PRIVACY
Your bedroom should stay private.
There are two separate privacy questions: what happens to information you choose to send through this website, and how the future HUMUV app is intended to handle microphone signals. This notice describes the website, which is the only part that exists today.
Who is responsible
HUMUV LLC, a Texas limited liability company in the United States, operates this website and is responsible for information submitted through it. Privacy and data requests go to privacy@humuv.com. General questions go to support@humuv.com. Both are monitored mailboxes.
What this website loads and stores
Browsing these pages does not request microphone access. Two different things are worth separating here. In your browser, every file the page loads — markup, styles, scripts, images and typefaces — comes from this website’s own address, and we have added no analytics, advertising, session-recording, social-media or A/B-testing code, so nothing on the page asks your browser to contact another company or to follow you elsewhere. The published pages set no cookies of their own and keep nothing in your browser’s storage. Behind the site, the infrastructure is not ours: this website runs on Vercel and its data is stored by Neon, so your request does reach Vercel’s servers and appears in the standard request and security logs Vercel keeps for us. We check the browser-side claim by inspecting the requests the live site actually makes. Internal preview builds, which are restricted to signed-in members of our team and excluded from search engines, load our host’s developer toolbar; the public site does not.
What the early-access form collects
When early-access collection is open, the form asks for your first name, your email address, whether you use iPhone or Android, whether you are interested in beta testing, and your agreement to receive early-access updates. Your signup record holds those answers together with the date, the identifier of the notice version you agreed to (early-access-v1), and a marker that the record came from this website. Two other things exist alongside that record and are described below: the abuse-prevention counter, and the request logs our host keeps. The form does not ask for recordings, audio, or health information, and you should not send them through it.
Keeping automated submissions out
To limit abuse we count recent attempts against a pseudonymous identifier: a keyed fingerprint (HMAC-SHA-256) of the network address our host reports for your request (grouping IPv6 addresses by their /64 network), stored with the time that counting window opened. We do not write the address itself into our database, and the fingerprint cannot simply be read back as an address — but it is pseudonymous rather than anonymous. While our secret key remains unchanged, the same address or IPv6 network produces the same fingerprint, and anyone holding our secret key could test a particular address to see whether it matches. Treat it as information about you that is harder to read, not as information that has stopped being about you. The form also contains a hidden field that real people leave empty. Vercel, as our host, separately keeps standard request and security logs, and those contain network addresses in the ordinary way.
Where it is stored and who processes it
Signup records are held in a Neon Postgres database provisioned in Washington, D.C., United States, kept separate from the database used for internal testing. Vercel hosts and serves the website. Those two providers process the information on our behalf and under their own agreements; HUMUV LLC does not sell early-access information, share it for advertising, or use it to profile you.
How long we keep it
Early-access records are kept for up to 24 months from the day you submit them. A cleanup job runs once a day, and a record is deleted on the first run after it passes that point, so it can survive up to a day beyond the 24-month mark rather than disappearing on the exact anniversary. The same daily run removes abuse-prevention counters more than 24 hours old, on the same next-run basis. If you ask us to delete your record we do it by hand, without waiting for the job.
Your choices
Write to privacy@humuv.com to ask what we hold about you, to correct it, or to have it deleted; we reply within 30 days. Deleting a record removes it from the live database, and we keep no second copy, archive or suppression list of our own. We cannot honestly call that erasure everywhere at once. Vercel keeps runtime request logs for 30 days on our current plan, and those logs contain network addresses rather than form contents. Neon also keeps a short automatic restore history for the database itself, and we have not yet confirmed the exact window for our account; we will publish it here once we have, rather than quote a figure we have not checked. No marketing email is being sent at this stage and the form generates no confirmation email. If we do begin sending early-access updates, every message will carry a one-click way to stop them, and stopping them will not depend on us reading your reply.
The intended app architecture
The design direction for the app is a short transient audio buffer, feature extraction, and disposal of raw audio, retaining derived measurements instead. On-device analysis where practical and no raw overnight recordings by default are goals, not verified shipping behaviour. The HUMUV app will publish its own disclosures, written against what it actually does, before it is released. Nothing here should be read as a description of shipping app behaviour.
Changes to this notice
Last updated 17 September 2026. If the early-access form starts collecting different information, or a new processor is introduced, this page and the consent identifier are updated before the change takes effect.
Certain HUMUV technologies are patent pending.