1. Operator and scope

The operator is 웨이브룸 (Waveroom). This policy covers the Riffline Android app (com.rifflab.player) and Riffline email support. It does not cover the separate Waveroom service or Riffline desktop application. Contact contact@waveroommastering.com for privacy and support inquiries.

The privacy officer is 하윤우, representative of Waveroom. Contact: contact@waveroommastering.com.

2. Audio and settings on your device

Selected audio is played and analysed on your device. Audio copies, track information, practice settings and presets, language, skin and metronome preferences, and last-track information are stored locally. The app does not upload them to a developer server.

The library has no automatic expiry. Deleting a track removes its library copy, settings and presets. Current playback data may remain in memory. Original audio and exported WAV files must be managed separately. You can clear all app data using Android's app-storage controls.

3. Tuner and microphone

The app requests microphone permission when you start the tuner. Input is analysed live on your device without saving a recording or transmitting samples to a server. The app stops the microphone stream when you stop the tuner or the app enters the background. You can revoke permission in Android settings.

4. Saving files and external document providers

WAV audio is processed on your device and saved to the location you choose in Android's save screen. If you select a cloud-storage or other external document provider, that service may download or upload files and its policies apply. Delete external copies and exported files at their respective storage locations.

The app attempts to remove temporary export files after saving, cancellation, error handling or normal shutdown. Cleanup may not complete immediately after abnormal termination.

5. Data protection and app features

Riffline for Android uses bundled interface, font and audio-processing assets. Its WebView restricts requests and navigation outside the allowed app assets. Microphone use depends on your permission. The app does not transmit audio, microphone input or settings to a developer server and does not use advertising, analytics, remote crash-reporting, login or in-app billing SDKs.

Manage your device's access permissions and lock settings. External storage selected through the file picker and email services also apply their own safeguards to storage and transfer. We do not guarantee identical encryption across every external storage or transfer path.

6. Google Play purchases and refunds

Riffline is sold as a one-time paid download through Google Play. Google's policies govern Play accounts and payment processing. The app has no card-entry feature or function that sends Play purchase history to a developer server.

Order identifiers, messages and attachments you send for purchase or refund support are processed as needed for that request. Google's independent payment records are distinct from support materials actually received by the operator. Do not send passwords, full card numbers or identity-document copies.

7. Email inquiries, retention and deletion

Email support is optional and separate from local music-practice features. An inquiry to contact@waveroommastering.com may include your sender address, display name, message, attachments, transmission headers and receipt time. This information is used as needed to respond, investigate issues, handle requested purchase or refund support, and respond to privacy-rights requests.

Ordinary inquiries are retained for 90 days after the operator closes the inquiry following its response or remedial action, then deleted. This covers messages, replies, attachments and support copies controlled by the operator. Unnecessary information is deleted without delay. Legally required records are separated under section 8.

The operator reviews and removes the relevant materials from the regular mailbox and Trash. This does not mean that automatic deletion based on an inquiry's resolution date has been configured. The account's 30-day Spam/Trash cleanup interval is separate from the 90-day ordinary-inquiry period.

Zoho's mail deletion policy provides an additional 30-day server recovery period after removal from Trash. Operator deletion and final provider removal therefore occur at different times; not every copy is guaranteed to disappear exactly 90 days after resolution. Provider policy: https://www.zoho.com/mail/help/data-deletion-policy.html

Information needed for purchase or usage support is processed under Article 15(1)(4) of the Korean Personal Information Protection Act only to the extent actually necessary to enter into or perform a contract. This basis does not apply to every general inquiry. Before requesting additional information that requires separate consent, we explain the purposes, information involved, retention period, right to refuse and consequences, and obtain explicit consent before collection or processing. We do not request unnecessary information or treat sending an inquiry as separate consent.

8. Records that must be retained by law

These periods apply where the relevant law covers the operator's transaction or record and the operator actually holds it. They do not require collecting every buyer's information merely for retention. Google's records do not automatically fulfil any separate duties of the operator.

