Privacy Policy

Novus Visualizers is operated by Novus Stream Solutions, a sole proprietorship trading as Novus Stream Solutions in London, Ontario, Canada. As a Canadian operator we handle personal information in line with PIPEDA and applicable Ontario law. Privacy questions go to visualizers@novusstreamsolutions.com.

Guest work is stored device-locally in your browser using IndexedDB, and it never leaves your device unless you explicitly export a `.novusvis` file. Signed-in projects, revisions, profiles, preferences, notifications, moderation records, and security events are stored in Turso (a hosted libSQL database), and the application itself is hosted on Vercel. Accounts use a public username and display name. Novus does not ask for or send to an email address; an internal non-routable credential identifier used by the authentication adapter is never exposed in application responses or used for communication.

Audio analysis and rendering run in your browser. For each project, you choose whether its uploaded audio is saved. If you decline, Novus stores a fingerprint and analysis metadata so another device can ask you to reattach the matching file. If you opt in, audio, images, video, fonts, and models are stored as private Vercel Blob objects with Turso ownership metadata. Sources are not made public by publishing.

Uploads receive random paths, checksum and type validation, decode/parse checks, and quarantine status. Public posts use separate preview derivatives. Private source audio and models are never served by a community page.

Passwords are stored only as secure hashes. Passkeys store public credentials; device private keys remain with your authenticator. Recovery codes are shown once, hashed, single-use, and replaced as a complete set. Recovery creates a short-lived HttpOnly session. Without a passkey, unused recovery code, or authenticated trusted session, Novus cannot self-recover an emailless account. Signup and account recovery are protected by Cloudflare Turnstile to block automated abuse.

Projects and assets are private until you explicitly publish. Publication freezes one revision and its preview. Public profile data, posts, comments, reactions, follows, remix attribution, and view counts may be visible to others according to your selected visibility. Reports, blocks, moderation decisions, and immutable admin audit records are retained to operate and secure the community.

Novus processes request metadata, coarse device/browser information, rate-limit state, and security events to prevent abuse and diagnose failures. Operational logs exclude passwords, recovery codes, raw project documents, usernames where avoidable, and private object paths. Novus uses Google Analytics 4 for aggregate usage measurement through this site's property and the Novus network roll-up, configured by one Google tag under Consent Mode v2. Analytics and advertising signals default to denied in the EEA, UK, and Switzerland until you consent through the cookie banner, your saved choice is reapplied on later visits, and Global Privacy Control overrides a saved grant. Turning analytics off immediately denies both destinations and expires applicable Google measurement cookies. Outside those regions (including Canada), advertising on marketing pages may load under the site's opt-out notice until you turn it off. First-party Vercel Analytics and Speed Insights measure page and performance metrics. Advertising on marketing pages is served by Adsterra for the current month. Google AdSense remains listed in ads.txt for possible future use, but its script is not loaded. Advertising scripts follow your cookie preference and never load on Studio, Classic, account, admin, legal, security, or accessibility routes. Starting an export may open one Adsterra sponsor page in a separate tab, no more than once per minute and only while advertising is allowed; the export itself never depends on it.

Account export and deletion controls are provided in settings. After account deletion, data enters a deletion queue and a scheduled job permanently removes it; public safety and audit records may be retained where necessary to prevent abuse or meet legal obligations.

You can edit profile visibility, notification preferences, sessions, passkeys, and recovery codes; export project files; choose cloud audio storage per project; unpublish or report community content; and request account export or deletion. See the account security guide for the recovery model.

This service is intended for a general audience aged 13 and older and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will delete anything we hold.

You can ask us to confirm what personal information we hold about you and give you a copy of it; correct it if it is wrong; delete it; restrict or object to how it is used, including profiling for advertising; and receive it in a portable, machine-readable form. Project files can be exported yourself at any time from settings without asking us.

Where we rely on your consent (analytics and advertising), you can withdraw it at any time from Manage cookie choices, and withdrawing does not affect anything that happened before. Exercising any of these rights is free, and we will not degrade the service or treat you differently for it. We answer requests within 30 days.

These rights come from PIPEDA in Canada and, where they apply to you, from Articles 15 to 21 of the GDPR and the UK GDPR.

Novus is operated from Canada. Accounts and projects are stored in Turso and private assets in Vercel Blob; analytics and advertising are handled by Google and Adsterra. These providers operate globally and process data on servers outside Canada, including in the United States. Guest work and all rendering stay on your own device and cross no border at all.

For privacy questions or PIPEDA access or correction requests, email visualizers@novusstreamsolutions.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.