Privacy & Security
Privacy Overview
WaveDrive is designed with a minimal data footprint. Only the data needed to sync your files is ever transmitted — no analytics, no telemetry, and no access to any file content beyond what you explicitly configure.
What's Stored Locally
-
Sync folder configurations — Folder name, type, mode, and extension list. Stored in SwiftData on-device.
-
Security-scoped bookmarks — macOS bookmarks that allow WaveDrive to access your chosen folders without re-prompting. Stored in the macOS Keychain.
-
Bearer token — Your WavePlan authentication token. Stored in the macOS Keychain, never written to disk in plain text.
-
Activity log — A rolling history of sync events, kept in memory and mirrored to the macOS system log. It is never uploaded to WavePlan.
-
App preferences — Launch at Login, notification settings, DAW configuration. Stored in UserDefaults, not synced to any server.
What's Transmitted
-
File content — Only files in your configured sync folders, only with matching extensions. Transmitted over HTTPS to WavePlan.
-
File metadata — Name, size, checksum, and the file’s path relative to its sync folder. WavePlan needs the relative path to restore your folder structure on any device.
-
Device identity — A device name and type (
wavedrive) used to identify this installation in WavePlan's Device Linking system.
What's Never Transmitted
WaveDrive does not collect analytics, crash telemetry, or usage statistics. Your application profiles, anything outside your configured sync folders, and the local activity log are never sent to WavePlan or any third party.
Privacy & Security
Keychain Storage
WaveDrive stores all sensitive credentials and folder access permissions in the macOS Keychain — the same secure, encrypted credential store used by Safari and iCloud.
Credentials and folder-access bookmarks live only in the Keychain — never in UserDefaults or in plain text on disk.
What's Stored in the Keychain
WaveDrive keeps a single consolidated Keychain entry — the vault — holding everything sensitive in one encrypted item. Consolidating means macOS prompts for Keychain access once per build, not once per secret.
Bearer Token
Your WavePlan authentication token, issued during Device Link. Used to authenticate all API requests and refreshed automatically as it approaches expiry.
Security-Scoped Bookmarks
One bookmark per sync folder. Bookmarks grant WaveDrive persistent access to your chosen directories without re-prompting for permission across restarts.
Keychain Access
WaveDrive's Keychain items are stored with kSecAttrAccessibleAfterFirstUnlock access, meaning they are available after your Mac has been unlocked once after a restart. This allows WaveDrive to sync at login without requiring your Keychain password.
You can inspect and remove WaveDrive’s Keychain entry at any time using the macOS Keychain Access app. Because the vault is a single entry, removing it clears the bearer token and every folder bookmark together — you’ll need to re-link your device and re-grant folder access.
Environment Isolation
WaveDrive's Keychain entries use a service identifier scoped to the build environment. The production app uses au.com.themixbus.WaveDrive and the LocalDev build uses au.com.themixbus.WaveDrive.dev, ensuring credentials are never shared between environments.
Privacy & Security
WaveDrive Device Link
WaveDrive Device Link is the authorisation that connects your WaveDrive installation to your WavePlan account. It grants WaveDrive the specific abilities it needs — no more, no less.
Device links are managed from your WavePlan account in the Device Linking section of Settings. You can revoke a WaveDrive link at any time without affecting other devices.
Granted Abilities
A WaveDrive device link requests the following abilities on your library:
library:read
Browse and download files from your WavePlan library. Required for Download Only and Bidirectional sync.
library:upload
Upload new files and updated versions to your WavePlan library. Required for all sync modes.
library:delete
Remove files from your WavePlan library. Only used if deletion propagation is enabled in a future WaveDrive version. Currently requested to future-proof the link.
Revoking Access
To unlink WaveDrive from your account, open WavePlan → Drive → settings cog → Device Linking and remove the WaveDrive entry. You can also unlink from within WaveDrive itself via Settings → General → Unlink App.
Unlinking clears WaveDrive's local sync folder configurations, DAW rules, and bookmarks — your account state comes from WavePlan, so unlinking effectively resets that state to "no account." Your files on disk are never touched. When you next link an account (the same one, or a different one), WaveDrive re-hydrates its sync folder list from WavePlan and you re-attach each folder to a directory of your choice.