Privacy Policy

1. Who We Are

nFluential ("AffirmTune," "we," "us," or "our") is operated by Daniel Swick, an individual doing business as nFluential. Our website is located at https://nfluenti.al. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials through our authentication provider (Clerk). If you sign in via Apple or Google, we receive basic profile information from those providers.

2.2 Platform Connection Data

When you connect a music streaming platform (e.g., Apple Music), we store encrypted OAuth access tokens and refresh tokens to interact with that platform on your behalf. Tokens are encrypted at rest using AES-256-GCM. We also store your platform user ID and username.

2.3 Music and Playback Data

We collect the following data related to your music playback:

• Injection event logs: Which affirmations were played, when, on which platform, and after which track. This data powers your analytics dashboard.
• Playback session data: Session start/end times, total songs tracked, total affirmations injected, and active session state.
• Injection trigger track identifiers: We store the platform catalog ID of the track that triggered each affirmation injection. These are opaque numeric identifiers (e.g., an Apple Music catalog ID) — we do not store song titles, artists, or genres. Only the triggering track per injection event is recorded; we do not build or store a log of all tracks you listened to.
• Playlist data: When you create interleaved playlists, we store the source and generated playlist IDs, track counts, and sync state.

2.4 Affirmation Preferences

We store your affirmation preferences including enabled categories, injection frequency, volume level, and preferred voice.

2.5 Custom Affirmation Content

If you create custom affirmations (available on paid tiers), we store the text label you enter and the audio recording you upload. Your recordings are kept in private storage and play only in your own account, through links that expire after 12 hours. We do not share them, we do not send them to our text-to-speech provider, and we do not use them to train AI.

2.6 Payment Information

Subscription payments are collected and processed by Stripe, Inc., our payment processor, on Stripe's hosted checkout page. Stripe receives your card details, billing name, email address, and transaction details; we do not receive or store your card number. We receive confirmation of payment and your subscription status, and we keep Stripe's identifiers for your customer record and your subscription.

2.7 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, and interactions with the Service.
• Device information: Browser type, operating system, IP address, and device identifiers.
• Error reports: If the website or our servers hit an error, we record it with technical details (the error trace, page address, browser and operating system) and your internal user ID so we can fix it. These reports do not include your email address, IP address or anything you typed. See Section 4 (Sentry).
• Behavioral analytics (discontinued): Until July 28, 2026, we used Microsoft Clarity to collect session recordings and heatmaps (clicks, scrolls, page navigation). We removed Clarity on July 28, 2026 and no longer collect session recordings or heatmaps. Recordings collected before that date are retained by Microsoft under its own retention schedule and age out automatically. To ask whether data about you was collected during that period, or to request its deletion, contact us at the address in Section 13. See Section 8 for details.
• Acquisition attribution: On your first visit we set a first-party cookie (nf_attribution, kept for 90 days) that records how you arrived: UTM campaign parameters, the referring website, and the page you landed on. If you create an account, we save these to your account. If you subscribe, we pass the campaign source, medium and name, the referrer and the landing page to Stripe as metadata on your checkout.
• Funnel analytics (Umami): We run our own instance of Umami, a cookie-less analytics tool, to count page views and key steps such as signing up, starting checkout and connecting a music platform. It does not use cookies, the data stays on our own servers, and no third party receives it.
• Cookies: See Section 8 (Cookies and Tracking).

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service (injecting affirmations, generating playlists)
• Authenticate you and manage your account
• Process subscription payments via Stripe
• Send transactional emails (welcome, account updates, billing confirmations, payment warnings)
• Provide usage analytics and personalized affirmation recommendations
• Improve, troubleshoot, and optimize the Service
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal information to third parties.

4. Third-Party Services

We use the following third-party services that may process your data:

