Realty Wave

Your rights and privacy

Privacy Policy

Last updated: October 2026

Imagine Peak LLC dba Imagine Peak Studios, the operator of Realty Wave ("we," "us," or "our"), respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use the Realty Wave platform ("Platform"), including our website, API, and MCP server. Realty Wave runs on the Harmonic Wave platform, which we also operate, so accounts, content, the API, the MCP server and connected services work the same way on both.

1. Information We Collect

1.1 Account Information

  • Email address: Required for account creation and authentication
  • Display name: Optional, provided by you for your profile
  • Account type: Creator or Developer designation
  • Profile information: Bio, links, and presentation preferences (Creators only)

1.2 Upload and Content Metadata

  • IP address: Logged on every upload for abuse prevention and legal compliance
  • Email address: Logged on every upload and linked to the uploader's account
  • File metadata: File type, file size, upload timestamp, content type classification
  • Content metadata: Titles, descriptions, tags, mood settings, and structural data you provide

1.3 Usage Data

  • API usage: Request counts, endpoints called, timestamps, API key used
  • Session data: Session tokens (hashed), login timestamps, expiration times
  • Playback records: Media and experience IDs, time, delivery status, and bytes delivered. Listener email addresses, where available, are stored as hashes; IP addresses are hashed with a salt that changes daily. Playback records are retained for 90 days.
  • Experience access records: Which email addresses have been granted access to which experiences
  • Protected-content access records: When we release a key for protected playback or viewing, we record the content identifier and version, time, request context, and a one-way IP-address hash using a salt that changes daily. A key-release record does not establish that someone played or viewed the content.

1.4 Technical Data

  • IP address: For rate limiting, security, and abuse prevention
  • Request headers: User-agent and origin headers for standard web operation

1.5 Connected Account Data

If you choose to connect a YouTube channel, we receive and store the following from your Google Account:

  • Channel identity: The channel ID, channel title, and channel image URL that YouTube returns for the channel you authorize
  • Authorization credentials: The tokens Google issues so the Platform can act on the channel you authorized. These are encrypted before they are stored, and they are never displayed, exported, logged, or returned by any Platform API
  • Permission record: Which permissions you granted, when the connection was last checked, and its current status

We ask for the narrowest set of permissions a feature needs. Connecting a channel for reporting does not ask for permission to upload videos or to change them.

We identify the channel by asking YouTube which channel your authorization reaches, and we record the channel it names. That establishes which channel you are authorized to manage, which is not the same as owning it: labels, managers, and brand accounts can all hold legitimate access to a channel they do not own. We never accept a channel identifier from a browser as proof of either.

If you connect a Google Ads account, we receive the accessible account list and account details, including account IDs, names, currency, time zone, and access status. When you request reporting, we receive daily campaign figures such as impressions, clicks, cost, video views, and conversions. Authorization tokens are encrypted before storage and are never exposed through the Platform API. See section 7.5.

1.6 Contact, Invite Request and Area Inquiry Forms

When you contact us, we store your name, email address, inquiry type, and message so we can respond. Our Contact form has no updates box, and sending it does not add you to any list.

When you send an inquiry from an area page, such as Venice Beach Florida, we store your name, email address, the area you asked about, and the optional phone number and question you provide. We email it to our team at hello@realtywave.ai so we can reply, and we may share it with a local real estate professional who can help with your move, but only after you tell us you want to be connected. Before an inquiry is sent, Cloudflare Turnstile checks that a person, not an automated program, is sending it.

1.7 Agent Alerts by Text Message

Realty Wave Agent Alerts are text messages for participating real estate agents and brokers, not for people who contact us about a home or an area. If you are an agent and sign up on our Agent Alerts page, we store your name, your mobile number, whether you agreed to receive texts, the date and time you agreed, the page you used, and the exact wording you agreed to. We also keep a record of when alerts were switched on for you and when you stopped them.

We use your mobile number only to send you the alerts you asked for: caller transfers, callback requests and the status of inquiries handed to you, plus the confirmation, help and opt-out messages the program requires. We send these texts through our messaging provider, which processes your number and the message only to deliver it.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Your mobile number and text consent are not shared with third parties, affiliates or lead generators.

