nanodot Privacy Policy

Effective date: 2 October 2026
Last updated: 30 October 2026

This Privacy Policy ("Policy") explains how Marian Paraschiv, an individual doing business as nanodot ("nanodot," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you use the Dust app for iPhone and Apple TV, the website at https://nanodot.app (including the song shelf, Dust Live, Dust Storm, song pages, embeds, and the Spotify playlist page), Dust Live as an Activity inside Discord, our APIs, and related services (collectively, the "Services").

If you do not agree with this Policy, do not use the Services.

1. The short version

• There are no accounts. You never sign in, and we never ask for your name, email address, phone number, or payment details to use the Services. The one exception is Dust Live inside Discord, where Discord tells us your Discord user ID and display name so you can take part (Section 3.8).
• What you add is public. A song you add — its audio, the artist name you give it, the link and lyrics you include — goes on a public shelf that anyone can play, share, and embed. So do your comments and Dust Live chat lines. Don't add anything you don't want the world to see.
• Songs are analysed by AI providers. To make a song dance, we send its audio and lyrics to OpenAI and Google for transcription and analysis (Section 7).
• Your song key is your identity. When you add a song, you get a key (a phrase such as "BrightRiverFollowsSilverMoon"). The artist name on that song becomes your public handle for comments and chat, and the key is what lets you fix the song's words, remove it, and edit or delete what you wrote. We store only a one-way hash of it.
• The apps contain no analytics, advertising, or tracking SDKs. The website uses Mixpanel for anonymous product analytics, and OpenAI's ads measurement pixel to count what our own ads in ChatGPT bring (Section 5).
• We do not sell or share your personal information for advertising, and we do not track you across other companies' apps or websites.

2. Who we are and how to contact us

3. Information we collect, and the sources

3.1 Songs you add

Source: you. When you add a song from the app or the website, we collect:

• The audio file you choose, and its file name (used as the song's initial title). We convert it to AAC and keep both the converted audio and the file it was made from.
• The artist name you enter. This is shown publicly with the song, and it becomes your public handle in comments and Dust Live.
• An optional link (for example, the artist's page), shown publicly with the song.
• Optional lyrics, and any corrections you make to them later.

From these, our systems and AI providers produce derived data: a time-stamped transcript of the words heard in the song, a cleaned-up title, a musical "reading" (tempo, beats, and other measurements of the sound), notes describing the song's themes and mood, illustrations and shapes for its visuals, and a preview image for links to it.

Please do not add audio that contains private conversations, personal details, or other content you would not want made public.

3.2 Your song key

When a song is added, we generate a random key and give it to you once. We store only a SHA-256 hash of the key, never the key itself. The app keeps your keys on your device (in the app's local storage), and the website keeps them in your browser's localStorage. Anyone who holds a key can act as the person who added that song, so keep it private.

3.3 Your email and notifications (optional)

Source: you. If you hold a song key you may choose to give us:

• An email address, when you add a song or later from the song's own sheet. We send one email with a link to confirm it; until the link is opened the address is linked to nothing, and you can change it. Once confirmed, it is linked to that song and cannot be changed. We store the address, which songs it is confirmed for, and when. It is never shown publicly and never sent to Mixpanel.
• Whether you want updates about your songs by email, such as how many times they were played. This is off unless you tick it, and you can turn it off at any time from the song's sheet. Confirmation emails are sent whatever you choose here, because you asked for them.
• Browser notifications. If you turn on notifications for a song on the website, your browser gives us a push address at its own push service (run by Google, Mozilla, Apple, or Microsoft, depending on your browser) and the keys to encrypt messages for it. We store these with the hash of the song's key, and use them to tell you about new comments on the song and, once a day, its plays and reactions. You can turn them off at any time from the song's sheet or your browser's settings.

3.4 Comments, Dust Live chat, and reports

Source: you. If you hold a song key you can:

• Comment on songs. We store the text (up to 500 characters), the moment in the song it refers to (if any), when it was written or edited, and the hash of the key that wrote it. Comments are shown publicly under your artist name.
• Chat in Dust Live. We store each line (up to 300 characters), when it was said, and the hash of the key that said it. Lines are shown to everyone in the room under your artist name.
• Queue songs in Dust Live.
• Report someone in Dust Live chat. We store your handle, your key's hash, the name you reported, and the reason you gave.

When a report is made, we send the reported name's most recent chat lines (up to 60) and the reason for the report to OpenAI to help decide whether the reported key should be removed from Dust Live (see Section 10).

3.5 Information collected automatically

Source: your device and our service logs.

