Privacy Policy

Last updated October 31, 2026 · Mariwave, LLC

1. Who is responsible for your data

Mariwave, LLC, a Delaware limited liability company, is the controller of the personal data described here.

• Privacy requests: privacy@mariwave.com
• Everything else: info@mariwave.com
• Data protection officer: none is appointed.

The pre-release is not offered to people in the European Union, the European Economic Area or the United Kingdom, so we have appointed no representative there. The request form and the sign-in refuse visitors whose connection Cloudflare places there.

This policy covers mariwave.com, web.mariwave.com and what the Mariwave Mac app sends to them.

2. What we collect, why, and our legal basis

A request to join. The email address you type into the request form, or the address you prove at sign-in if you are not yet admitted, with the name and note you add, the date, the decision and the administrator who made it. We use it to review and answer your request. Legal basis: steps you ask us to take before a contract (Article 6(1)(b)).

Your account and sign-in. Your email address, your display name if you have one, and the identifier and sign-in times Cloudflare's login gives us. We use them to create your account and sign you in. We keep no password. Legal basis: performing our contract with you (Article 6(1)(b)).

Sessions. A browser session is stored as a hash of its token, with its times. A Mac session is stored the same way, with the Mac's label and when it last renewed. We use them to keep you signed in and to let you and an administrator end a session. Legal basis: performing our contract with you, and our legitimate interest in keeping accounts secure (Article 6(1)(f)).

The access list. Which addresses may sign in, who changed that and when, and for a banned address the reason. We use it to run a closed pre-release safely. Legal basis: our legitimate interest in deciding who uses a pre-release product and in preventing abuse.

Legal acceptance. Which version of the Terms of Service and Confidentiality Agreement you accepted, its digest and the time. Legal basis: performing our contract with you, and our legitimate interest in being able to prove what was accepted.

Billing. Stripe collects your payment details on its own pages; we do not receive card numbers. We keep your Stripe customer identifier, your subscription and its status, trial codes, complimentary marks, and whether a payment was refunded or disputed. Legal basis: performing our contract with you, and our legal obligations for accounting records (Article 6(1)(c)).

Metered usage. For each model request or job on Mariwave's engine: the account, the service or model, the tokens or GPU seconds used, the price and the time. It holds counts, not your words. Legal basis: performing our contract with you.

Content you send to models on Mariwave's engine. Chat requests, music prompts and audio to transcribe pass through our Worker to Modal, which runs the models, and the answer comes back the same way. Our Worker does not store this content. The Terms of Service ask you to use only sample, test or non-sensitive data during the pre-release. Legal basis: performing our contract with you.

Support reports. If you press the Mac app's button to report a first-run failure, we receive the app, macOS and hardware versions, the failing step, the error and log text, your note and your reply address if you give them, and a hash of your network address. Email addresses, tokens and home folder names in the error and log text are removed before storing. The report is emailed to our support address. Legal basis: our legitimate interest in fixing faults and answering you.

Email. We send letters about your request, account, trial, subscription and policy changes, through Cloudflare Email Service. Legal basis: performing our contract with you, and our legal obligation to inform you where one applies.

Security and abuse limits. Your network address is used at the edge to limit repeated attempts. We do not store it, apart from the hash on a support report. Cloudflare keeps request logs for the Worker. Administrators' actions on accounts are recorded. Legal basis: our legitimate interest in keeping the service available and secure.

We do not sell your data, show advertising, or use your content to train models.

3. Data we get from others

• Cloudflare, and Google if you choose it at Cloudflare's login, confirm your email address.
• Stripe tells us about your customer record, subscription and payments.
• An administrator may add your address to the access list.
• Anyone can type an address into the public request form. An address typed there stays unproven until its owner signs in, and we write nothing to it unless an administrator admits it.

4. The Mac app

The Mac app runs on your Mac. Your provider keys stay in your Mac's Keychain and are never sent to Mariwave. Our Worker stores no person's credential. Chats on a local model stay on your Mac. A chat on a cloud model you connect with your own key goes to that provider under its terms, not through Mariwave.

5. Who receives your data

• Cloudflare: hosting, including the mariwave.com server, our database, file storage, the sign-in, email routing and sending, and request logs.
• Stripe: payments, subscriptions and tax.
• Modal: runs the models on Mariwave's engine.
• GitHub: access tokens the Mac app asks for.
• Google: hosts the mailbox that receives support reports and mail to us, and confirms your address if you choose it at Cloudflare's login.
• Mariwave's administrators, who decide requests and manage accounts.
• Authorities, where the law requires it.

