← WaveCast

Privacy Policy

Last updated: July 7, 2026

Data Controller

Brehm, Osipovs & Zimmermann Software GbR Birkenstr. 111 40233 Düsseldorf Germany Email: contact@wavecast.app

Note on Children

Our services are not intended for individuals under the age of 16, and we do not knowingly collect personal data from minors.

1. Introduction

Welcome to WaveCast. We are committed to protecting your privacy and handling your personal data in a transparent and secure manner. This Privacy Policy describes how we collect, use, and share your personal data when you visit our website at www.wavecast.app (the "Site").

WaveCast is a macOS application that brings AirPods spatial audio to any source on your Mac. This Privacy Policy covers only our Site. The WaveCast desktop application itself does not collect analytics or transmit any usage data about you.

Please read this policy carefully. By using our Site, you agree to the collection and use of information in accordance with this policy.

2. Data We Collect

2.1 Website Data Collection

Anonymous Analytics (No Consent Required)

We use anonymous analytics (PostHog) to understand basic website usage patterns without identifying individual users. This operates without cookies or persistent storage and collects:

  • Page views and navigation: Which pages you visit and how you navigate our Site
  • Traffic sources: UTM parameters and referrer information to understand how you found us (e.g., from search engines, social media, or advertising campaigns)
  • Device and browser information: Browser type, operating system, screen resolution, and user agent string
  • Approximate location: City and country derived from your IP address
  • Session data: A temporary, anonymous session identifier that changes daily and cannot identify you across different days or sessions

How it works: PostHog generates a privacy-preserving hash on our servers using your IP address, user agent, and a daily salt that is deleted after processing. This hash cannot be reversed to identify you and changes every day, meaning each day you visit appears as a new anonymous user.

Legal Basis: Legitimate Interest in understanding website usage patterns and measuring marketing effectiveness.

Consent-Based Analytics (Requires Consent)

If you accept analytics cookies through our cookie consent banner, we upgrade to persistent tracking which provides:

  • Cross-session identification: Recognition of you across multiple visits to our Site
  • User journey tracking: Understanding your behavior over time
  • Advanced analytics: Feature flag assignments, A/B testing, and detailed interaction tracking
  • Persistent identifiers: PostHog distinct IDs stored in cookies/local storage

This enhanced tracking collects the same data types as anonymous analytics, but with persistent identifiers that allow us to recognize you on return visits.

Legal Basis: Consent (GDPR Article 6(1)(a)).

Information You Provide:

  • Email Address: When you join our waitlist or contact us
  • Marketing Consent: Whether you have provided explicit consent to receive communications from us
  • Server Logs: Our hosting provider automatically collects standard server logs, which may include your IP address, browser type, page requests, and timestamps

2.2 Advertising and Marketing Technologies

We use a tag management system (Google Tag Manager) together with advertising pixels and cookies from third-party platforms to measure the effectiveness of our marketing campaigns and deliver relevant advertising. These services may collect information about your visit to our website and your interactions with our ads.

Cookie Consent Requirement: Before any advertising technologies are activated, you will see a cookie consent banner asking for your explicit permission. You can choose to:

  • Accept all cookies (analytics + advertising)
  • Accept only essential cookies (advertising disabled)
  • Customize your preferences

Advertising pixels will only be activated if you provide explicit consent through this banner.

Tag management:

  • Google Tag Manager: We use Google Tag Manager to load and manage the tags described below. Google Tag Manager itself is a container that fires other tags according to your consent choices.

Advertising platforms we use:

  • Google Ads (conversion tracking and remarketing)
  • Meta Pixel & Conversions API (Facebook/Instagram advertising, including server-side conversion events)

What they collect:

  • Your IP address
  • A hashed (pseudonymised) version of your email address
  • A hashed pseudonymous identifier and ad-platform cookie IDs
  • Browser type and version
  • Pages you visit on our website
  • Whether you arrived from one of our advertisements
  • Actions you take on our Site
  • Device identifiers and advertising IDs

How we use this data:

  • Measure conversion rates from our advertising campaigns
  • Show you relevant ads on Google, Facebook, and Instagram
  • Create audiences of similar users who might be interested in WaveCast
  • Optimize our advertising spend

Your choices: You can opt out of personalized advertising through:

3.1 Website Data Usage

To Analyze Site Usage, Measure Marketing Effectiveness, and Improve the Site (Anonymous Analytics — No Consent Required):

  • Purpose: Understand basic website traffic patterns, measure effectiveness of marketing campaigns (including UTM parameters from advertising sources), identify popular content, and optimize website performance.
  • Legal Basis: Legitimate Interest in understanding how our website is used and measuring the return on our marketing investments.
  • Data Processing: PostHog processes this data using anonymous, non-persistent identifiers that cannot track you across different days.

