PRIVACY

Phasion Live is built by AV Club Visuals. We collect as little as possible and we don't sell anything about you.

What we store

• Your email address, so you can sign in and receive your license.
• A hashed machine fingerprint for each device you activate, so we can enforce the 2-seat limit.
• Your purchase record (subscription or perpetual) from Lemon Squeezy.
• A small event log (sign-ins, license checks, device revokes) for support and fraud prevention.

What we don't store

• We don't upload your audio, your butterchurn visuals, your AI prompts, or anything generated by the engine on your Mac.
• AI generation runs locally on your Mac via Draw Things. Nothing leaves your machine.
• We don't track your usage, fingerprint your browser, or run analytics inside the app.

Audience submissions during a show

Two delivery modes, two different retention pictures. Your pricing tier picks the architecture:

📡 Pro Local — photos never leave your Mac

• Audience phones connect to <your-slug>.phasion.live, which DNS-routes their traffic through Cloudflare's tunnel network directly to the operator's Mac — no Worker hop, no cloud storage of any kind.
• Photos, messages, polls, reactions all arrive at the operator's local disk. Cloudflare sees encrypted tunnel traffic, not the contents.
• If you delete a photo on the operator's app, it's gone. There's no backup copy anywhere — because there was never an elsewhere.
• The recap page is served by the operator's Mac via the same tunnel. When the operator quits the app, the recap page returns 503 until they relaunch.
• What we have access to: the slug ↔ license mapping, a daily activity heartbeat, and Cloudflare's request count. Nothing else.

☁️ Pro Cloud / Venue Cloud — cloud-backed event recap (48 hours; 30 days on Venue)

• The operator's Mac receives every approved submission locally. Photos and metadata are saved to the operator's disk on arrival; that copy is yours to keep indefinitely.
• Cloudflare R2 holds a copy so guests can re-download photos after the event. Audience submissions are written to R2 under the key prefix events/<your-slug>/. An automated sweep deletes them after the recap retention window — 48 hours on Pro Cloud, 30 days on Venue Cloud — and a Cloudflare bucket lifecycle rule guarantees nothing under that prefix ever persists beyond 30 days, enforced at the storage layer regardless of the sweep.
• The recap page served at phasion.live/recap/<your-slug> loads photos and event content from R2 for the same window (48 hours, or 30 days on Venue), then returns a "this event has ended" page. Guests use the recap window to download photos they appeared in; the promoter can share the URL on social media in the days following the event.
• Audience consent at upload. Each photo upload form includes a "OK to share in event recap" checkbox (defaulted on) and a brief footer attesting the uploader has permission to share. Audience members can also tap "Remove my photo" within the recap window to delete their own uploads early — the delete is enforced by a per-upload token stored only on the audience phone.
• Operator early-clear. Hitting "End the night" or rotating your slug immediately wipes the R2 copy. Tier-aware: Venue Cloud operators can export the full event archive as a ZIP before clearing.
• Opt-in lead capture. The recap page offers guests an optional field to leave their email ("email me these photos / follow this venue"). Strictly opt-in — leave it blank and nothing is collected. Submitted emails are stored only so the operator can re-share the recap and invite guests to future events; they are never sold or shared with third parties, and a guest can ask the operator to remove them at any time.
• Durable Object session state (current poll / word-cloud / branding snapshots for the audience UI) is held in memory for up to 30 minutes of idle time, then evicted. Operator authentication passphrases are evicted alongside it.
• Analytics summaries (counts only — never photo contents or guest identities) live under a separate R2 key prefix (summaries/) that's exempt from the recap retention rules. These aggregates are retained for the admin dashboard.
• Audience IP addresses are visible to Cloudflare for rate-limiting (transient — not retained by us) and are never displayed to the operator or stored in any of our databases.
• If your venue has stricter retention requirements, Pro Local mode (above) is the strictest option — built for venues that can't tolerate ANY cloud retention of audience content.

Who touches your data

• Supabase — authentication and license database (hosted in the US).
• Lemon Squeezy — payment processing and subscription management.
• Cloudflare — this website, the optional Cloudflare Tunnel that exposes your audience page during a show, and the audience-relay infrastructure (Workers + Durable Objects + R2) described above.
• Sentry — anonymous crash reports, opt-in and off by default (turn them on in the app's Privacy section). Reports never include audience submissions, passwords, or IP addresses.
• QR Server (goqr.me) — third-party API used in the Live Poll activity to render QR codes for the poll URL. The poll URL is sent to the API; the audience response data is never sent there.
• Apple ShazamKit — when the operator enables song identification, short audio fingerprints are sent to Apple's ShazamKit service to identify the currently playing track. Subject to Apple's privacy policy.

Your rights

Email hello@phasion.live to delete your account, export your data, or ask anything else.

Refunds

14-day no-questions refund on both subscription and perpetual. Just email us.

Changes

If this policy changes in a way that matters, we'll email active users before it takes effect.