-free and does not use fingerprinting to build a profile of you. It does not include your audio, your file names, or any directly identifying personal data. See Vercel's Privacy Policy for details on how Vercel processes data as our hosting and analytics provider.
The Service records a small number of custom, anonymous events so we can tell whether the tool actually works on your device: whether your browser supports MP4 export at all, whether it can include sound in the exported file, when audio is loaded, when the demo track is played instead of a file of your own, when a file cannot be decoded, when an export starts, and when it succeeds, fails or is canceled. These carry only technical details: the chosen waveform style, the output resolution and frame rate, the exported length in seconds, the file extension, whether the audio came from your device or from the demo, how long the work took, and an error category when something goes wrong.
A second, smaller group of events covers the optional tip: the "Buy me a coffee" button in the corner and in the footer, the line shown after a successful export, and the small button that appears further down the tool page or partway through a blog article. They record that one was displayed, and whether it was clicked or dismissed, nothing beyond which placement it was, and, for the one after an export, whether it was the first, second or third time. Payment, if you choose to make one, happens entirely on the payment provider's own site; we never see your name, your email or your card details, and nothing about a payment is sent back here.
A third group covers the optional Pro add-on: which of its layers were switched on, that the line beside the export button was shown, that checkout was opened, and whether an unlock key was accepted or rejected. A rejected key records only that an attempt happened and which attempt it was, and never the text you typed, since a mistyped key could be anything. The export events also carry whether the file included the add-on, and how many of its layers were left out of it.
A language is offered once, when the page you landed on is not in a language you read. Three events record that the bar was shown, and whether it was followed or dismissed, together with the language being offered. Nothing else about you is involved in that choice.
After an export has finished, you may be offered a rating: five stars, at most twice, and never again once you have answered. Three events record that the prompt was shown, the number of stars you chose if you chose any, and whether you waved it away — plus, when it is held back, the reason it was held back. There is no comment box, and that is deliberate rather than an omission: a free-text field is something you could type your name, your email or a file name into, and no field is the only way to be certain none of that is ever sent. The star you pick is a number between one and five, and it is the whole of what that prompt collects.
Two smaller events cover how the tool is used rather than whether it works: following a link from a guide to the tool, which records only which guide it was and whereabouts on the page the link sat, and applying one of the built-in looks, which records the name of that look. Every event also carries the language the page was served in, which is the one already in the address you visited: en, ja or ko. The export event additionally counts whether it was your first, second or third of the visit.
They never include the audio itself, its file name, or anything about its content, nor the background image or album art you may add, which are read by your browser and never leave it. They exist to answer two questions: which browsers and devices the export fails on, so we can fix it, and whether the tool is worth supporting to the people who use it.
Your tool settings (such as the selected waveform style, colors and analysis options) are saved in your browser's localStorage so the tool remembers your preferences between visits. The same storage holds a small counter recording whether you have already seen or dismissed the tip prompt and button, so they stop asking. It is shared between the tool and the blog: declining once is enough for the whole site. Alongside them sit your Pro settings, any looks you have saved under a name, a note of which language bar you have already answered, a record of the star rating you gave and when you were last asked for one — which is what stops that prompt coming back — and, once you buy the add-on, a flag recording that this browser is unlocked.
What is never stored is media. Your audio file has never been, and neither are the background image or album art you can add with the add-on: they are read by your browser, held in memory while the tab is open, and gone when you close it. That is why both have to be chosen again on your next visit. This data stays on your device, is not transmitted to us, and you can clear it at any time through your browser settings.
Music Waveform does not set advertising or tracking cookies. We do not use cookies to identify you.
The Service is hosted by Vercel Inc., whose full address is on the legal notice. Like any web host, Vercel automatically processes limited technical information such as your IP address and browser user-agent as part of normal web-server operation and content delivery. This is standard for essentially every website and is handled by Vercel as described in their privacy policy linked above.
If you buy the Pro add-on, the purchase is handled by Stripe, which acts as the merchant of record: Stripe is the seller, takes the payment, charges any tax due where you live, and sends your receipt. Your name, email address and card details are given to Stripe and never to us. Nothing about a payment is sent back to this site. The key from your receipt is checked inside your own browser, which is why the add-on works with no account and no sign-in. Stripe assumes that seller role in roughly eighty countries rather than everywhere; the legal notice says what happens outside them, and it changes nothing about what this site receives, which is nothing either way.
Because we do not collect your audio or personal account data, there is nothing of that kind for us to retain or delete on a server.
The page views and the events in section 2 are the only processing of personal data this site carries out. They rest on the publisher's legitimate interest (article 6(1)(f) GDPR) in knowing whether the tool works on real devices and whether the pages are useful — an interest that a counter which cannot identify anyone does not weigh against. Vercel keeps them for twelve months, the reporting window of the plan this site runs on, and they are aggregated, never profiled.
Vercel Inc. processes them on the publisher's behalf, in the United States, under a data processing agreement. That transfer rests on two safeguards rather than one: Vercel is certified under the EU–U.S. Data Privacy Framework, and the same agreement incorporates the European Commission's 2021 Standard Contractual Clauses (decision 2021/914, Module Two). A copy is published at vercel.com/legal/dpa.
The Service is a general-audience tool and is not directed at children — under 15 in France, where article 8 of the GDPR sets the age of digital consent, and under 13 in the United States. We do not knowingly collect personal information from children, and in truth we collect no personal information from anyone: there is no account, no sign-up, and no field to type a name into.
Depending on where you live (for example, under the GDPR in the EU/UK or the CCPA in California), you may have rights to access, correct, or delete personal data held about you. Since the Service is designed not to collect personal data, in most cases there is simply nothing held. If you believe we hold data about you and wish to exercise a right — access, rectification, erasure, restriction, portability or objection — contact us using the details below.
You also have the right to complain to a supervisory authority. The publisher is established in France, so that is the CNIL; you may equally go to the authority where you live.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
Music Waveform is published and operated by Damien Yvert, an independent developer (see About), who is the data controller for the little data described on this page. His postal address, telephone number and registration number are on the legal notice. Questions about this policy or your privacy? Contact damienyvert.dev@gmail.com.