To Enable Advanced Analytics and Cross-Session Tracking (Consent-Based):

  • Purpose: Recognize returning visitors, analyze user journeys over time, perform A/B testing, and deliver personalized experiences.
  • Legal Basis: Your explicit Consent, obtained through the cookie consent banner.
  • Data Processing: PostHog stores persistent identifiers in cookies/local storage only when you have consented.

To Measure Advertising Effectiveness and Deliver Relevant Advertising (Consent-Based):

  • Purpose: Measure conversions from our advertising campaigns, build audiences, and show you relevant ads on Google, Facebook, and Instagram.
  • Legal Basis: Your explicit Consent, obtained through the cookie consent banner.

To Send You Communications:

  • Purpose: Inform you about WaveCast availability, early access, and product updates.
  • Legal Basis: Your explicit Consent, obtained through the waitlist signup form.

3.2 Other Purposes

For Security and Troubleshooting:

  • Purpose: Monitor for and prevent fraudulent or malicious activity, diagnose technical problems, and maintain security.
  • Legal Basis: Our Legitimate Interest in protecting our services and business operations.

To Comply with Legal Obligations:

  • Purpose: Comply with applicable laws, regulations, and legal processes.
  • Legal Basis: Compliance with a legal obligation.

4. How We Share Your Data (Third Parties)

We share your personal data with third-party service providers who perform services on our behalf. These third parties are obligated to protect your data and use it only for the purposes we specify.

Brevo (Email Service): We share your email address and marketing consent status with Brevo to manage our waitlist and send you communications.

PostHog (Analytics): We share usage data, identifiers, and event information with PostHog to perform website analytics, A/B testing, and feature flag management, as well as geographic and technical data processing.

  • Anonymous Analytics (no consent required): Page views, traffic sources (including UTM parameters), device information, and approximate location are processed using privacy-preserving, non-persistent identifiers.
  • PostHog, Inc. acts as our processor under a data processing agreement (Art. 28 GDPR). All analytics data is hosted on PostHog Cloud EU (AWS data centre, Frankfurt, Germany), and we have disabled IP-address retention, so events are stripped of IP-derived personal data on ingestion.

Google (Tag Manager and Advertising): We use Google Tag Manager to manage tags on our Site, and Google Ads for advertising campaigns, conversion tracking, and remarketing. With your advertising consent, we share website usage data, device information, and interaction data with Google. (Privacy Policy)

Meta Platforms (Facebook/Instagram): With your advertising consent, we use the Meta Pixel and Conversions API for advertising campaigns, conversion tracking, and remarketing, including server-side conversion events (Conversions API) containing a hashed email address and technical identifiers. (Privacy Policy)

Hosting Provider (Vercel): Your website data, including server logs, is processed and stored by our hosting provider, Vercel Inc., as necessary to operate the Site.

We do not sell your personal data. We may also disclose your data if required by law or in response to valid requests by public authorities.

5. Cookies and Tracking Technologies

Anonymous Analytics (No Cookie Consent Required)

Our website uses PostHog anonymous analytics by default, which operates without cookies or persistent browser storage. This means:

  • No data is stored on your device
  • You cannot be tracked across different days or sessions
  • Each visit appears as a new anonymous user
  • Page views and UTM parameters (traffic sources) are collected to understand basic website usage and marketing effectiveness

Legal Basis: Legitimate interest in understanding website usage and measuring marketing campaign performance.

