WAVEMOTION

Privacy Policy

Last updated October 4, 2026. Wavemotion is operated by Above the Hill Developments (“ATH”, “we”). Questions: dhill5711@gmail.com.

Wavemotion helps creators move their own work to the destinations they choose: you upload a source, approve the rights, choose where it goes and when, and Wavemotion publishes it and shows you evidence of what happened.

What we collect

• Account: when you sign in with Google we receive your Google account ID, email address, and name. We do not receive your password.
• Content you upload: the original files, titles, transcripts, Moments, and captions you create, and a checksum of each file.
• Managed clipping orders (only if you order them): the contact email you give for the order, and your explicit OK for the ATH clipping team to download that one source and deliver finished clips into your workspace. Every download and delivery is recorded in your workspace's receipts.
• Automatic transcription (only when you press it): the audio of that source is sent in short segments to Cloudflare Workers AI (OpenAI Whisper model run by Cloudflare) to produce timed captions. Cloudflare processes it to return the text and, per its Workers AI terms, does not use it to train models. The transcript is stored in your workspace labelled as machine output. If you press Suggest hook and caption or Find Moments with AI (which also runs right after automatic transcription), the transcript text is sent to a Cloudflare Workers AI text model (Meta Llama) to draft copy or propose clips; nothing is kept or posted until you choose it.
• Billing: if you subscribe or buy clipping, Stripe collects your card through WOW OS, the Above the Hill Developments payment hub. Wavemotion receives and stores only your subscription status, period end, Stripe customer and subscription IDs, and payment receipts. We never receive your card number. If you link a WOW Passport, we store its Passport Number and World Pass status, nothing else.
• Activity records: receipts of actions in your workspace (uploads, approvals, launches, publications) so you can audit what happened.
• People who join your Living Destination: if a visitor opts in on your public page, their email address and the exact consent text they agreed to. We store a daily-rotating hash of their network address only to limit abuse; we do not store the raw address.

Data from YouTube and Google APIs

If you connect a YouTube channel, you grant Wavemotion these permissions through Google’s own consent screen:

• Manage your YouTube videos (youtube.upload): used only to upload the videos you launch to the channel you chose.
• View your YouTube account (youtube.readonly): used only to identify the channel you connected (its name and ID) and to read your channel’s list of uploads so Wavemotion can confirm whether a video already landed and never upload the same post twice.

Google access tokens are encrypted at rest on our servers with a key that is never sent to your browser, and are bound to your workspace and channel. We do not sell YouTube or Google user data, use it for advertising, or use it to train AI models. We do not share it with anyone except as needed to perform the uploads you request, or if required by law.

Wavemotion’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

By connecting YouTube you also agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

Other connected platforms

You can also connect accounts on other platforms (for example TikTok, Instagram, Facebook Pages, Threads, X, LinkedIn, Pinterest, Tumblr, Reddit, Vimeo, Dailymotion, Twitch, Kick, Bluesky, Mastodon, Discord and Telegram). You sign in on each platform’s own page, or paste a revocable app token that platform issues; we never ask for or store your platform password. For each account we store its ID, its display name, the permissions you approved, and its tokens, encrypted at rest and bound to your workspace. We use them only to publish what you launch to the account you chose and to confirm the post. We don’t sell this data, use it for advertising, or use it to train AI models.

If someone sends you a Wavemotion connect link, the accounts you connect through it are attached to the sender’s workspace so they can post for you, as stated on that page. You can disconnect at any time by removing Wavemotion’s access in that platform’s settings, or by asking the workspace owner to disconnect it.

For platforms with no posting API (“tap to post”), Wavemotion does not connect to your account at all; it only prepares the media and caption for you to post yourself.

How we use data

• To run the service you asked for: store your originals, publish what you launch, and show results.
• To keep it safe and correct: prevent duplicate posts, enforce rights and permissions, and stop abuse.
• We never post to an account without your authorization, and automated posting happens only within the limits you set.

Storage, retention, and deletion

Data is stored on Cloudflare infrastructure. You can export your workspace at any time. Disconnecting a YouTube channel in Wavemotion deletes its stored tokens immediately and asks Google to revoke them. You can also revoke access yourself at myaccount.google.com/permissions. To delete a clip or original yourself, move it to Trash in Assets: it can be restored for 30 days, you can delete it forever at any time, and anything left in Trash for 30 days is deleted forever automatically, including its stored file, transcripts and Moments. To delete your whole account and content, email dhill5711@gmail.com; we delete it within 30 days, except records we must keep by law.

Your choices

You can access, export, correct, or delete your data, disconnect any connected account, and unsubscribe from any Living Destination you joined. Children under 13 may not use Wavemotion.

Changes

We will update this page and its date when this policy changes, and notify account holders of material changes.