Last updated: 15 September 2026

Privacy

Naluvia lets you listen to soundscapes and save mixes. This page describes the data processing the service is designed to perform.

Account and soundscapes

Creating an account by email uses your email address, display name, and a password stored as a hash. You can also sign in with Apple or link Apple to a Naluvia account you are already signed in to. Naluvia verifies the identity provided by Apple without receiving your Apple password. The shared address may be a private relay address, or may be absent for some managed Apple accounts.

Saved mixes are linked to your account so you can access them on your devices. Naluvia session tokens are stored as hashes on the server. For Apple sign-in, the server stores a fingerprint of your Apple identifier and encrypts the refresh tokens needed to verify and revoke that authorisation. Signed notifications from Apple allow the service to respond to revocation or changes to the email relay.

Audio and cache

Sounds and images are hosted on OVHcloud storage. The app keeps a local cache, limited to 500 MB by default. The app or device may clear this cache; it is not a guaranteed permanent download. Files used in active playback are protected from cleanup.

Ads and privacy choices

Ads remain disabled until their configuration is complete. When they are enabled, Google Mobile Ads and its consent platform handle the required choices. On iOS, tracking permission is requested when applicable. Declining does not prevent listening. No ad should interrupt a listening session. You can change your choices in the app settings.

Subscriptions

When available, subscriptions are purchased through Google Play or the App Store. Naluvia does not collect payment card numbers. The server verifies the purchase with the store and keeps the references needed to restore it and check its validity. Stored verification data is encrypted.

Diagnostics and security

If an error occurs, the app may send the platform, its version, a message, a technical trace, and limited context. Secrets and email addresses are masked, including codes, tokens, and identifiers from Apple sign-in attempts. Repeated errors are grouped and kept for 30 days. Network address fingerprints, rather than the addresses themselves in the application database, help limit abuse. The web server also keeps technical access logs without URL parameters.

Deletion and contact

You can delete your account in Naluvia’s settings. See the steps for deleting your account and data, or ask support to delete them without using the app. This removes your soundscapes, sessions, and subscription data held by the service. It does not automatically cancel a store subscription, which remains managed through Google Play or the App Store.

If your account is linked to Apple, deletion of your Naluvia data is followed by a request to Apple to revoke the authorisation. The server retries if this fails. For these attempts, only encrypted technical tokens and the information needed to revoke them are retained, for up to 30 days after deletion. Your Naluvia profile and account are not retained.

For a request about your data: naluvia@smartapps.ovh.

Third-party services

OVHcloud hosts the media and infrastructure. Google and Apple provide services for ads, consent, ratings, and purchases depending on the platform and enabled features. Apple is also involved if you choose Sign in with Apple. Their own notices explain how their services process data.