6. International transfers

Mariwave, LLC is in the United States, and Cloudflare, Stripe, Modal, GitHub and Google are based there. Modal's model endpoints we use are in the United States. Your data is processed there and wherever those providers operate.

Cloudflare and Stripe rely on the EU-US Data Privacy Framework and on standard contractual clauses. Modal, GitHub and Google act under their own data processing terms. Write to us for a copy of what applies.

We set no fixed region for our Cloudflare database and storage, so Cloudflare chooses where they are held.

7. Cookies and similar storage

We set only the cookies the service needs. They are first-party and cannot be read by page scripts. We use no analytics, advertising or cross-site tracking.

• __Host-mari_session: keeps you signed in on one site, for up to 24 hours.
• __Host-mari_access_state: protects a sign-in in progress, for 5 minutes.
• __Host-mari_request: lets your browser fill in your own waiting request, for 30 minutes.

If you press the appearance button, your light or dark choice is saved in your browser's local storage under mari-appearance. It is not sent to us.

Cloudflare's login page and Stripe's payment pages set their own cookies on their own sites, under their own policies.

8. Data retention

• Requests to join: one year from the request, or sooner if you ask.
• Your account and what belongs to it: until the account is deleted. This includes sign-in identifiers and legal acceptances.
• Model usage records: 761 days, or until the account is deleted if that is sooner.
• Sign-in in progress: deleted within a day of its short expiry.
• Browser sessions: 24 hours, then deleted within a day.
• Mac sessions: 90 days after the last renewal.
• Song and transcription usage records: 761 days, so that the current and last full year can be answered for.
• Stripe event records: 90 days.
• Support reports: 90 days in our database. The emailed copy stays in the support mailbox for one year.
• Billing records at Stripe: Stripe keeps your customer record and invoices after your account is deleted, for as long as Stripe's own policy and the record-keeping laws that apply to it require.
• Content sent to Modal: Modal publishes no fixed period for prompts, audio and results.
• Cloudflare request logs: up to 7 days.
• Records kept after deletion: the history of access list changes, the record of administrators' actions and the record that a policy notice was sent stay for 761 days, to show what was done. A ban stays until it is lifted, to keep a banned address out.

9. Your rights

If the GDPR or the UK GDPR applies to you, you have the right to:

• access your data and get a copy (Article 15);
• correct data that is wrong (Article 16);
• erase your data (Article 17);
• restrict how we process it (Article 18);
• receive data you gave us in a portable format, or have it sent to another controller (Article 20);
• object to processing based on our legitimate interests (Article 21);
• complain to a supervisory authority, in particular where you live, work, or where you think the law was broken. In the UK that is the Information Commissioner's Office.

To use a right, write to privacy@mariwave.com. We answer within one month, and it costs nothing. We may ask you to prove the address is yours.

To delete your account, write to that address and an administrator carries it out. It removes your account and what belongs to it. A live subscription is cancelled first and unbilled usage is billed first. We keep what we must keep for accounting or to defend a legal claim. Section 8 lists what stays.

We do not rely on your consent for any of this processing. If we ever do, you may withdraw it at any time.

California residents have the rights set out in section 3.2 of the Terms of Service. We do not sell or share personal information.

10. Do you have to give us your data?

No law requires it. An email address is needed to answer a request, and an account needs a proven address and acceptance of the Terms of Service: without them we cannot admit you or give you an account. A name, a note and a support report are optional. A paid plan needs payment details at Stripe.

11. Automated decisions

We make no decision about you by solely automated means that has legal or similarly significant effect. A person decides every request to join.

Fixed rules do act without a person: limits on repeated attempts, the caps on waiting requests, a ceiling on unpaid usage, and a stop on metered work while a payment stands refunded or disputed. Lifting a payment stop is done by a person.

12. Security

Connections use TLS. Session tokens are stored only as hashes, and session cookies are Secure and HttpOnly. Forms that change an account are checked to come from our own site. Access to accounts by administrators is limited to named people and recorded.

No system is perfectly secure. Report a vulnerability to security@mariwave.com.

13. Age

You must be at least 18 to use Mariwave (Terms of Service, section 1.3). If you think we hold data about someone younger, write to us and we will delete it.

14. Changes to this policy

The date above moves with every change. We tell you by email before a material change takes effect.

15. Contact

Privacy questions and requests: privacy@mariwave.com