• Clerk — Authentication and user management
• Apple Music (MusicKit) — Music streaming platform integration (playlist access, playback state)
• Stripe, Inc. — Subscription payments (hosted checkout and billing portal). Stripe receives your card details, billing name, email address, and transaction details; its privacy policy is at https://stripe.com/privacy.
• ElevenLabs — Text-to-speech generation of our built-in affirmation library (no information about you is sent to ElevenLabs)
• Cloudflare — DNS, CDN, and audio file storage (R2 object storage for affirmation MP3s)
• Hetzner — Server hosting for our database (PostgreSQL), Redis and background job worker
• Vercel — Application hosting (serverless functions, edge network)
• Sentry (Functional Software, Inc.) — Error monitoring and performance measurement for our website and servers. When something goes wrong, Sentry receives the error and its technical trace, the page address (with any query string removed), your browser and operating system, and your account's internal user ID; for about one in ten page loads it also receives timing data. We configure Sentry not to receive your email address, IP address, cookies, anything you type, or authentication headers, and we test that configuration. Sentry stores this in the United States for 90 days. See Sentry's Privacy Policy.
• Resend — Transactional email delivery
• Google Analytics — Website traffic and usage analytics (anonymized page views, sessions, and events)
• Microsoft Clarity (discontinued July 28, 2026) — Behavioral analytics including session recordings, heatmaps and click tracking, used until July 28, 2026. Microsoft states that Clarity masks certain input fields and does not collect passwords or payment information; we did not independently verify the scope of that masking. See Microsoft's Privacy Statement.

Each provider processes data only as necessary to provide their respective services and in accordance with their own privacy policies. These providers are contractually obligated to use your information only as directed. We encourage you to review their policies.

We do not share your information for advertising purposes.

5. Data Sharing

We may share your information in the following circumstances:

• Service providers: As listed in Section 4, to operate the Service.
• Legal requirements: When required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.
• With your consent: When you explicitly authorize sharing.

6. Data Retention

We retain your data according to the following schedule:

Upon account deletion, we delete or anonymize your personal information within 90 days, except where retention is required by law or legitimate business purposes (e.g., tax records).

7. Data Security

We implement industry-standard security measures to protect your data:

• OAuth tokens are encrypted at rest using AES-256-GCM
• All data is transmitted over HTTPS/TLS
• Database connections use TLS encryption
• Webhook signatures are verified to prevent spoofing
• Access controls limit data access to authorized systems

No method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users within 30 days of discovery, as required by applicable law.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in to the Service (session cookies via Clerk)
• Remember your preferences
• Remember how you first arrived at nFluential (the nf_attribution cookie, 90 days; see Section 2.7)
• Analyze usage patterns to improve the Service (Google Analytics)
• Collected behavioral analytics including session recordings and heatmaps (Microsoft Clarity) — discontinued July 28, 2026

Microsoft Clarity (discontinued): Until July 28, 2026 we used Microsoft Clarity to understand how users interact with our website through session recordings and heatmaps. Clarity used first-party cookies to maintain session state. Microsoft processed this data under its own terms and for its own purposes in addition to providing analytics to us. We stopped using Clarity on July 28, 2026; it is not loaded on any page.

Our Umami funnel analytics do not use cookies.

We do not use third-party advertising cookies or tracking pixels for advertising purposes. You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Service.

9. Your Rights

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain legal exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by CCPA/CPRA. Affirmation category preferences (e.g., "health," "confidence") are explicit content selections you make in your settings — not inferences about your health or personal characteristics. Track identifiers in injection logs are opaque platform catalog IDs, not health data or listening history.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Global Privacy Control (GPC): We recognize and honor Global Privacy Control opt-out preference signals. If your browser or extension sends a GPC signal, we will treat it as a valid opt-out request.

To exercise your rights, contact us at [email protected]. We will verify your identity and respond within 45 days. You can also delete your account yourself at any time in Settings (Account → Delete account).

9.2 EU/EEA Residents (GDPR)

If you are located in the EU/EEA, you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

To exercise any of these rights, please contact us at [email protected].

9.3 All Users

Regardless of your location, you may:

• Access and update your account information through your account settings.
• Delete your account yourself in Settings (Account → Delete account), or by contacting us at [email protected]. Deleting in Settings removes your account, preferences, listening stats and uploaded recordings immediately; anything remaining (such as backups) is deleted within 90 days.
• Opt out of marketing emails by clicking the unsubscribe link in any marketing email.
• Disconnect streaming platforms through the Settings page at any time.
• Request a copy of your personal data by contacting us.

10. International Data Transfers

Your information may be transferred to and processed in the United States. If you are located outside the United States, your use of the Service constitutes consent to transfer your information to the United States, where data protection laws may differ from those in your jurisdiction.

11. Children's Privacy

Our Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from someone under 18, please contact us at [email protected] and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. For material changes, we will provide at least 30 days' notice via email or in-app notification. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

13. Contact Us

For privacy-related questions or to exercise your rights:

nFluential is operated by Daniel Swick, doing business as nFluential.
Mailing address: 3660 Briarcliff Road, Nashport, OH 43830
Email: [email protected]
Website: https://nfluenti.al