Privacy Policy

Last updated: July 18, 2026

This Privacy Policy describes how Merkhet Ventures Limited, a New Zealand company ("we," "us") collects, uses, and shares information in connection with Kovrie (the "Software"), including its desktop application, web interface, and account/backup services.

The short version: by default, Kovrie doesn't send your data anywhere. Your mixer setup lives entirely on your own device. Creating an account is optional and only changes this for what you explicitly opt into (server-backed backup).

1. Information We Collect

1.1 Information you provide directly

If you create an account (email/password, Google sign-in, or email-code sign-in), we collect:

• Email address
• Password — we never store your actual password, only a salted, one-way cryptographic hash (Argon2id) that cannot be reversed to recover it.
• Display name, if you provide one (or if you sign in with Google, the name Google provides).
• If you sign in with Google: your Google account's stable identifier and the email address associated with it at the time of linking. We do not receive your Google password.

1.2 Backup data (only if you enable it)

If you're signed in, you can optionally enable backup, which sends your local mixer configuration to our servers so it can be restored later. This payload can include information you may not expect:

• Titles you've typed for your zones, sources, and saved snapshots.
• YouTube video IDs, Spotify track/playlist URIs, and direct audio URLs for any sources you've added.
• For audio files added from your local disk (desktop app only): the full file path on your computer (e.g. `/Users/yourname/Music/song.mp3`), which can reveal your device's username and folder structure. This is stored exactly as your operating system reports it; we don't parse or inspect it otherwise.

We store this as a single opaque blob per account and do not read, analyze, or use its contents for anything beyond storing and returning it to you.

1.3 Information collected automatically

• IP address, used only to rate-limit sign-in-code requests (preventing abuse) — held in server memory only, never written to our database, and cleared when the server process restarts.
• Browser/device user-agent string, recorded on each login session, so you can see or manage active sessions.
• Standard server request logs (method, path, status, response time, and the requesting IP), generated by our web framework's default logging. We host on Railway, which captures and retains this log stream per its own policies — see Railway's Privacy Policy.

1.4 Information that stays on your device and is never sent to us

Unless you sign in and enable backup, none of the following ever leaves your device: your mixer configuration, zones, sources, and snapshots; app settings; and (desktop app) your Spotify connection tokens, which are stored in your operating system's local config directory and are separate from — and never included in — the account backup payload above.

2. How We Use Information

• To create and secure your account, and to keep you signed in.
• To provide backup/restore, if you enable it.
• To communicate with you about your account (e.g., a sign-in code, a password-reset link) — see §3 for how these are currently sent.
• To detect and prevent abuse (e.g., rate-limiting repeated sign-in-code requests).
• We do not use your information for advertising, and we do not sell your information to anyone.

3. Third-Party Services

Kovrie integrates with, and may send limited information to, the following third parties:

• Spotify — if you connect your Spotify account, playback happens through Spotify's own SDK running in your browser/app, which communicates directly with Spotify. Looking up a track/playlist's title and artwork also calls Spotify's API directly from your device using your Spotify access token. See Spotify's Privacy Policy.
• YouTube / Google — playing a YouTube source loads YouTube's own embedded player, which communicates directly with Google. Looking up a video's title also calls YouTube's oEmbed endpoint directly from your device. See Google's Privacy Policy.
• noembed.com — a fallback used only if YouTube's own title lookup fails; the video URL is sent to this independent third-party service in that case.
• Google Sign-In, if you use it to create an account — we receive your name, email, and a stable account identifier from Google to create/verify your Kovrie account; see Google's policy linked above.
• Railway — application hosting and our managed PostgreSQL database; stores account and backup data on our behalf. See Railway's Privacy Policy.
• Email provider (not yet configured). Once selected, it will send verification/sign-in-code/password-reset emails on our behalf. As of this writing, these emails are not actually delivered by any third party; see §9.
• Error monitoring (Sentry) — present in the code but inactive by default; see §9.
• GitHub — the desktop app's manual "Check for updates" button, only when you click it, makes a request to GitHub to check for a new release.

We do not otherwise sell, rent, or share your personal information with third parties.

4. Cookies

Kovrie does not set any cookies. Sign-in uses a bearer token stored in your browser's local storage or, on desktop, a local file — not a cookie. Embedded YouTube and Spotify players (§3) may set their own cookies or local storage under their own domains, governed by their own policies, not this one.

5. Data Retention

• Account data is retained until you delete your account (or ask us to, at [email protected]).
• Sessions expire automatically after 30 days of inactivity, or immediately when you sign out.
• Sign-in codes expire after 10 minutes and are single-use.
• Backup data is retained until you delete your account or your backup is overwritten by a newer one.

6. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export a copy of your personal information, and to withdraw consent for us to process it. To exercise any of these, contact us at [email protected]. We will respond within the timeframe required by applicable law.

If you're in the UK or EU: you have rights under the UK GDPR / EU GDPR, including the right to lodge a complaint with your local data protection authority.

If you're a California resident: you may have rights under the CCPA/CPRA, including to know what personal information we've collected and to request its deletion. We do not sell or share your personal information for cross-context behavioral advertising. As of this policy's effective date, Kovrie does not meet the CCPA/CPRA revenue or data-volume thresholds that trigger these obligations for a business — we're honoring the same principles anyway, and will update this section if that changes as the business grows.

7. Children's Privacy

Kovrie is not directed at, and we do not knowingly collect personal information from, children under 13. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

8. Data Security

Passwords are hashed with Argon2id and never stored in plain text. Session tokens are stored as one-way hashes; the actual token is never persisted anywhere, including by us. All data in transit between your device and our servers is encrypted via HTTPS/TLS. At-rest storage security for our database is managed by our hosting provider (Railway); we have not conducted a separate independent audit of their at-rest encryption. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Current Implementation Notes

Two things worth being honest about rather than glossing over, since a privacy policy that doesn't match reality is its own liability:

• Emails aren't actually delivered yet. Verification, sign-in-code, and password-reset emails are currently logged to our server's own process output rather than sent through a real email provider.
• Error monitoring (Sentry) is present in the code but inactive — no destination is currently configured, so as shipped today, no error/crash data is actually transmitted anywhere.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated the same way as Terms of Service changes (see our Terms, §11).

11. Contact

Questions about this policy or your data: [email protected].