Privacy Policy

1. About this Policy

This Privacy Policy explains what personal information Macrame, LLC ("Macrame," "we," "us," or "our"), a Delaware limited liability company, collects when you use Shadow Edge — including the website at shadowedge.app, the iOS, Android, macOS, and Windows applications, the ShadowStudio Desktop companion, and the GoShadowing-branded marketing surfaces at goshadowing.com (collectively, the "Service") — how we use it, who we share it with, and the rights you have over it.

This Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms. Macrame also operates WordEdge (wordedge.app), which has its own Privacy Policy; this Policy covers Shadow Edge only.

2. Information we collect

2.1 Account data

When you create an account, we collect the email address you sign up with, an account identifier we generate, and — if you sign in via Apple, Google, or another identity provider — the subject identifier and basic profile fields the provider returns. We do not store passwords for SSO accounts. For password-based accounts, we store a salted hash, never the password itself.

Shadow Edge and WordEdge share a single account system, the Lingovea account. If you already have an account from WordEdge, you can sign in to Shadow Edge with the same email and credentials instead of creating a new one, and vice versa. Only your account identity (email, account identifier, and sign-in method) is shared between the two products — your practice data described below stays private to Shadow Edge.

2.2 Practice data

When you use the Service to practice, we store the sources you import (URLs, file metadata, transcripts, segment timings), your edits to those transcripts, your recordings, your pronunciation scores, and your practice history. Recordings and scores are private to your account and are not used for any purpose other than providing the Service to you.

2.3 Platform cookies

If you choose to import content from a platform that requires authentication (for example, a private podcast feed), you may upload session cookies to Shadow Edge so we can fetch the source on your behalf. Platform cookies are stored encrypted at rest using XChaCha20-Poly1305 authenticated encryption with per-row nonces, and are decrypted in process memory only when fetching a source for you. Staff cannot read decrypted platform cookies; the underlying database row enforces owner-only access (Postgres row-level security), and there is no override path for support.

2.4 Device and usage telemetry

The applications send telemetry events (download complete, transcription complete, play session, practice score) tied to your account so we can operate the Service, debug failures, and bill metered usage. Telemetry includes app version and an opaque per-install device identifier; it does not include the audio of your recordings or the contents of your transcripts.

2.5 Payment information

If you upgrade to a paid plan, payment is processed by Stripe, Inc. Stripe collects and stores your card details directly; we receive only the customer ID, subscription state, and the last four digits / brand of the card for receipts and dunning. We never see or store full card numbers, CVVs, or bank account numbers.

2.6 Support correspondence

If you contact support@goshadowing.com or privacy@macrame.io, we keep the email and any attachments you send for as long as needed to resolve the issue and meet our recordkeeping obligations.

2.7 Cookies and similar technologies on our websites

The marketing website at goshadowing.com and the application at shadowedge.app use a small number of first-party cookies for sign-in sessions and for remembering your preferences. We do not use third-party advertising cookies.

3. How we use your information

We use the information described in §2 to:

• operate the Service (host your sources and transcripts, run pronunciation scoring, deliver playback);
• provide your account and customer support;
• bill you for paid plans and prevent fraud;
• send transactional email tied to your account (security alerts, billing receipts, deletion confirmations);
• measure aggregate usage of the Service so we can improve it; and
• comply with legal obligations.

We do not sell your personal information, we do not use your recordings or your transcripts to train third-party machine-learning models, and we do not show you behavioral advertising.

4. Legal bases for processing (EEA / UK)

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)) — to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, debug failures, prevent fraud, and improve the product. Where we rely on legitimate interests, we balance them against your privacy rights and you may object at any time.
• Consent (Art. 6(1)(a)) — for any use that requires it (for example, the opt-in curation consent described in Terms §7.4).
• Legal obligation (Art. 6(1)(c)) — when we must keep records or respond to lawful requests.

Where we process personal information on behalf of a school, employer, or other organization that has its own privacy notice, that organization is the controller and we are the processor; this Policy describes our practices as a processor in those cases.

5. Who we share information with

We share personal information only with the parties below and only for the purposes listed.

5.1 Sub-processors

We use a small number of third-party service providers ("sub-processors") to operate the Service. Each sub-processor is bound by a written data processing agreement and may use your information only on our instructions.

5.2 Other recipients

• Legal compliance. We may disclose information if required by law, court order, or other lawful request, or where necessary to protect the rights, property, or safety of Macrame, our users, or others. Where the law allows, we will notify you of the request before responding.
• Business transfers. If Macrame is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will notify you (and where required, seek your consent) before your information becomes subject to a different privacy policy.