• API access logs. Each request to our API records the time, your IP address, your browser or app's user-agent string, the route and path requested, the response status, and timing. We do not log the contents of what you send.
• Dust Live connections. While you are in Dust Live we keep a connection record with a hash of your IP address (not the address itself), used only to limit how many connections can come from one address.
• Play counts. Starting a song adds one to that song's public play count. The count is not linked to you.
• Story votes (Apple TV). If you vote on a story, the app creates a random voter ID the first time and sends it with your vote, so one device's vote is counted once and can be changed. It is not your Apple ID or a device identifier, and a reinstall creates a new one.
• Website analytics. See Section 5.

3.6 Information that stays on your device

Some features work entirely on your device, and what they process is not sent to us:

• Song clips made for sharing on iPhone are rendered on the device and shared only where you choose (through the system share sheet).
• Videos recorded on the website are written to your computer and never uploaded.
• The Spotify playlist page plays a playlist in another browser tab and captures that tab's sound inside your browser to make the songs dance. The captured audio never leaves your browser. What we receive is the playlist's link, and for each song its title, artist, length, and the musical reading computed in your browser.
• Caches of songs and clips are kept in the app's own storage and cleared automatically over time.

3.7 What we do not collect

We do not collect your name, phone number, contacts, photos, precise location, microphone or camera input, health data, payment information, Apple ID, advertising identifier, or any device identifier, and we collect an email address only if you give one (Section 3.3). The apps do not record audio. Inside Discord we receive only what Section 3.8 lists.

3.8 Dust Live inside Discord

Source: Discord, with your permission. When you open Dust Live as an Activity in Discord, Discord asks you to let nanodot know who you are (the identify permission). If you agree:

• Your Discord user ID and display name (your Discord username where you have no display name), which Discord gives our servers. We ask Discord for nothing else: not your email address, your servers, your friends, or your messages.
• Which Activity session you are in. We ask Discord, with your permission and the Activity session's ID, whether you are really in that session, so that only its people can queue songs in its room.
• A session of ours, a signed record of your Discord user ID, display name, and room, which your Activity holds while it is open and which expires after 12 hours. Discord's own access token is used once, in your Activity, and never stored by us.
• A one-way hash of your Discord user ID, kept so the room's rules apply to you: how soon you may queue another song, and whether you have been muted or banned from Dust Live.
• Your display name on the songs you queue. A song you queue is shown in that Activity's room as queued by you. The room and its queue are deleted about a day after the room closes, and a Discord room closes 3 hours after the last time anybody opened it.
• Service logs that record when your display name joined an Activity's room, used to operate and debug Dust Live in Discord.

Inside Discord, Dust Live has no chat of its own (your Discord channel is the chat), so we receive and store no messages from you. Everything the Activity loads, including the songs, our API, and Mixpanel's anonymous analytics (Section 5), goes through Discord's own proxy, so Discord sees those requests under Discord's privacy policy. We do not send your Discord user ID or name to Mixpanel, OpenAI's ads pixel does not run inside Discord, and we do not use what Discord gives us to contact you, profile you, or for anything other than Dust Live in Discord. We never sell it, never share it with advertisers or data brokers, and never use it to train AI models.

4. How we use your information

We use personal information only to:

• Provide the Services — host, convert, analyse, and play the songs you add; generate their visuals; show comments and chat; run Dust Live; let your key fix, remove, or edit what you added.
• Moderate and keep the Services safe — review reports, remove content that breaks our Terms, and stop abuse such as spam, flooding, and attempts to run up our costs.
• Operate, secure, debug, and improve the Services, including understanding how the website is used (Section 5).
• Send you what you asked for — the email confirming your address, browser notifications you turned on, and, only if you agreed, emails about how your songs are doing.
• Respond to you when you contact us.
• Comply with law and enforce our Terms, and establish, exercise, or defend legal claims.

We do not use your information to target advertising, and we do not use it to build profiles of you. We do measure our own ads (Section 5).

5. Website analytics, cookies, and local storage

The Dust apps for iPhone and Apple TV contain no analytics.

The website at nanodot.app uses Mixpanel, Inc. to answer a few questions: how many people visit and listen, how many add songs, and how many visit Dust Live. Mixpanel stores a randomly generated anonymous ID in your browser's localStorage, and receives events such as:

• a page viewed (which page, and whether you arrived on a song's link);
• a song played or ended (the song's ID and title, how long it played, and playback quality);
• a song upload started, completed, or failed;
• joining or leaving Dust Live, and for how long;
• a video recorded (its size and format, not the video);
• comments opened or a comment written (never the text);
• a song shared, and how (for example, link copied or clip saved).

