Eqavo Equalizer & Audio Editor privacy policy

This policy describes Eqavo (previously AuraSound, earlier AuraDSP) on Android and its account, subscription and support services. Google Play builds from 198 use local settings only. Legacy sections explain cloud preferences that may remain from earlier versions until deletion is requested. Updated 28 October 2026.

Data on your phone

Audio settings, presets, appearance, language, page order and floating-control preferences are stored locally. From build 198, the app does not upload or synchronize these settings between devices. Sign-in and access verification use online services separately from local audio settings. We do not upload audio files, recordings or contacts. Listening preferences are audio choices, not medical diagnoses.

Local file studio

Studio and Audio cleanup read files you select with the Android picker and process audio locally, including range selection, editing, preview, undo and noise reduction. Supported operations may use an on-device model. This path does not use the microphone or upload audio or processed results. Cleanup quality varies with content; the app does not verify rights to use a file.

Processing uses private temporary working files. Save project on device retains a local copy of the project, settings and supported undo history for later work; it does not upload a cloud copy. Unsaved changes may be lost when the process ends. Temporary files may remain until subsequent cleanup. Use Android Clear storage to remove all local app data, after exporting anything you need.

When exporting M4A or WAV, choose the name and destination in the Android picker. A destination can be local or a cloud-storage provider you select; that provider handles storage and transfer under its terms and your settings. Studio does not overwrite the imported original. Account or app-data deletion does not remove exported copies; delete them at their destination.

Track information and player controls

Connecting your music player is optional. Choosing to connect opens Android settings for notification access. This is a broad permission described by the system; Eqavo uses it to find media playback sessions and read the title, artist, album, artwork supplied by the player, playback state, progress and supported commands. The component does not inspect or store message notification content. Track information and artwork remain temporarily in memory for display only; they are not sent to Firebase or another server or included in backups. The app does not fetch cover artwork from external websites.

Play, pause, previous and next request the action from the current player only. Players may omit information or commands. You can revoke notification access in Android settings. Stopping monitoring or leaving the app clears the displayed track data and detaches the observer; this does not stop music playing in the other app.

Optional response to audio output

The app displays a waveform and spectrum derived from audio available on the device. Android Visualizer may require RECORD_AUDIO, which Android labels as microphone permission. This path observes audio output; it does not open the microphone or save a recording.

On Android 10 or later, you may select system playback analysis using AudioPlaybackCapture and MediaProjection after explicit Android consent. It receives only audio that Android and the source app permit. It does not create a screen capture, save audio or images, or upload them. Samples are processed temporarily in memory to generate the spectrum. A foreground notification provides Stop; you can also stop it in the app or revoke system consent. It stops when the app task is removed or the service ends. It does not bypass apps that prohibit capture.

You may decline optional analysis and use other tools according to account access. Availability depends on the device, player and content. A zero reading does not establish silence in the room or safe listening levels.

Account and credentials

An account is required for access to app tools and access verification. The app uses Google sign-in through Google Firebase Authentication. The service verifies your Google identity and provides your account identifier, email address, display name, session information, sign-in provider and email verification status. Google handles sign-in and account selection; the app does not ask for your Google password or read your inbox. The support website retains email and password authentication and password reset only to let legacy account holders recover access for account deletion.

The app interface and account deletion page do not store your password or session tokens in localStorage. The Android app retains a session refresh token and the account information needed to sign in, using encrypted local session storage protected by Android Keystore when available. If secure storage is unavailable, you may need to sign in again.

Legacy cloud-preferences data

This section applies only to earlier versions. Cloud saving and restoration of audio preferences were removed from Google Play builds starting with 198. Current builds do not send new audio settings.

A preferences backup you previously saved may remain in Cloud Firestore under your account ID, including audio settings, preset names, appearance, page order, shortcuts and save time. It does not contain audio files or your password. Updating the app alone does not delete legacy cloud data. To request deletion of only that backup, follow Data controls below. Account deletion also removes the associated backup.

App and device integrity checks

When you request an account, authentication, account-recovery or access-verification operation, Eqavo may request a Firebase App Check token using Google Play Integrity. Google processes technical information about the app, device, operating environment and app licensing to produce a verification result that helps prevent service abuse. The app receives a verification token and attaches it to trusted Firebase requests when available; it does not send this token to the JavaScript interface or other apps. Local sound tuning alone does not start this check.

Subscription verification, checkout and purchase restoration require a valid attestation token; legacy cloud-backup operations also required it. If verification is unavailable, the operation stops with user guidance; this build has no direct database fallback. Attaching a token to authentication and account-recovery requests remains optional with a limited wait, and it is not a condition of account deletion. Automatic background token refresh is disabled. See Firebase's data disclosure and Play Integrity data information.

Purposes and service providers

Account information is used for authentication, account management and secure access. Current audio preferences remain separate on each device. We use Google Firebase Authentication and Cloud Firestore for accounts and data, Google Play Billing for the official subscription interface, Cloud Functions for verification, access management and deletion, Pub/Sub and Cloud Scheduler for subscription and refund updates, and Firebase Hosting for these support pages.