We do not share personal information with advertisers, data brokers, or analytics platforms beyond the sub-processors listed in §5.1.

6. International transfers

Macrame is established in the United States. Our primary infrastructure is hosted in the European Union (Hetzner, Germany / Finland), with backups in the United States (Backblaze). When we transfer personal information from the EEA, UK, or Switzerland to the United States or another country that has not been recognized as providing an adequate level of protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented as needed by additional safeguards.

For users in mainland China, source media you import from China-region platforms is fetched from infrastructure positioned to honor regional routing constraints.

7. How long we keep information

We keep your information for as long as your account is active and for the periods below afterwards.

• Account record + practice data — kept while your account is active; deleted on request (see §8). Your account is considered active until you delete it, even if you stop using the Service.
• Encrypted backups — rotated on a 30-day cycle. Deleted data persists in backups until that cycle completes; we do not restore deleted data from backup except to recover from a disaster.
• Tombstones — when you delete data we keep a tombstone row recording that something was deleted (not its contents) for up to 30 days after sweep to make the deletion auditable and idempotent.
• Support feedback attachments — kept up to 90 days then deleted.
• Server logs — retained per our log lifecycle (typically 30 days for application logs, longer for security-relevant events).
• Billing records — kept for the period required by tax and accounting law (typically seven years in the United States).

When we delete data, we delete it from the primary database, from object storage, and from log indices using a per-user deletion query. The deletion job is idempotent and re-runnable; under normal load, deletion completes within minutes, and within hours if a sub-system is degraded.

8. Your rights

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

• Access — ask us what we have about you.
• Export — receive a machine-readable copy of your account data, your sources, your transcripts, your edits, and your scores.
• Correction — correct information that is inaccurate.
• Deletion — delete your account and the personal information tied to it.
• Object / Restrict — object to, or ask us to restrict, processing that relies on our legitimate interests (§4).
• Withdraw consent — withdraw consent for processing that relies on it (for example, curation consent under Terms §7.4).
• Lodge a complaint — with your local data-protection authority. EEA users may complain to their member-state authority; UK users may complain to the ICO.

How to exercise these rights. Most rights can be exercised directly from the Service:

• Settings → Account → Export your data produces a downloadable archive.
• Settings → Account → Delete account initiates deletion. Once you confirm, we enqueue a deletion job that removes your account record, your practice data, your sources, your recordings, your platform cookies, your support attachments, and your telemetry events. The job is idempotent; if any step fails, it is re-tried until complete.

For requests that cannot be served from the application, email privacy@macrame.io. We will respond within the period required by applicable law (one month under the GDPR, with a possible two-month extension for complex requests). We may need to verify your identity before acting; we will not ask for sensitive information beyond what is necessary to confirm you are the account holder.

8.1 California, Virginia, Colorado, Connecticut, Utah, and similar U.S. state rights

Residents of certain U.S. states have specific rights under their state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, and others as enacted). Those rights generally include access, deletion, correction, opt-out of "sale" or "sharing" for cross-context behavioral advertising, and the right not to be discriminated against for exercising your rights. We do not "sell" or "share" personal information for cross-context behavioral advertising as those terms are defined in those laws.

8.2 Automated decision-making

We do not use your personal information to make automated decisions that produce legal or similarly significant effects on you.

9. Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS 1.2+ for all client traffic), encryption at rest for sensitive fields (XChaCha20-Poly1305 for platform cookies; AES-256 disk encryption for object storage), least-privilege role-based access for staff, audit logging for staff actions, and isolation between users via Postgres row-level security. No security measure is perfect; if we become aware of a security incident affecting your information, we will notify you and the appropriate authorities as required by law.

10. Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information to us, please contact privacy@macrame.io and we will delete it. See Terms §2 for our minimum-age rules and the consent requirements that apply between 13 and the age of majority in your jurisdiction.

11. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you in-app, by email, or both, at least 30 days before the change takes effect. Continued use of the Service after the effective date means you accept the updated Policy. The "Last updated" date at the top of the page reflects the most recent revision.

12. Contact us

Questions about this Policy or about how we handle your information:

For copyright/DMCA notices, please use the dedicated agent at /legal/dmca instead.

Shadow Edge is a product of Macrame, LLC, a Delaware limited liability company. GoShadowing is a brand of Macrame, LLC.