Privacy policy

01. Scope and operator

Qualified4, the operator and developer of Wavely (contact: davin3377@gmail.com), explains the handling of data by this personal Windows music editing app and its public information website. The app is not publicly distributed. This website has no user registration, payment features, advertising, analytics or tracking scripts.

Local editing is implemented. YouTube OAuth, uploads and playlist features are under development and validation. The account-related descriptions below reflect the development code reviewed on the effective date; they do not mean that live Google authorization and uploads have been fully validated.

02. Information accessed and purposes

• Google OAuth: authorization from the selected Google account to access YouTube APIs. Wavely does not receive your Google password or request Gmail, Contacts or Drive permissions.
• Channel information: YouTube channel ID and name, connection status and update time, used to display and verify the upload account.
• Playlists: IDs, titles, visibility, item counts, thumbnail URLs and video membership information, retrieved and stored to select destinations and track playlist additions.
• Selected uploads: the local MP4 you select, plus its title, description, tags, visibility, audience and other upload settings, sent to YouTube. Unlisted is the default; YouTube may impose a different actual visibility.
• Upload records: video IDs, channel and track references, local file paths, sizes and hashes, processing and transfer status, errors, timestamps and playlist membership status, stored locally. Resumable upload session information is also processed.

03. Permission and credential storage

The development code requests one scope: https://www.googleapis.com/auth/youtube.force-ssl, for channel identification, playlist retrieval, video upload and status checks, and adding videos to playlists. This is a broad permission that can view, edit and delete YouTube videos, ratings, comments and captions; it is not read-only or upload-only. Wavely uses it only for the functions disclosed here. Declining prevents connected features, while local editing remains available.

Authorization uses your default browser and a local loopback callback, with PKCE and state validation implemented. Access tokens, refresh tokens, imported OAuth client configuration and upload session information are stored as Windows user-bound DPAPI encrypted files in the app data folder under credentials. They are not sent to this website. The original imported OAuth JSON file is not automatically deleted and remains your responsibility.

When a token is near expiry or an API rejects authorization, the app requests a refresh from Google and updates its local credential file. If refresh is rejected, reauthorization is required. General library databases, media and logs are not claimed to be encrypted. You are responsible for protecting your Windows account and computer.

04. Local editing data and retention

Source URLs, titles and chapters, selected ranges, tracks, bookmarks, metadata, editing settings and job history are stored in library.sqlite3 in the app data folder. Imported and downloaded media are in media, waveform and preview caches in cache, album artwork in artwork, and diagnostic records in logs. MP3 and MP4 outputs are saved to your chosen output directories, which may be outside the app data folder.

Files, edits, channel data, playlists and upload records may remain until you delete them. No automatic expiry cleanup has been confirmed. Disconnecting an account alone does not delete all these records or media.

05. Transfers and external services

There is no separate Wavely backend or cloud database. Authentication data and Google account data are transmitted directly between your PC and Google APIs only as needed for authorization, refresh, revocation and the YouTube API functions you request. The developer does not operate a server receiving this data.

YouTube importing uses the external yt-dlp tool through a path separate from OAuth uploads. Processing a selected video URL connects to YouTube and Google media servers or CDNs, which may receive your IP address and request information. Fetching video frames also involves network requests. FFmpeg and ffprobe process media locally. You must verify your rights to download, edit and upload content and the applicable YouTube terms.

This website is hosted on GitHub Pages. The operator adds no cookies, analytics, advertising or tracking scripts. GitHub may process IP addresses and other access information to provide hosting under its own policy. This website does not receive Google logins or tokens.

Google user data is not sold or used for advertising, profiling or training general-purpose AI models, or made available to other users. Information you voluntarily send by email is used to answer your inquiry and is handled through Gmail. Do not email tokens, passwords or OAuth configuration files.

06. Disconnecting, revocation and deletion

1. Disconnect in the app: in the development app, open YouTube 업로드 (YouTube upload) → YouTube 계정 (YouTube account), then choose 연결 해제 및 인증 정보 정리 (disconnect and clear credentials) for the channel. The app attempts Google revocation and removes that account’s locally stored tokens and upload session credentials. Google revocation may fail when the network is unavailable; also check the next step.
2. Revoke at Google: open Google account third-party connections, select Wavely and remove its access. This does not automatically delete local records or uploaded videos.
3. Delete all local data: finish ongoing jobs and fully close the app. In File Explorer, delete the app data folder identified in settings (the default Windows location is %APPDATA%\app.wavely.desktop; a custom location may differ). This removes the database and associated files, channel, playlist and upload records, credential files including the imported configuration copy, caches, artwork, downloaded media and logs. This deletes the whole library, so retain any files you need first.
4. Other files: outputs in separate MP3/MP4 directories, external originals, the original OAuth JSON and user-created backups are not automatically removed. Delete them separately in File Explorer, and empty the Recycle Bin if needed.
5. Data on YouTube: delete uploaded videos and playlist entries in YouTube Studio or YouTube. Disconnecting or deleting local data does not delete videos already sent to Google.

A separate bulk deletion control for Google-derived records and automatic retention cleanup have not been confirmed in the current app. Deleting the app data folder is the way to remove all local records. Contact support below if you need help.

07. Google and YouTube policies

Wavely’s use and transfer of Google API data must follow the Google API Services User Data Policy, including applicable Limited Use requirements. Data is used only for the disclosed user-facing functions, never sold or used for advertising. This statement does not represent verification or compliance approval by Google.

The YouTube API Services Terms of Service and Developer Policies apply to YouTube integration. Users are also bound by the YouTube Terms of Service. See Google’s Privacy Policy for Google’s processing, and the GitHub Privacy Statement for website hosting.

08. Changes and contact

We update this policy and its effective date when data handling or permissions change. Access to Google data for a new purpose requires appropriate prior notice and consent.

Operator and developer: Qualified4 (Wavely)
Privacy and support: davin3377@gmail.com
Effective date: 2026-11-15