Privacy Policy

Website edition: This policy applies to the website, the independently distributed Better Volume app and related purchase and licensing services.

2026-10-23

1. Who is responsible

Vast Lightyear (万维光年) operates Better Volume, its website and licensing service and is responsible for the personal information processed for these services. Privacy and support contact: [email protected]. This policy covers test and live environments. Waffo handles live website orders; test and production environments are isolated.

2. Audio and local settings

Audio is processed in real time in device memory; we do not save recordings or upload audio. App and device volume settings remain local. System audio recording permission supports volume control. Local diagnostics reach support only when you choose to share them. We do not use hardware serial numbers as licensing identifiers.

The Mac App Store build does not request Input Monitoring or Accessibility access. Optional AudioDriverKit approval enables keyboard volume control. Bluetooth access is requested only to manage paired audio devices; it does not scan nearby devices. Playback controls use local Apple Music or Spotify automation; Spotify artwork may be fetched from its image service. Profiles and diagnostics remain local unless shared as described below. Trial and activation records may remain in the Keychain after uninstalling; exported configuration files must be deleted separately.

3. Purchase, activation, device and email data

For website orders, the licensing service receives the purchase email, order and product identifiers, amount, currency, payment/refund status, and callback identifiers and times. We store encrypted email addresses and activation codes, license hashes, activation associations, signed access expiry and email delivery status. Resend sends website license emails.

When you explicitly claim a code in the App Store edition, the app sends the Apple-signed purchase transaction over HTTPS to license.vastlightyear.com. The server verifies status with Apple and stores the original transaction identifier, license plan, encrypted activation code and its hash. We do not request your Apple Account password, create a new order or send a purchase email for redemption. Production and sandbox transactions are isolated.

Claiming, activation and online verification process a product-scoped SHA-256-derived identifier based on the hardware UUID. The server stores this identifier and activation associations to permanently bind up to three computers, avoid double-counting the same machine and prevent license abuse. Raw hardware UUIDs and serial numbers are not uploaded. Claiming reserves a slot; direct-edition activation on the same machine does not reserve another. Legacy random installation IDs are linked to machine identifiers on verification after upgrading. Uninstalling or reinstalling does not release slots; no deactivation or transfers are offered.

Direct-edition activation sends the code, installation identifier and machine identifier over HTTPS. The app stores activation records and signed offline tickets in the local Keychain. If access is unavailable, the client reports an error rather than treating the record as missing and creating a new device identity. A separate Better Volume account is not required.

4. Purposes and legal bases

Purchase verification, code delivery, activation, device limits and support are needed to perform the service contract. Necessary security, fraud prevention, troubleshooting and license-abuse handling rely on legitimate interests where permitted by law. Legally required transaction records are retained to comply with legal obligations. Diagnostics you volunteer are used for the requested support. We seek separate consent where required and do not use purchase email for unsolicited marketing.

5. Service providers and sharing

Waffo Pancake handles payment and billing details for direct orders; full card numbers and security codes are handled within its payment system and are not stored on our servers. Resend receives the recipient email, activation code and message content to deliver license emails. Cloudflare provides DNS, website delivery, security and support-email forwarding. DigitalOcean hosts the website and licensing service. Support messages are handled through our current Microsoft Outlook mailbox. Apple handles App Store purchases. We provide only the data needed for the respective service. We do not sell personal information. Necessary information may be disclosed where legally required or to protect lawful rights.

6. Website storage, logs and tracking

The website stores language preferences in localStorage. The success page stores its claim credential in sessionStorage and removes it from the URL fragment. Claims expire after seven days. You may clear browser storage, but may need the original payment-return link to claim again. We do not use advertising trackers or embed tracking pixels in license emails. Website, hosting and security services may process IP addresses, request times and errors for delivery, security and troubleshooting.