Mixpanel also receives your IP address and basic browser and device information, from which it derives an approximate location (city or region). We never send Mixpanel your song key, your comments, chat lines, lyrics, or anything else you type. Mixpanel automatic tracking (autocapture and automatic page views) is turned off.

Measuring our ads. We advertise nanodot in ChatGPT. To know which ads bring people who listen or add songs, the website (not the embedded player on other sites, and not the apps) runs OpenAI's ads measurement pixel. When you arrive from one of our ads, OpenAI adds a click reference to the address, and the pixel keeps it in a first-party cookie (__oppref) along with a random browser reference (__obref). The pixel tells OpenAI three things: that a page was viewed, that a song was listened to for 30 seconds (the song's ID and title), and that a song was added (the song's ID). With them OpenAI receives your IP address and browser information. We send no name, email, song key, or anything you type, and we mark every event as opted out of OpenAI's ad personalisation, so it is used to measure our ads, not to target you. We do not use retargeting or third-party advertising cookies.

The website also uses localStorage to remember your song keys, a few display preferences, and, for 30 days, the click reference of an ad you arrived from.

You can clear localStorage in your browser at any time (doing so also forgets your song keys, so copy them first). You can also block requests to Mixpanel or to OpenAI's pixel (bzr.openai.com) with a content blocker without affecting the rest of the site.

6. Public content

Songs, artist names, links, lyrics shown as part of a song's visuals, comments, and Dust Live chat lines are public. Anyone can see, play, link to, embed, and share them, including people who don't use the Services, and others may record or share what they see. Search engines may index public pages. Removing content from the Services (Section 11) removes it from nanodot, but we cannot recall copies others have already made.

7. Service providers and other disclosures

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under U.S. state privacy laws. We have not done so in the preceding 12 months.

7.1 Service providers

We disclose personal information to these service providers, which process it on our behalf and only for the purposes listed:

We use OpenAI and Google through their API services. As of this Policy's effective date, those providers' API terms state that they do not use API inputs or outputs to train their models by default, and we rely on those commitments. If that changes in a way that affects your content, we will update this Policy.

7.2 Other services we contact

• Spotify. When you open a playlist on the Spotify playlist page, our servers ask Spotify for the playlist's track list. We send Spotify only the playlist's ID. Your use of Spotify itself is governed by Spotify's own terms and privacy policy.
• LRCLIB (lrclib.net). For songs from a Spotify playlist, our servers look up published, time-stamped lyrics by the song's title, artist, and length. No information about you is sent.
• Your browser's push service. If you turn on browser notifications, we send each notification to the push address your browser gave us, at the push service your browser uses (Google for Chrome and Edge, Mozilla for Firefox, Apple for Safari, Microsoft for older Edge). The message is encrypted so that only your browser can read it; the push service sees only its size and timing.
• Discord. When you open Dust Live inside Discord, our servers exchange the permission you gave for your Discord user ID and display name, and ask Discord whether you are in the Activity session you opened (Section 3.8). We send Discord nothing else about you. Your use of Discord is governed by Discord's own terms and privacy policy.
• Apple. The apps are distributed through Apple's App Store, and Apple collects information under its own privacy policy. Universal links to nanodot.app are verified by Apple.
• X (Twitter) and other places you share to. If you share a song to X or anywhere else, you are sending it to that service under its terms.

7.3 Other permitted disclosures

We may also disclose personal information:

• to comply with law — in response to a valid subpoena, court order, or other lawful request from a public authority;
• to protect rights and safety — to enforce our Terms, investigate abuse, or protect nanodot, our users, or others;
• in a corporate transaction — if nanodot is involved in a merger, acquisition, financing, reorganisation, or sale of assets, subject to confidentiality, and to a successor that will be bound by this Policy or one at least as protective.

8. Where your information is stored and international transfers

nanodot is available worldwide, and we store and process personal information in the United States (Amazon Web Services, us-east-1). Our AI providers may process data in the United States and other countries where they operate. If you use the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where the law of your country requires a transfer mechanism, we rely on the safeguards our service providers offer, such as the European Commission's Standard Contractual Clauses.

9. How long we keep your information

When a retention period ends, we delete or irreversibly anonymise the data.

10. Moderation of comments and chat

To keep Dust Live and comments usable, we may remove content and mute or ban song keys that break our Terms. When someone in Dust Live chat is reported, an automated review (using OpenAI, see Section 7.1) reads the reported name's recent lines and the reason given, and decides whether to remove that key from Dust Live. If it does, all of that key's chat lines are deleted, its open connections are closed, and the key can no longer take part in Dust Live. This affects only participation in Dust Live and has no legal or similarly significant effect on you. If you believe a key was banned in error, email support@mavster.ai.

