Privacy Policy

1. Introduction

Mental Audio AS ("we", "us", or "our") operates Surraura, an audio processing application for macOS. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Application and website. We are committed to protecting your privacy and handling your data responsibly.

2. Audio Data - What We Do NOT Collect

The Application does not:

• Record or store your audio
• Transmit audio content to any server
• Analyze audio content for advertising or profiling
• Access files on your computer beyond application resources

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Email address (required for account creation and communication)
• Name (optional, for personalization)
• Password (stored securely using industry-standard hashing)
• Approximate country at sign-up (a coarse two-letter country code provided by our hosting provider's edge network — we do not store your IP address or look up your location)
• Environment downloads (which sound environments your account has downloaded, and daily aggregate download counts per environment and country — used for support and to understand which environments are popular)

3.2 Payment Information

Payment processing is handled by Paddle.com, our merchant of record. We do not directly collect or store your credit card numbers or bank account details. Paddle may share with us:

• Transaction IDs and subscription status
• Billing country (for tax purposes)
• Last four digits of your payment method (for your reference)

Please review Paddle's Privacy Policy for details on how they handle payment data.

3.3 Device Information

For licensing and technical support purposes, we may collect:

• Device identifier (anonymized hardware ID for license activation)
• macOS version (to ensure compatibility)
• Application version

3.4 Usage Telemetry (On by Default, Easy to Turn Off)

Telemetry is on by default so we can see in aggregate how the Application is used, and you can turn it off at any time in the Application settings. The first time telemetry is active without an explicit choice from you, the Application shows a brief one-time notice pointing you to that setting. The Application sends daily event counters tied to a random install identifier — a UUID generated on your device that is never connected to your account, your email, or your IP address (we do not store IP addresses with telemetry). Counters are kept for 90 days, with one-day granularity.

Telemetry observes the application, never your audio. This is the complete list of events the Application can report — our server rejects anything else:

• app_installed — first launch of a new installation (includes the app version)
• first_audio — the Application processed audio for the first time
• session — the Application was launched (includes the app version)
• session_end — the Application was quit (a duration bucket and the reason)
• environment_session — an environment was used (environment name and a duration bucket)
• settings_touched — settings were adjusted (not which ones, or to what)
• mode_snapshot — which listening switches were on for a session (3D sound, head tracking, ambience — on/off only)
• engine_restart — the audio engine restarted
• underrun — an audio buffer underrun occurred
• capture_permission_granted — System Audio Recording permission was granted
• capture_permission_lost — System Audio Recording permission was revoked or unavailable

Separately and with the same consent, the Application can send anonymous crash diagnostics (Apple MetricKit reports, which contain no personal data and no audio).

4. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Application
• Process your subscription and payments
• Send transactional emails (receipts, subscription updates)
• Provide customer support
• Improve the Application based on usage patterns
• Detect and prevent fraud or abuse
• Comply with legal obligations

5. Data Sharing and Third Parties

We do not sell your personal information. We may share data with:

• Paddle.com: Payment processing and subscription management
• PostHog (EU region): Website analytics and session recordings, only with your consent — see section 9
• Legal authorities: When required by law or to protect our rights

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL)
• Secure password hashing
• Regular security audits
• Limited employee access to personal data

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Your Rights (GDPR)

As a Norwegian company, we comply with the General Data Protection Regulation (GDPR). You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing of your personal data
• Restriction: Request limited processing of your data
• Withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at privacy@surraura.com.

8. Data Retention

We retain your personal data only for as long as necessary to provide our services and fulfill the purposes described in this policy. Account data is retained while your account is active and for a reasonable period afterward for legal and business purposes. You may request deletion of your account and associated data at any time.

9. Cookies and Website Analytics

Our website uses essential cookies for authentication and session management. These are required for the site to work and are not optional.

For everything else we use PostHog, hosted in the European Union (Frankfurt). Nothing is collected until you accept in the consent banner — if you decline, or simply ignore it, the analytics code is never even downloaded. You can change your mind at any time using the “Cookie settings” link in the footer.

With your consent, PostHog records:

• Pages you visit, how you arrived, and how far down a page you read
• Clicks and interactions with the site, including which audio previews you play
• Session recordings — a replay of your visit used to find where the site is confusing. All text you type is masked, so passwords, email addresses and form contents are never recorded.
• Approximate location (country/region), browser and device type, derived from your IP address. PostHog does not store your IP address for our project.

If you have an account, analytics is linked to your account identifier so we can understand how the product is used. We never send your email address to PostHog. Analytics data is retained for 12 months. This processing is based on your consent, which you can withdraw at any time.

10. Children's Privacy

Our Application and services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

For questions about this Privacy Policy or our data practices, please contact us: