Version 2026-09-29 · Last updated: September 29, 2026
Jamverse is operated by Noy-David Avitan, an individual in Israel operating under the name Jamverse ("Jamverse", "we", "us"). Noy-David Avitan is the controller of the personal data described in this policy. You can reach us about anything in it at noy@jamvers.com. When the Jamverse company is incorporated, it will take over as the controller and we will update this page.
This policy covers jamvers.com (including the early-access page at jamvers.com/early and the Live Shows pages at jamvers.com/live), the Jamverse web app at jamvers.com/jam, the Jamverse desktop apps for Mac and Windows, Live Shows, and the emails we send. Jamverse is in a closed, invite-only beta.
The short version
For each activity below we list what we collect, why, the legal basis we rely on, whether you have to provide it, and how long we keep it (see also section 8).
What: a nickname you choose and your email; your answers (what you play, how often and for how long, your level, your gear, your DAW, what you play along with today, your computer type, memory, graphics and browser, what you want Jamverse for — in your own words, if you write them — where you heard about us, an optional link to your music); the campaign tags, referring page and landing path of the link you arrived from; your consent choices; your browser's user-agent string; a result from Cloudflare Turnstile that tells people from bots; and a keyed one-way hash of your IP address, which is pseudonymous data, not anonymous data. If you allowed analytics on that page, we also store the page's random analytics ID with your application.
Why: to review applications, choose who gets a seat, make sure Jamverse runs well on the machines people actually have, understand how people play today so we can make Jamverse better for them, invite you to a short call about your first week if you ask for one, and stop spam and abuse.
Legal basis: steps you ask us to take before an agreement (your application); our legitimate interest in preventing spam and abuse and in understanding how people play so we can improve Jamverse; your consent for optional news emails and the optional call.
Required? Your nickname and email and the questions not marked optional are needed to apply. Everything marked optional can be left out without affecting your ability to apply, although it may affect our ability to assess whether Jamverse will run well on your computer.
What: the email address your invite was sent to; your role, plan and invite details; sign-in codes, which are emailed to you and are not stored by us; and the session token that keeps you signed in, which is stored in your browser or app. If you choose "Sign in with Google", Google tells us your email address and your Google account identifier; we use only the email address and do not store the Google identifier.
Why: to confirm your invite, sign you in, keep you signed in, and give you the features of your plan.
Legal basis: performing our agreement with you (the Terms of Service).
Required? Providing your invited email address is voluntary, but without it we cannot create or authenticate your beta account.
What: when you tick the box to accept the Terms of Service, we record your email, the version of the Terms and of this policy that you saw, a fingerprint (SHA-256) of both documents, the exact sentence you agreed to, the date and time, your IP address, your browser or app version, and where you accepted (the sign-in page, the app, or a Live Show page).
Why: to keep reliable evidence of our agreement with you, including the Confidential Beta obligations in the Terms.
Legal basis: performing our agreement with you; our legitimate interest in being able to establish, exercise or defend legal claims.
Required? Yes, to use the beta. If you do not accept, you cannot use it.
What: a device identifier (in the web app, a random ID stored in your browser; in the desktop apps, the identifier your operating system derives from your computer's hardware, which is the hardware UUID on a Mac and a value built from the system's SMBIOS data on Windows); your plan checks; a play-time meter for the free plan (seconds played and seconds open per day, number of sessions, how far the app got through loading, and whether you reached playing), linked to your email when you are signed in and to your device identifier when you are not; and, in the web app, the setup you declare during the rig check (instrument and model, how it is connected, how you monitor, whether you sing or use talkback, and your platform).
Why: to provide the service, apply your plan's limits, and understand a bug report against the rig it came from.
Legal basis: performing our agreement with you; our legitimate interest in supporting you and fixing problems.
Required? Yes, the app needs this to run. The setup declaration is optional.
When you play, the audio from your microphone or instrument is processed on your device, in your browser or the desktop app, to detect chords, notes and timing. Voice commands are recognised on your device by a speech model that runs locally; your voice is not sent to us or to any speech service. Live audio is not transmitted to our servers and is not stored by us. Recordings, saved jams, presets and exports you make are stored on your device or in a folder you choose, and we do not upload them. The one exception is a Live Show you choose to start (section 3.7).
The camera is used only when you turn it on in Jamverse and your browser or operating system grants permission. The video is processed on your device to recognise hand gestures and to place you on the stage, using models that run locally and are served from our own site. No camera frames, gesture results or camera diagnostics are sent to our servers, except the camera picture of a Live Show you choose to start (section 3.7).