Article 6 of Korea's Act on the Consumer Protection in Electronic Commerce and its Enforcement Decree provides for five years for contract or withdrawal records, five years for payment and supply records, three years for consumer-complaint or dispute-resolution records, and six months for advertising records. Refund and cancellation materials are classified according to their content.

Where Framework Act on National Taxes Article 85-3 applies, books and supporting evidence are generally retained for five years from the day after the relevant statutory tax-filing deadline, or seven years for offshore transactions, subject to statutory exceptions. Depending on merchant status and record type, Commercial Act Article 33 may require ten years for commercial books and important business documents or five years for slips and similar records; commercial-book retention runs from closure.

Only necessary statutory records are separated from ordinary inquiries and retained for their legal purpose and period. They are deleted without delay once the retention grounds and period end. There is no blanket five-, seven- or ten-year rule for all inquiries.

Personal information retained is limited to what the relevant statutory record requires from materials actually received: sender email address, display name if provided, order identifier, transaction or inquiry details, processing dates and necessary supporting attachments. We do not additionally collect unverified buyer details or card information for this purpose.

9. Zoho Mail processing and international transfers

Service and purpose: Zoho Mail sends, receives and stores support email and provides related service operation and recovery. The app has no feature that sends audio or live microphone input to Zoho.

Contracting processor: Zoho's published regional terms assign South Korean accounts to Zoho Corporation Pte. Ltd. (Singapore). The service privacy contact is dpo@zohocorp.com; mail support is support@zohomail.com. Regional terms: https://www.zoho.com/legal/zoho-contracting-entities.html

Account data-storage country: this support account uses a United States data centre. Singapore, the contracting entity's location, is distinct from the United States mail-storage location.

Data: sender and recipient email addresses, display names, inquiries and replies, attachments, transmission headers and receipt times, and order identifiers or other details you include for support.

Timing and method: email transmission over the internet and storage on Zoho servers when you send an inquiry, the operator replies, and while the messages are retained.

Retention: the operator retains ordinary inquiries for 90 days after resolution; statutory records follow section 8. Deletion and Zoho's subsequent server retention are distinguished in section 7.

Refusal and consequences: you can avoid this inquiry channel's international processing by not sending support email. This does not affect on-device practice features, although support may be limited without the information needed for your inquiry. You may request deletion or restriction of information already received through the contact above. Sending an email is not treated as separate consent to an international transfer.

Basis for overseas transfer: the transfer details above are disclosed under Article 28-8(1)(3) of the Korean Personal Information Protection Act only for outsourced processing or storage actually necessary for purchase or usage support to enter into or perform a contract with the data subject. This basis is not applied indiscriminately to all inquiries or unsolicited information. Any additional overseas transfer requiring separate consent proceeds only after the relevant details are explained and consent is obtained before the transfer. A later reply or publication of this policy does not replace consent for a transfer that has already occurred.

10. Intended age group and children's information

Riffline is intended for music learners and practicing musicians aged 13 and over. This is not the same as an age of privacy consent or a content rating. The app does not require account registration or date-of-birth entry.

In Korea, processing a child under 14's personal information on a basis that requires consent requires a legal representative's consent and verification. Please conduct such inquiries through the legal representative. Before that processing, we explain the purposes, information involved, retention period, right to refuse and consequences, and any applicable overseas-transfer details to the legal representative. We obtain an explicit consent reply and verify representative authority to the extent necessary. Processing that relies on that consent does not proceed until the required consent and verification are complete. Unnecessary child information is deleted without delay, and records legally required to be retained are handled separately within that scope.

11. Your rights and effective date

Contact contact@waveroommastering.com to request access, correction, deletion, restriction of processing, or withdrawal of consent where applicable for information held by the operator. Identity or representative authority is verified only as needed. Any legal limitation on a request, such as required retention, is explained.

The operator cannot remotely delete audio and settings held only on your device. Use library deletion and Android's app-data controls, and manage originals, exported WAVs and external-storage copies at their respective locations.

This policy takes effect on its actual first publication date. Changes and their effective timing will be announced on the public policy page.