Privacy policy

1. Data controller

The site WaveFlow (https://waveflow.app) is a personal, non-commercial project. The data controller within the meaning of art. 5 lit. j Swiss FADP and art. 4 §7 GDPR is reachable at the email below, which is the official channel for any data-related request.

Contact:privacy@waveflow.app

2. Data collected

2.1 Server logs (technical)

Our host Cloudflare automatically collects, for security and abuse prevention:

• IP address
• HTTP headers (User-Agent, Accept-Language, Referer)
• Request timestamp
• Approximate country (derived from IP)

Cloudflare retains technical logs according to its policies; the period varies by service.

2.2 Cookies

The site sets exactly one strictly functional cookie — no advertising, no tracking, no fingerprinting.

This cookie is exempt from consent under art. 5(3) of the ePrivacy Directive as it is strictly necessary for the functionality you requested (language switch).

2.3 Analytics

Cloudflare Web Analytics measures page views and performance without analytics cookies or cross-site tracking.

2.4 Data NOT collected

• No advertising tracking
• No browser fingerprinting
• No behavioral profiling
• No resale to third parties
• No Meta Pixel, Google Analytics, TikTok Pixel or similar
• No cross-site tracking

3. Purposes and legal bases

No automated decision producing legal effects is taken about you. No profiling.

4. Recipients and transfers

4.1 Hosting

The site is hosted by Cloudflare, Inc. and served through its global network. Technical request data may be processed outside Switzerland and the EU.

4.2 Fonts

Inter and Bricolage Grotesque are self-hosted on waveflow.app via the @nuxt/fonts module. No request is sent to fonts.googleapis.com or fonts.gstatic.com — Google does not see your visit.

4.3 External links

The site contains links to GitHub.com (project source). If you click, GitHub Inc. will receive your request per their own privacy policy. No GitHub script is loaded on waveflow.app — their logo is stored locally.

5. Retention period

6. Your rights (FADP / GDPR)

You have the following rights:

• Access: obtain a copy of data concerning you
• Rectification: correct an inaccuracy
• Erasure: request deletion
• Portability: receive your data in a structured format
• Objection: object to processing based on legitimate interest
• Restriction: request restriction of processing

Exercise your rights by email to privacy@waveflow.app (response within 30 days). If you disagree:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch
• EU: data protection authority of your country of residence

Analytics opt-out

You can block Cloudflare Analytics at any time:

• By using a script blocker (uBlock Origin, Privacy Badger, Brave Shields)

7. Security

Technical and organizational measures consistent with art. 8 FADP and art. 32 GDPR:

• Encryption in transit: HTTPS/TLS 1.3 everywhere, HSTS preload (max-age 1 year)
• Strict Content Security Policy with SHA-256 hashes per script
• Security headers: X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, restrictive Permissions-Policy (camera/mic/geolocation blocked)
• Cross-Origin: COOP same-origin, CORP same-origin
• Open-source code: auditable on GitHub

8. Minors

The site is accessible to all but is not specifically aimed at people under 16. No data is knowingly collected from minors.

9. Changes

This policy may be updated if processing practices change. The last-updated date is shown at the top of the page. Material changes will be announced via the site's GitHub repository.

10. Contact

For any question, access request or complaint: privacy@waveflow.app