Cookie Consent Banner: When you first visit our website, you will see a cookie consent banner that allows you to:

  • Accept all cookies (including advertising and analytics)
  • Reject non-essential cookies (advertising and analytics disabled)
  • Customize your cookie preferences
  • Review and change your choices at any time

Our website uses cookies and similar tracking technologies from both first-party (PostHog) and third-party services (Google, Meta) to:

  • Analyze website usage (requires consent)
  • Remember your preferences (essential, no consent required)
  • Track advertising effectiveness (requires consent)
  • Enable retargeting campaigns (requires consent)

You can control cookies through:

  • Our cookie consent banner (recommended)
  • Your browser settings (may limit functionality)

Cookie Duration:

  • Essential cookies: Session end or a few days
  • Analytics cookies: Up to 1–2 years unless consent is withdrawn
  • Advertising cookies: Up to 1–2 years unless consent is withdrawn

Withdrawing Consent: You can withdraw your cookie consent at any time by clearing your browser cookies or using the "Manage Cookie Preferences" link at the bottom of this page.

6. Data Retention

Email Address and Marketing Consent: Retained while you remain on our waitlist or mailing list or until you withdraw consent, unless a longer retention period is required by law.

Website Analytics Data: Retained by PostHog for up to seven (7) years in line with our PostHog plan. Because IP addresses are not retained (see Section 4), the stored analytics data does not identify you.

Advertising Data: Retained by the respective advertising platforms (Google, Meta) in accordance with their own privacy policies and retention periods.

7. Data Security

We have implemented appropriate technical and organizational security measures designed to protect your personal data from accidental loss and unauthorized access, use, alteration, and disclosure. However, no method of transmission over the Internet or electronic storage is 100% secure.

In the event of a personal data breach, we will notify affected individuals and regulators as required by applicable law.

8. Your Data Protection Rights

For Users in the European Economic Area (EEA), UK, and Switzerland: Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

  • Right to Be Informed — Know what data we collect and how we use it
  • Right to Access — Request a copy of the personal data we hold about you
  • Right to Rectification — Ask us to correct inaccurate data
  • Right to Erasure — Request deletion of your data ("right to be forgotten")
  • Right to Restrict Processing — Ask us to limit how we use your data
  • Right to Data Portability — Receive your data in a portable format
  • Right to Object — Object to processing based on legitimate interest or direct marketing
  • Right to Withdraw Consent — Withdraw consent for marketing or analytics at any time without affecting the lawfulness of prior processing

Right to Lodge a Complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with a data protection authority. Our competent supervisory authority is:

  • Germany (our authority): Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
  • Other EU countries: you may also complain to the authority in your country of residence

Automated decision-making: We do not carry out any automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR.

9. How to Exercise Your Rights

To exercise your rights or withdraw consent, contact us at contact@wavecast.app.

Withdraw Marketing Consent: Click the "unsubscribe" link in any email or contact us directly.

Withdraw Website Analytics Consent:

  • Click "Manage Cookie Preferences" at the bottom of this page to re-open the consent banner
  • OR: Clear your browser cookies and refresh the page
  • OR: Contact us at contact@wavecast.app and we will manually remove your consent

Withdraw Advertising Consent:

  • Use the same methods as analytics consent above
  • Additionally, you can opt out directly through advertising platforms:

10. International Data Transfers

Some of our service providers are located outside the EU/EEA (primarily in the United States). Where that is the case, we ensure an appropriate safeguard under Chapter V GDPR for each transfer:

  • PostHog (analytics): hosted on PostHog Cloud EU (Frankfurt, Germany) — analytics data is not transferred to a third country.
  • Google (Tag Manager and advertising, only with your consent), United States: EU-US Data Privacy Framework and/or Standard Contractual Clauses, as provided by Google.
  • Meta (advertising including via server-side Conversions API, only with your consent), United States: EU-US Data Privacy Framework and/or Standard Contractual Clauses, as provided by Meta.
  • Vercel (hosting), United States: EU-US Data Privacy Framework certification (Art. 45 GDPR) and Standard Contractual Clauses.

You may request a copy of the relevant Standard Contractual Clauses by contacting us at contact@wavecast.app.

11. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be published on this page with a revised "Last Updated" date. We encourage you to review this page regularly.

12. Contact Us

If you have questions about this policy or want to exercise your data rights, contact us:

Brehm, Osipovs & Zimmermann Software GbR Birkenstr. 111 40233 Düsseldorf Germany

Email: contact@wavecast.app

If you want to change your cookie preferences or see the consent banner again, use the "Reset your cookie preferences" button at the bottom of this page.