Privacy Policy
We collect your email, what you upload, and basic technical information needed to run the service. That is close to all of it.
There is no advertising, no tracking across other websites, and nothing is sold or shared with data brokers. We do not store raw IP addresses anywhere.
European accounts are stored in the EU. You can export or delete everything yourself, at any time, without contacting us.
Who we are
Northwest Falls provides storage, version history and private sharing for musicians. For European data protection law we are the data controller for your account information and the data processor for the files you upload.
Contact for anything privacy related: privacy@northwestfalls.com.
What we collect
Information you give us
- Email address. Needed to create an account, sign in and reach you about your account.
- Password. Stored only as a hash by our authentication provider. We never see or store the password itself.
- Artist profile. Your name, handle, and optionally a bio, location, genres and links. All optional except the name and handle.
- Your files. Audio, artwork, lyrics, credits, notes and metadata. See Your content for what we do with these.
- Payment details. Handled entirely by Polar, our merchant of record. We never receive your card number. We store only a customer reference, your plan, and the renewal date.
Information collected automatically
- Country. Derived at the network edge, used for data residency and to know where we can operate.
- Approximate technical details. Browser type and device category, used to make the product work on your setup.
- Salted IP hash. We hash IP addresses with a salt that rotates daily, then discard the address. The hash lets us count unique visits and stop abuse for one day, and is useless for identifying anyone after that.
- Link views. When someone opens a link you created, we record the time, the country, the referring site and whether audio played, so you can see how your share performed.
We do not store raw IP addresses. Not in the database, not in analytics, not in application logs. Anywhere an IP would normally be recorded, we store a daily-salted hash instead.
What we do not collect
- No advertising identifiers and no ad networks.
- No third party analytics or tracking pixels.
- No cross-site tracking, and no profile of your behaviour off Northwest Falls.
- No contact list, calendar or device file access.
- No use of your audio to train machine learning models, ours or anyone else's.
Why we process it
| What | Why | Legal basis |
|---|---|---|
| Email and password | Create your account, sign you in, contact you about it | Performance of a contract |
| Your uploaded files | Provide the storage service you signed up for | Performance of a contract |
| Payment reference and plan | Take payment and apply your plan limits | Performance of a contract |
| Country | Data residency and knowing where we can legally operate | Legal obligation |
| Salted IP hash | Rate limiting, abuse prevention, counting unique link views | Legitimate interest |
| Link view records | Show you how your shared links performed | Legitimate interest |
| Service emails | Verification, password resets, storage and billing warnings | Performance of a contract |
We do not rely on consent for any of the above, because none of it is optional extras. If you have an account, all of it is needed to run it.
Where your data lives
Accounts created in Europe are stored in the European Union. Your region is decided when you sign up, from the country the request came from, and it does not change afterwards without us telling you.
Your audio files are held in EU-jurisdiction object storage. Our database is hosted in the EU. The service itself runs on a global edge network, meaning the code answering your request may run near you, but your files and your account records stay in your region.
How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | Until you close your account, then 30 days |
| Uploaded files | Until you delete them, then up to 30 days to clear backups |
| Individual link views | 90 days, then reduced to daily totals with no per-visit records |
| Daily link statistics | As long as the link exists |
| Session records | 60 days, or until you sign out |
| Payment records | As long as tax law requires, typically 7 years |
| Application logs | 30 days |
Who else touches your data
We use a small number of providers to run the service. Each one is listed on the sub-processors page, with what they do and where they are based. We do not sell data, share it for advertising, or give it to data brokers. There is no arrangement under which anyone receives your information in exchange for money or services.
Your rights
If you are in the European Economic Area or the UK, you have the right to:
- Access a copy of what we hold about you.
- Correct anything inaccurate.
- Delete your data.
- Export it in a portable format.
- Object to processing based on legitimate interest.
- Complain to your local data protection authority.
Access, export and deletion are all buttons in Settings. You do not need to email us or wait for a response. For anything else, write to privacy@northwestfalls.com and we will reply within 30 days.
Security
Files are encrypted in transit and at rest. Master recordings are stored separately from the public streaming copies, and the server that answers public link requests has no access at all to master storage. Database access rules are enforced at the database level, not only in application code.
Full detail, and how to report a vulnerability, is on the security page.
Children
Northwest Falls is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has an account, contact us and we will remove it.
Changes
If we make a material change to this policy we will email every account holder at least 30 days before it takes effect. Smaller corrections are published with an updated date at the top of this page.