If you go live: your show's title, your handle, and the stage and jam events of the show pass through our servers to your viewers. Your mix and, if it is on, your camera are sent directly from your device to your viewers' devices (a peer-to-peer WebRTC connection). A direct connection means the devices in a show can see each other's IP addresses, and Google's STUN service is contacted to set the connection up. For the replay, the show's audio, its event stream, clips from your camera, a still picture of the stage, and the files your stage uses (custom backgrounds, video art, avatar and room files) are uploaded to our storage and served to your viewers from a content-delivery-network address that is not listed anywhere public but opens for anyone who has it. A guest list you enter holds the email addresses you choose to invite.
If you watch: your audience account (email, display name, seat look, age confirmation, sign-in dates and count, the IP address of your last sign-in, and any strikes or ban), which shows you watched and for how long, and reports you send. Chat messages, claps and reactions pass through our servers to the people in the room; we do not store them.
Why: to run Live Shows and keep them safe (moderation, reports and bans).
Legal basis: performing our agreement with you; our legitimate interest in keeping shows safe.
Required? Only if you use Live Shows.
What: a report or idea you send from the app (its text, your email, your device identifier, the app version and your platform), and any email you send us.
Why: to answer you, fix what you report, and tell you when your request ships.
Legal basis: performing our agreement with you; our legitimate interest in improving Jamverse.
Required? No.
What: your plan, trial dates, subscription status and period, your Stripe customer identifier, invoices, and a plan you tell us you would keep once billing opens. During the beta, Stripe runs in test mode: an early-adopter trial asks for no card, and nothing is charged.
Why: to give you the plan you chose and, once billing opens, to take payments.
Legal basis: performing our agreement with you; our legal obligations for accounting and tax once real payments begin.
We send emails that are part of the service: sign-in codes, invitations, trial notices, and answers to what you send us. We send product news only if you opt in, and every news email has a one-click unsubscribe. Our server keeps a delivery record for each email (recipient, subject and the delivery service's message ID).
In the app: if you allow product analytics, we record usage events such as app opens, which views you open, launch steps, when a jam starts and ends and how long it lasts, a short session summary (play time, which worlds, windows and effects you used, how many recordings and saves you made, and how many voice commands you used and of which kind, never your voice or your words), errors, and your app, operating-system and browser versions. Events are tied to a random analytics ID that is separate from your sign-in and is never your email address. Automatic click capture and session recording are off in the app.
On the early-access page: if you allow analytics there, we count page views, how much of the video is played, which sections you look at, and where you stop filling in the form (which fields, never their contents). We may also record pseudonymized interaction data on that page, such as pointer movement, scrolling and clicks. Text entered into form fields is masked and is not included in the recording.
On other jamvers.com pages: analytics load only if you have already allowed them on jamvers.com.
Where it goes: PostHog, our analytics provider, receives your IP address when an event arrives. We have told PostHog to discard it, and PostHog may derive an approximate country before it does.
Legal basis: your consent. You can withdraw it at any time: in the app under Settings, then Account, then Product analytics; on the early-access page with its analytics choice; or by emailing us. Withdrawing does not affect analytics collected before.
Required? No. Jamverse works the same without analytics.
What: our API logs each request (time, method, address path with secrets removed, result, your browser's or app's user-agent string, and a request ID), and some events include your email, such as a sign-in or an email we sent you. Our content-delivery network and web firewall log access to jamvers.com, including IP addresses, addresses requested and user-agent strings.
Why: security, preventing fraud and abuse, and fixing problems.
Legal basis: our legitimate interest in keeping Jamverse secure and working.
We do not request or collect precise GPS location. Our hosting, security and analytics providers may process IP addresses and may derive an approximate country or region for security, fraud prevention and service operation.
Some storage is strictly necessary and is used without asking: your sign-in token, the signed cookies that let your browser load the app's content from our content-delivery network, your analytics choice, the web app's device ID, and your own app data (presets, recordings, saved jams and settings), which stay in your browser's storage or on your computer. Analytics cookies and storage are set only after you allow analytics. We use no advertising cookies and no cross-site trackers.
Jamverse does not currently use your microphone audio, recordings, MIDI performances or musical content to train machine-learning models. If we introduce an optional contribution program in the future, we will explain it separately and obtain any consent required before collecting that data.