11. Your rights and choices

11.1 Controls you have directly

Because there are no accounts, your song key is how we know content is yours. With it you can:

• Remove a song ("Remove from gallery"). This deletes the song, its audio, the original file, its transcript, and all comments on it, and takes it off every shelf. Generated illustrations may remain in the shared library (Section 9).
• Fix the song's lyrics.
• Edit or delete any of your comments.
• Delete all of your Dust Live chat lines at once.

If you lose your key, email us with enough detail for us to reasonably confirm the song is yours (for example, the original file or details only the uploader would know), and we will help.

Inside Discord, you can stop nanodot receiving anything more from Discord by removing the app under User Settings > Authorized Apps in Discord. To have us correct or delete what we hold from Discord (Section 3.8), email support@mavster.ai with the subject line "Discord Data Request" and your Discord username; we will act on it within 30 days, and we also delete it when Discord asks us to or if we stop offering Dust Live in Discord.

11.2 Rights available to everyone

Wherever you live, you may ask us to access, correct, delete, or export personal information we hold about you, or object to how we use it. Email support@mavster.ai. Because we do not know who you are, we may need your song key or other information to find and verify the data, and we may be unable to act on data we cannot link to you (for example, anonymous analytics events). We will respond within the time your local law requires, and in any case within 45 days (extendable by a further 45 days where reasonably necessary, with notice to you). We will not discriminate against you for exercising these rights.

11.3 European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, the UK, or Switzerland, we process your personal information on these legal bases:

• Performance of a contract — to provide the features you ask for, such as hosting and processing a song you add, showing your comments and chat, and letting your key manage them;
• Legitimate interests — to secure the Services, prevent abuse, moderate content, and understand how the website is used, where those interests are not overridden by your rights;
• Legal obligation — where we must keep or disclose information by law;
• Consent — where we ask for it; you can withdraw it at any time.

You have the rights to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to lodge a complaint with your local data-protection authority.

11.4 California and other U.S. states

Residents of California and of other U.S. states with comprehensive privacy laws have the rights to know, access, correct, delete, and obtain a copy of their personal information, and to opt out of its sale, sharing, targeted advertising, and certain profiling. We do not sell or share personal information, engage in targeted advertising, or engage in profiling that produces legal or similarly significant effects, so those opt-outs are in place by default. We honour Global Privacy Control signals as an opt-out of sale and sharing. We do not knowingly sell or share the personal information of consumers under 16.

In the past 12 months we have collected these categories of personal information under the CCPA: identifiers (IP address, anonymous analytics ID, song-key hash, random voter ID); internet or other electronic network activity (access logs, analytics events); approximate geolocation derived from IP address (by Mixpanel); audio information (the songs you add); and user-generated content (artist names, links, lyrics, comments, chat lines, reports). We disclose these only to the service providers in Section 7.1, for the purposes in Section 4.

To make a request, email support@mavster.ai with the subject line "Privacy Request" and your state of residence. You may use an authorised agent; we will verify the agent's authority. If we deny your request, you may appeal by replying with the subject "Privacy Appeal"; we will respond within 60 days. If your appeal is denied, you may contact your state attorney general.

11.5 Do Not Track

The website does not respond to browser "Do Not Track" signals, because no common standard for them exists. It does honour Global Privacy Control as described above.

12. Security

We protect personal information with reasonable administrative, technical, and physical safeguards, including encryption in transit (TLS) for all traffic to our website and API, encryption at rest for stored data, storing song keys only as one-way hashes, storing only hashes of IP addresses for Dust Live, least-privilege access to our systems, and limits on how fast and how often our public routes can be called. No method of transmission or storage is completely secure.

If a security breach involving your personal information occurs, we will notify affected people and regulators as required by applicable law. Because we hold no contact details for you, we may give that notice on the website and in the app.

13. Children

The Services are not directed to children under 13, and you must be at least 13 to use them (or older where your country's law sets a higher age for using online services without a parent's consent, such as 16 in some EEA countries). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has added a song, comment, or chat line, email support@mavster.ai and we will remove it.

14. Changes to this Policy

We may update this Policy. The "Last updated" date above shows when it last changed. If we make a material change — for example, adding a service provider that receives your songs, beginning to collect a new category of personal information, or adding accounts — we will post a prominent notice on the website and in the app before the change takes effect and, where the law requires, ask for your consent.

15. How to contact us

Questions, requests, or complaints about this Policy or your personal information:

Marian Paraschiv, an individual doing business as nanodot
2120 W Spring Creek Pky, Plano, TX 75023, USA
Email: support@mavster.ai

You may also complain to your local data-protection or consumer-protection authority — in the United States, your state attorney general or the Federal Trade Commission (https://reportfraud.ftc.gov).