Privacy Policy

Novus Visualizers is operated by Novus Stream Solutions, a sole proprietorship trading as Novus Stream Solutions in London, Ontario, Canada. As a Canadian operator we handle personal information in line with PIPEDA and applicable Ontario law. Privacy questions go to visualizers@novusstreamsolutions.com.

Guest work is stored device-locally in your browser using IndexedDB, and it never leaves your device unless you explicitly export a `.novusvis` file. Signed-in projects, revisions, profiles, preferences, notifications, moderation records, and security events are stored in Turso (a hosted libSQL database), and the application itself is hosted on Vercel. Accounts use a public username and display name. Novus does not ask for or send to an email address; an internal non-routable credential identifier used by the authentication adapter is never exposed in application responses or used for communication.

Audio analysis and rendering run in your browser. For each project, you choose whether its uploaded audio is saved. If you decline, Novus stores a fingerprint and analysis metadata so another device can ask you to reattach the matching file. If you opt in, audio, images, video, fonts, and models are stored as private Vercel Blob objects with Turso ownership metadata. Sources are not made public by publishing.

Uploads receive random paths, checksum and type validation, decode/parse checks, and quarantine status. Public posts use separate preview derivatives. Private source audio and models are never served by a community page.

Passwords are stored only as secure hashes. Passkeys store public credentials; device private keys remain with your authenticator. Recovery codes are shown once, hashed, single-use, and replaced as a complete set. Recovery creates a short-lived HttpOnly session. Without a passkey, unused recovery code, or authenticated trusted session, Novus cannot self-recover an emailless account. Signup and account recovery are protected by Cloudflare Turnstile to block automated abuse.

Projects and assets are private until you explicitly publish. Publication freezes one revision and its preview. Public profile data, posts, comments, reactions, follows, remix attribution, and view counts may be visible to others according to your selected visibility. Reports, blocks, moderation decisions, and immutable admin audit records are retained to operate and secure the community.

Novus processes request metadata, coarse device/browser information, rate-limit state, and security events to prevent abuse and diagnose failures. Operational logs exclude passwords, recovery codes, raw project documents, usernames where avoidable, and private object paths. Novus uses Google Analytics 4 for aggregate usage measurement through this site's property and the Novus network roll-up, configured by one Google tag under Consent Mode v2. The analytics control on the cookies page governs analytics: your choice there sets Google's analytics and advertising signals, which default to denied in the EEA, UK, and Switzerland until you consent, are reapplied on later visits, and are overridden by Global Privacy Control. Turning analytics off immediately denies both destinations and expires applicable Google measurement cookies. Outside those regions (including Canada) those signals may be granted by default until you turn them off. First-party Vercel Analytics and Speed Insights measure page and performance metrics.

Advertising is served by Mediavine (Journey). Mediavine and its demand partners may use cookies, scripts, or similar technologies to serve and measure ads. Advertising consent is governed by Mediavine's own consent management platform, which appears for visitors in regions where that is required. This site's own analytics control covers analytics, not advertising. The Mediavine script is included in the page for every route, including this one, so that Mediavine's own consent prompt and its crawler can reach every page; this site's Content-Security-Policy refuses it outright on the signed-in and editing areas (Classic, Studio, dashboard, settings, admin, sign-in, sign-up, account recovery, notifications, and community publishing), so it cannot run there at all. Novus places no ad slots of its own on Classic, Studio, account, admin, legal, security, or accessibility routes, and exports do not open sponsor tabs.

Account export and deletion controls are provided in settings. After account deletion, data enters a deletion queue and a scheduled job permanently removes it; public safety and audit records may be retained where necessary to prevent abuse or meet legal obligations.

You can edit profile visibility, notification preferences, sessions, passkeys, and recovery codes; export project files; choose cloud audio storage per project; unpublish or report community content; and request account export or deletion. See the account security guide for the recovery model.

This service is intended for a general audience aged 13 and older and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will delete anything we hold.

You can ask us to confirm what personal information we hold about you and give you a copy of it; correct it if it is wrong; delete it; restrict or object to how it is used, including profiling for advertising; and receive it in a portable, machine-readable form. Project files can be exported yourself at any time from settings without asking us.

Where we rely on your consent for analytics, you can withdraw it at any time with the Essential only button under Your choices on the Cookie Policy page. Advertising consent is collected by Mediavine's own consent manager rather than by us, and where that manager is running for your visit you can reopen it from Manage advertising consent on the same page, beside the analytics control. Withdrawing either does not affect anything that happened before. Exercising any of these rights is free, and we will not degrade the service or treat you differently for it. We answer requests within 30 days.

These rights come from PIPEDA in Canada and, where they apply to you, from Articles 15 to 21 of the GDPR and the UK GDPR.

Novus is operated from Canada. Accounts and projects are stored in Turso and private assets in Vercel Blob; analytics and advertising are handled by Google and Mediavine. These providers operate globally and process data on servers outside Canada, including in the United States. Guest work and all rendering stay on your own device and cross no border at all.

For privacy questions or PIPEDA access or correction requests, email visualizers@novusstreamsolutions.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.