Privacy policy

Last updated: 26 October 2026. RECURSOR is based in India and is responsible for the personal data described here. Write to hello@recursoraudios.com about this policy or your data. This policy covers recursoraudios.com, SIGNAL accounts and community features, audio, waitlists, custom applications, orders and TRIBUTE.

What we collect and why

When you join a waitlist, we collect your email address, the source of your request, the consent wording version and time, confirmation and subscription status, and a keyed hash of your IP address. We use these to send a confirmation email, record your choice, send RECURSOR updates at most once a month, process one-click unsubscribes and limit abuse. The list uses double opt-in. You are added only after using the confirmation link. Each list email has an unsubscribe link.

When you apply for a custom build, we store the email address you give, your answers to the brief, the tier you request, whether you asked for rush, and the time of your request. We email you a receipt and send the application to RECURSOR’s inbox so we can reply.

When you give a TRIBUTE, we record the PayPal order and capture identifiers, amount, currency, payment status, time, a keyed hash of your IP address and, if PayPal supplies it, your email address for the receipt. PayPal handles checkout and payment details. RECURSOR does not receive or store your card number or other payment instrument credentials. We use the record to confirm payment, avoid duplicate receipts, answer payment questions, prevent abuse and meet applicable record-keeping duties.

When you join membership, PayPal holds the subscription and payment details. We keep the subscription status, plan, and the PayPal subscription identifier so we can give you access and answer billing questions.

Your SIGNAL account includes your email and authentication records, member identifier, display name, optional handle, bio and avatar, account dates and access status. We also store the onboarding choices and questionnaire answers you submit. These let us run your account, personalise your starting point and provide the features you choose.

Community records include messages, replies, reactions, read positions and notice reads. Your profile and messages are visible to the members who can access the relevant space. Direct-line messages are available to you and RECURSOR. RECURSOR can review content to answer requests, moderate the community and investigate abuse. Do not put another person’s private information into a message or brief without authority.

Audio records can include the track, time a play starts or completes, playback position, completed-listen count, observations and saved progress. Where you use the personal practice feature, we store your chosen starting pattern and the days you check in. These records show your progress and support access rules. A missed day does not erase your long-term record. You choose whether to submit an observation or reflection. Avoid including health, sexual or other sensitive details that are not needed for your request.

If you enable browser notifications, we store the push endpoint and encryption keys for that browser with your member identifier. We use them to deliver notices to the audience you belong to through browser push services. You can turn notifications off in SIGNAL or your browser settings. Each browser has its own subscription. If you request a founding-offer reminder, we keep the email, request and send status for that reminder. An optional cancellation reason helps us understand why members leave.

For membership, accepted custom applications and works bought through SIGNAL, we keep the relevant order or subscription reference, amount, currency, status, payment dates and access record. Custom orders may also include the payer email supplied by PayPal. Staff actions can create an audit record with the actor, time, affected record and relevant changes. We use these records for fulfilment, support, security and transaction accountability.

Some paid CODEX audio is sold through Payhip, which handles its checkout and digital file delivery. Works sold inside SIGNAL use PayPal checkout and are linked to your SIGNAL account for delivery. The item page identifies its purchase route. If you contact us about any order, we receive the details you choose to send so we can help.

When you email us, we receive your address and the contents of your message so we can reply. Our hosting provider may process technical request logs, including IP addresses and device or browser information, to deliver and protect the site. We do not use an advertising tracker in the site code.

When enabled, Plausible measures offer views, plan clicks and other flow events. Events contain the site domain, page path and limited metadata such as the selected plan, gate or cancellation reason. Our event code does not attach your name, email or member identifier. The analytics service also receives the technical information needed to process the request. We use this information to understand and improve the flow.

Legal grounds and your choice

Where EU or UK data protection law applies, consent supports optional marketing and notifications. You can withdraw it without affecting processing that was lawful before withdrawal. Account, order, membership and requested custom-service processing is used to take steps at your request and perform the relevant contract. Applicable legal duties support required transaction and accounting records. Our legitimate interests support proportionate security, fraud prevention, support, community moderation and service improvement, subject to your rights and interests. We do not use these grounds as permission to collect unnecessary sensitive information.