Providing your invited email address is voluntary, but without it we cannot create or authenticate your beta account. All other information identified as optional may be omitted without affecting your ability to submit an application, although it may affect our ability to assess device compatibility. Analytics, the camera, the microphone, Live Shows and product-news emails are all optional; if you turn a feature off, only the part of Jamverse that needs it stops working. To use the beta you must accept the Terms of Service.
We do not sell your personal data and we do not share it for advertising. We use the service providers below, who process data on our behalf under their contractual and security terms:
| Provider | What they process | Why | Where |
|---|---|---|---|
| Amazon Web Services (AWS) | Requests to our API; Live Show replays and stage files; database backups; delivery of the site, the app and its content; firewall and access logs | AWS hosts portions of our API and content-delivery infrastructure and processes data on our behalf under contractual and security controls. We do not intentionally provide AWS with access to the content of locally stored recordings. | Germany (EU) and the United States; content is delivered from AWS locations worldwide |
| Neon | Our database: accounts and invites, applications, acceptance records, the play-time meter, setup reports, plans and trials, feedback, and Live Show records | Database hosting | United States |
| PostHog | Product analytics under a random ID, only if you allow them; early-access page recordings with typing masked | Understanding how Jamverse is used | United States |
| Resend | Your email address and the emails we send you | Sending sign-in codes, invitations, notices, and news you opted into | United States |
| Zoho Mail | Emails you send us, and copies of reports sent from the app | Our mailbox, noy@jamvers.com | United States |
| Your email and Google account identifier if you choose Google sign-in; your IP address when a Live Show sets up a connection (STUN) and when a page loads Google Fonts | Sign-in, Live Show connections, fonts | Worldwide | |
| Stripe | Your email, plan, trial and subscription details | Plans and trials; during the beta, test mode only | United States and worldwide |
| Cloudflare | A check of your browser on the early-access form (Turnstile) | Telling people from bots | Worldwide |
| Apple | Distribution through the Mac App Store or TestFlight, and crash reports only if you opt into them | Mac app distribution | Worldwide |
The band on stage is built with Unity and runs on your device; Unity's analytics, ads and crash-reporting services are switched off. People you perform for or watch with in a Live Show see what section 3.7 describes. We may also disclose data when the law requires it, to protect our rights or someone's safety, or to a company that takes over Jamverse, such as the Jamverse company once it is formed, which would continue to protect it under this policy.
We are based in Israel, and our providers process data in the European Union, the United States and elsewhere, as listed above. The European Commission recognises Israel as providing adequate protection for personal data transferred from the European Economic Area. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without such a decision, we rely on the provider's Standard Contractual Clauses or, where the provider is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Transfers from Israel follow the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations.
| Data | Kept for |
|---|---|
| Early-access applications | 12 months after we decide on them, or until you ask us to delete them |
| Account, invite, plan and trial records, the play-time meter, setup reports, analytics choice | While your beta account exists; deleted within 30 days after you ask us to delete your account or we close it |
| Terms acceptance records | While your account exists; after it is deleted, kept only in pseudonymized form (your email replaced by a one-way hash, and the IP address and device details removed) for as long as needed to establish or defend legal claims, because the Confidential Beta obligations continue after the beta |
| Feedback and support emails | While the beta runs, or until you ask us to delete them |
| Live Show replays and stage files | Until the host asks us to delete them, we remove the show, or the host's account is deleted |
| Live Show audience accounts, watch history and reports | While the account exists |
| Product analytics events (PostHog) | 12 months |
| Early-access page recordings (PostHog) | 30 days |
| API server logs | 90 days |
| Content-delivery and firewall access logs | 90 days |
| Database backups | 30 days, on a rolling basis |
| Email delivery records at Resend | 30 days |
| Payment records | Once real payments begin, as long as tax and accounting law requires |
You can ask us to:
Email noy@jamvers.com from the address you use with Jamverse, so we can confirm it is you. We answer within 30 days. You can also clear your browser's site data or uninstall the desktop app to remove what is stored on your device.
You have the right to complain to a data protection authority: in Israel, the Privacy Protection Authority; in the European Union, the authority in your country; in the United Kingdom, the Information Commissioner's Office.
We protect data with encrypted connections, access limited to what each part of the system needs, signed sign-in tokens, an administration key that stays off the public site, and our providers' encrypted storage. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
Jamverse is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.
When we change this policy, we update the version and date above. When a change matters, we tell you in the app or by email, and when it needs your consent, we ask for it again.
Questions about this policy, or to use any of your rights: noy@jamvers.com