Website analytics: We use Umami Cloud to measure pageviews, referring sites, page language and download, purchase and migration clicks. Umami processes connection information to derive approximate location and browser/device statistics. Data is processed in the United States and retained for six months. We exclude URL query strings and fragments, email addresses, activation codes and order identifiers. No advertising cookies, session recordings or cross-site identity linking are used. Do Not Track and Global Privacy Control are respected.

Campaign measurement: A fixed campaign label may be carried in website links and sent with analytics events and checkout requests. We do not store this label in cookies or browser storage, or collect advertising click IDs. Our payment server associates the label with the order to report aggregate checkout, verified payment and revoked-order counts. For labeled orders, verified payment status, amount, currency and campaign, plus refund status, are sent to Umami Cloud; order IDs, emails and licenses are excluded. This does not track App Store purchases or app installations.

From version 1.5.0, the production website edition automatically enables usage analytics and crash diagnostics, without a separate consent dialog or an in-app switch. Development, test and sandbox builds do not report to production. Earlier versions retain their existing controls. The App Store edition follows its separate consent policy. Website analytics and purchase processing described above are separate.

Umami Cloud and Google Firebase Analytics provide usage analytics, and Google Firebase Crashlytics provides crash diagnostics. Data may include fixed feature and purchase-action categories and results, random installation identifiers, app version, language, system and device-model information, crash stacks and fixed actions preceding a crash. Installation identifiers may link activity across days and are not fully anonymous. We do not include audio, entered content, application or user-assigned device names, licenses, payment details or raw hardware identifiers in custom usage-event fields. Providers may process connection information; data may be processed in the United States or other countries. This data is used to improve features and investigate crashes, not for advertising tracking.

When app analytics are enabled, service providers may infer an approximate region from network connection information such as an IP address. We do not request precise location access for analytics.

For access, deletion or objections to processing, contact [email protected]. Stopping use or uninstalling stops future reports from that installation but does not automatically delete data already sent. Random identifiers may limit our ability to locate records. We rely on legitimate interests for product improvement and stability where permitted by applicable law; this does not override rights or consent requirements under applicable law.

7. Retention

Necessary license and activation records are kept while the entitlement remains valid. Personal data no longer needed is cleared within 90 days after entitlement termination. Support emails are retained for at most 24 months after case closure; self-managed access and error logs for at most 30 days. Records necessary for legal obligations, unresolved refunds/disputes or security investigations may be kept longer with restricted purpose and access, then deleted or de-identified when that basis ends. Billing records retained by payment providers under law follow their policies. We implement these periods through periodic manual review and existing log rotation; this is not a claim that all deletion is automated.

8. Security and international processing

We use HTTPS, encrypted storage for email and activation codes, hash-based matching, least-privilege configuration and restricted credential files. No system guarantees absolute security. Our server is in the United States and providers may process data in other countries. Where applicable law requires it, we will use applicable transfer safeguards. We investigate and mitigate security incidents and notify authorities and affected users within the timeframes required by applicable law.

9. Your rights and requests

Subject to applicable law, you may request access, a copy, correction, deletion, restriction, portability, object to processing or withdraw consent, and complain to your local data-protection authority. Contact [email protected]; we normally respond within 30 days and explain any legally permitted extension. We may verify identity but will not ask for full card numbers or passwords. Necessary license records may be required to continue activation; we will explain any effect of deletion on future verification beforehand. Uninstalling the app does not automatically remove Keychain records.

10. Minors, notices and changes

Direct purchases are intended for adults aged 18 or older; we do not knowingly collect direct-purchase personal information from minors under 18. Contact [email protected] if you believe we received such information. License, order, security and policy messages are service notices, not marketing. We normally announce material policy changes here at least 14 days in advance and, where applicable, by purchase email; urgent security or legal requirements may take effect sooner. The update date appears on this page.

Provider policies / 服务商政策：Waffo Pancake · Resend · Cloudflare · DigitalOcean · Microsoft · Apple。 · Umami · Google Firebase