You can browse without an account or payment. Account and payment information is required for features that depend on identity, delivery or entitlement. Optional profile details, questionnaire responses, observations and marketing choices are your choice. Declining marketing does not cancel your account or stop essential security, billing or service messages.

Services that handle data

Supabase provides account authentication and stores application records, including profiles, community content, audio activity, progress and orders. Cloudflare R2 stores private audio and avatars. Access to stored files uses time-limited URLs after the relevant checks. Resend sends authentication, confirmation, welcome, receipt and application emails. Upstash Redis holds expiring rate-limit counters. Cloudflare Turnstile checks forms for abuse. Vercel hosts the site. Plausible processes analytics when enabled. Browser push providers deliver opted-in notifications.

PayPal handles checkout for TRIBUTE, membership, accepted custom orders and SIGNAL works. Payhip handles orders made through its store. Payment services may collect contact, device and payment information under their own policies. RECURSOR does not receive or store full card numbers or payment instrument credentials. Providers can act as service providers for some processing and independently for their own legal, security or payment duties.

We may disclose information where needed to comply with a legal duty, protect rights or investigate fraud, or to advisers bound by appropriate duties. A business transfer may require relevant records to be transferred, subject to applicable privacy law. We do not offer member data for advertising or operate cross-site advertising profiles in the site code.

International processing

RECURSOR operates from India. Providers may process information in other countries, whose laws can differ from those where you live. Where EU, UK or other applicable law requires safeguards for a transfer, the relevant transfer must have an appropriate legal mechanism. Contact us for information about the recipients, locations and safeguards relevant to your data, including how to request a copy where available. A provider’s privacy policy does not replace your rights against RECURSOR.

Cookies and similar storage

SIGNAL uses essential session cookies called signal_access and signal_refresh to keep you signed in. The access cookie follows the access-token lifetime; the refresh cookie can last up to 30 days. Signing out clears these session cookies in that browser. RECURSOR does not set an analytics or advertising cookie in its own code. Turnstile and payment services may use cookies or similar storage for security and checkout. Restricting essential storage can stop sign-in, the security challenge or payment from working.

Retention and security

Waitlist records currently have no automatic deletion date. Unsubscribing stops list emails and records that choice. Custom application records are kept while we work on the request and for the period needed to answer questions about it. Payment records are retained for transaction support and applicable legal or accounting obligations. Rate-limit counters expire after their configured windows. We restrict database access to server-side services, store a hash rather than the raw confirmation token and hash IP addresses before saving them in application tables. No internet service can guarantee absolute security.

Account, community and progress records remain available while needed to run the account and relevant features. Cancelling paid membership stops renewal; it does not delete your free account or content. Ask us separately to review deletion. Some audit, transaction, security or legal-claim records may need to remain, and backup copies may remain until their normal replacement. We consider the purpose, account status, applicable obligations and dispute needs when deciding what to retain. We do not promise that hiding a message or cancelling a service immediately erases every copy.

Your rights

Email hello@recursoraudios.com to ask what personal data we hold, request correction or deletion, withdraw consent, or raise a concern. If EU or UK law applies, you may also request restriction or portability, object to certain processing and complain to your local data protection authority. Some records may need to be kept where law requires it. We may need to verify your identity before acting on a request.

Australian users can ask for access or correction and raise a privacy complaint with us. Where the Privacy Act applies, the Australian Information Commissioner may also receive complaints. For US residents, applicable state law may provide access, correction, deletion, portability, appeal and rights concerning sale, sharing, targeted advertising or sensitive data. Rights and exemptions depend on the law and its scope. An authorised agent can contact us with evidence of authority. We will explain a refusal and any applicable appeal route. We do not require paid membership to make a privacy request or penalise you for exercising a protected right.

Children and changes

The site, membership, custom builds and TRIBUTE are intended for adults aged 18 or older. We do not knowingly seek data from children. If you believe a child supplied data, contact us. We may update this policy when practices change. The effective date above will change when we publish a revision.