Privacy
Hum has no analytics, no ads and no third-party scripts. It doesn’t sell your data. The people who run Hum can read your email and your listening history, so here’s exactly what’s stored.
This is a draft. It hasn’t had legal review, and the marked gaps still need filling in.
If you only visit this site
This site sets no cookies and runs no tracking. The sample and the setup run in your browser. Answers you give in setup stay on your device until you create an account. Your request for each page still reaches our host, Vercel, which runs its own platform logs under its own terms.
What’s stored if you create an account
When you sign up, what’s in your browser is copied up: your settings, favourites, survey answers and earlier listening.
- Used to sign in. Hum may email you a link to confirm the address is yours, and a notice if someone tries to sign up with it. It sends no newsletters or marketing.Kept until you delete your account.
- Password
- Stored only as a scrypt hash, so nobody can read it.Kept until you change it or delete your account.
- Recovery code
- Stored only as a keyed hash. You see the code once.Kept until it’s used or replaced, or you delete your account.
- Settings and favourites
- Your sound settings, saved favourites and loved tracks, stored as they are.Kept until you delete your account.
- Listening sessions
- The day, start time and length, the state, activity, style and settings you used, and any rating you gave. Stored as they are.Kept until you delete your account.
- Survey answers
- Encrypted at rest with AES-256-GCM. The key comes from a secret on the server, so this protects against a leak of the database alone. Someone with both the database and that secret could read them. Answers saved before this encryption existed are encrypted the next time their owner opens Hum.Kept until you delete your account.
- Plan and payment records
- If you subscribe: your plan, its status and renewal date, and the ids Stripe uses for you and your subscription. Hum never receives your card details.Kept until you delete your account. Stripe keeps its own records: [Payment record retention].
- Promo codes
- If you use a code: which code, and when. Codes themselves are stored only as a keyed hash.Kept until you delete your account.
- Session records
- Your IP address and browser user agent as they were when you signed in, so you stay signed in.A session ends after 60 days unused, and renews about daily while you use it. Signing out removes it. An expired record that’s never used again can stay until you delete your account.
- Rate-limit records
- Used to slow down password guessing. Hum’s own counters hold only SHA-256 hashes of their keys. The sign-in library’s rate limiter stores your IP address and the path you requested in plain text.The sign-in library’s records are deleted some time after their window passes. Hum’s counters aren’t tied to your account.
What’s stored on your device
- Local storage
- Your settings, favourites, loved tracks, listening stats and history, survey answers, and a sync record with your email. These are not encrypted on your device.Signing out clears them. Without an account they stay until you clear your browser’s data.
- Cached app files
- A service worker keeps the app’s own files so it loads quickly.Stays until your browser clears it.
Cookies
- Session cookie
- Keeps you signed in. Set when you sign in, not when you visit this site.Up to 60 days, renewed while in use.
- Music-access cookie
- Lets your browser fetch library tracks. It’s HttpOnly, sent only for /music and carries nothing that identifies you.24 hours.
We don’t use advertising or analytics cookies, so there’s no cookie banner.
Who can see your data
The people who run Hum. Anyone with access to the database can read your email, settings and listening history. Survey answers need the server secret as well. We only look when we need to run or fix the service.
Service providers. Vercel hosts the site and runs the server code. Neon hosts the database. Both process data on our behalf, in [Hosting region].
Payments. If you subscribe, Stripe takes the payment on its own page and receives your email and card details directly, under its own privacy policy. [Stripe's role and data transfer wording]
Email. If Hum emails you, Resend delivers it and receives your address and the message. [Resend's region and data transfer wording]
Nobody else. We don’t sell your data or share it for advertising. We’d only disclose it if the law required it.
Deleting your data and your rights
Delete your account in the app’s account settings, with your password. That removes your account, sessions, settings, survey answers and listening history from the database straight away, and clears this browser. It also cancels any subscription at once. Neon’s restore history may hold a copy for [Backup retention period].
To ask for a copy of your data, a correction, or anything else this page doesn’t cover, write to contact@humfocus.com. Depending on where you live, you may have further rights under [Governing law], including the right to complain to a regulator.
Hum isn’t meant for anyone under [Minimum age].
If this page changes in a way that matters, we’ll say so here and change the date at the top.