Firebase also processes IP addresses and technical request and client information to operate and protect its services, including preventing abuse during registration and authentication. Visits to these support pages may be logged by Firebase Hosting. Eqavo does not use these addresses to infer your location or target advertising. The app does not access advertising identifiers or contacts for its account and backup features.

This build has no advertising, usage analytics or crash reporting tools added by Eqavo. We do not sell account or backup data or use it to create advertising profiles. Google processes data to provide these services and handles its service data under its terms. See Firebase privacy and security information.

Encryption and processing locations

Account, backup and support-page connections use HTTPS to encrypt data in transit. Encryption of the session on your phone is separate from legacy cloud-backup data stored in Firestore and is not end-to-end encrypted with a key held only by you. This policy does not describe the service as anonymous.

Google and its providers may process service data outside your country or database region. Choosing a Firestore region does not mean all authentication, integrity and support processing occurs in that same region. See Firebase processing-location information at the link above.

Subscriptions and link sharing

Subscriptions use Google Play, with weekly and monthly plans. Google's purchase window shows the price, currency, renewal period and offer available to your account before confirmation. If eligible for a free trial, Google Play displays its duration and terms before confirmation; creating an Eqavo account or sharing a link does not grant a local trial, start a charge or begin automatic renewal. Eqavo does not receive your card number or bank-account details from Google Play.

When you request paid access, buy a subscription or restore it, the app sends your Firebase account identifier, authentication and attestation information, Google Play purchase token (purchaseToken) and product identifier to our backend hosted by Google. A pseudonymous hash derived from your account identifier is passed to Google Play to bind the purchase to your account; your Eqavo account password is not passed into the purchase flow. Firestore retains the purchase token needed for re-verification and its account binding. Payment-card details are not sent to the Eqavo backend.

The backend checks Google Play directly and records the subscription state, plan, offer, test-purchase or free-trial status, acknowledgement and renewal state, and available start, expiry, verification, cancellation and resumption times. It retains one-way hashes of order identifiers and linked tokens. Change notifications arrive through Google Pub/Sub, and scheduled jobs review status and voided or refunded purchases. We use Google's results to update access and prevent receipts from being bound to multiple accounts or reused after revocation; we do not read your full Google account purchase history or audio files for these purposes.

Temporary records prevent duplicate requests and conflicting operations, with request times and notification-completion states. Subscription data and purchase tokens are not included in preferences backup or exported audio. Link sharing opens a chooser where you select an app and recipient; Eqavo does not automatically send messages or upload contacts. Referral rewards are not enabled in this release.

Retention and deletion

Account data and legacy cloud backups remain until you request deletion. Current builds do not create new cloud-preferences backups. To request deletion of only a legacy backup, follow Data controls below. You can delete the account and backup in the app or on the account deletion page. Google sign-in verifies current accounts; the website also supports password verification for legacy accounts. The backend requires a recent sign-in for deletion. Website deletion does not require the app or a Play Integrity token. If the sign-in account is deleted while server cleanup is still finishing, the page reports that pending state rather than confirming complete backup deletion.

Purchase tokens and verification records support subscription updates, restoration and fraud prevention. The current system has no single automatic deletion period for all purchase records. Account deletion removes the Firebase identity, preferences backup and linked UID records, and replaces purchase records tracked for that account with pseudonymous deletion markers that remove the UID, plain purchase token and subscription-detail history. One-way ownership, account, token and order hashes, refund proofs and observation or deletion times remain to prevent reuse; these markers contain neither the email nor the plain purchase token and are not described as anonymous. The current code does not set an automatic deletion date for these proofs.

Notification-deduplication records expire 30 days after processing. Rate-limit and request-lock records carry shorter expiry times according to the operation and are deleted through Firestore policies; actual deletion can follow the expiry time later. These records are separate from purchase-ownership proofs. Providers may retain operational logs or backups under their schedules; successful account deletion does not mean immediate erasure from every infrastructure system. See Firebase retention details.

Website account deletion leaves local settings, working audio and exported results unchanged. Clear the project or app data for local files, and delete exported results at their destination. Account deletion also does not cancel Google Play renewal; manage any existing subscription separately through Google.

To protect the database against deletion or corruption, we use Firestore point-in-time recovery with a window of up to seven days and a daily backup schedule with seven-day retention. Data deleted from the active database may remain in recovery history or an earlier backup until its retention period ends. These copies are not used for sign-in or marketing; access is administrative and limited to recovery. Before restored data is returned to service, deletion requests and current subscription states must be reviewed to avoid reactivating a deleted account or an old entitlement. This protection is separate from legacy cloud preferences and does not upload current phone settings.

Your choices

You can change language and read help and privacy information before subscribing. Account management, deletion and purchase restoration do not require an active subscription; app tools require Google sign-in and a verified entitlement in the commercial release. Your session and subscription status are restored automatically when available; current builds do not synchronize audio preferences. Deleting the app or an Eqavo account does not automatically cancel an existing Google Play subscription. Use Google Play subscription management if needed.

Store review access

A designated store-review account can receive full access without a purchase, trial or automatic renewal. The server stores a grant bound to a hash of that account identifier and verifies the account and app before returning access. This grants no administrative permissions or access to other users or their data. The reviewer password is not embedded in the app.