You can stop alerts at any time by replying STOP, by using the Stop Agent Alerts form, or by emailing hello@realtywave.ai. We keep the record of your consent and of your opt-out for as long as the program runs and for up to four years after your last alert, so we can show what you agreed to and that we stopped when you asked, and then delete it.

This section covers agents’ text consent only. An inquiry a caller or visitor asks us to pass to a real estate professional is handled as described in section 1.6.

1.8 Conversations with Our Intelligent Assistant

On our phone line and in the chat on our area pages, you can talk with our intelligent assistant, an AI that answers questions about an area. It tells you it is an AI at the start of every conversation. Calls are recorded and chats are saved, and you are told so at the start.

We keep the transcript of each conversation, a summary of it, the details you choose to give, and, for calls, the phone number you call from (caller ID). We also record where a conversation came from: for chats, the approximate city and region of your internet connection, your type of device, the page and the website that referred you; for calls, where your phone number is registered. We use this to understand which areas and ads people come from, never to judge or sort people. If the assistant cannot take your call, you can leave a voicemail, which we record and keep with your number. Our team reviews conversations and voicemails to follow up with you and to improve the assistant's answers.

During a conversation you can make two separate, optional choices:

  • Notes by email: a one-time email summarizing your own conversation, with links to the places mentioned. We send it only when you ask, to the address you give. It does not add you to any list.
  • A local real estate professional: only after you say yes, we share your details and your request with the participating real estate professional(s) for that area, who may contact you by phone, text or email. Realty Wave is not a real estate brokerage.

Agreeing to one is not agreeing to the other. The assistant answers from information we have researched and reviewed, but it can be wrong: please check details such as hours, prices and school assignments with the source. It does not give financial, legal, tax or insurance advice. To see or delete a conversation, email hello@realtywave.ai. How long we keep conversations is in section 8.

2. How We Use Your Information

  • Authentication: To verify your identity via email codes and maintain your session
  • Content delivery: To host, stream, and deliver your content to authorized users and agents
  • Protected delivery: To validate access, operate and troubleshoot protected playback and viewing, and detect abuse
  • Analytics: To provide you with usage statistics for your account and content
  • Area inquiries: To answer your question about an area and, when you ask us to, connect you with a local real estate professional
  • Abuse prevention: To detect and prevent prohibited content, copyright infringement, and platform abuse
  • Legal compliance: To respond to lawful requests and enforce our Terms of Service
  • Platform operation: To maintain, improve, and secure the Platform infrastructure

3. What We Do NOT Do

We are explicit about what we will never do with your data and content.

  • We never sell your data. Your personal information is not for sale, to anyone, for any reason.
  • We never use your content to train AI models. Your audio, video, images, and text are never used to train a machine learning model or large language model, ours or anyone else's, and our providers are not permitted to train on them. This is a foundational principle of the Platform.
    To be precise about the difference: the Platform is built on generative AI, so when you ask it to produce something, the material you give it is sent to AI services to do that work. That is processing you requested, not training, and the services involved are named in section 7.
  • We never share your data for third parties’ own marketing. We do not sell or supply your personal information to advertisers or data brokers for their own use. If you authorize a promotional campaign for your production, the agreed material is used only to carry out that campaign. Connecting an account alone is not campaign authorization. If you send an area inquiry, we may pass it to a local real estate professional so they can help with your move, only with your permission, as section 1.6 describes.
  • We do not build our own cross-site profiles of you. We do not use fingerprinting. Our Google tag uses analytics and advertising cookies, and Google receives information about your visits through it, as described in section 6.

4. Data Storage and Infrastructure

The Platform's own storage is Cloudflare infrastructure:

  • Account and metadata: Stored in Cloudflare D1 (SQLite-based database), encrypted at rest
  • Media content: Stored in Cloudflare R2 (object storage), encrypted at rest
  • API and application logic: Runs on Cloudflare Workers (edge computing)

Data is processed at Cloudflare edge locations globally. All data in transit is encrypted via TLS.

Cloudflare is where we store your data. It is not the only place your data goes. The services described in section 7, including the AI providers that generate content, Google Analytics, Cloudflare Turnstile, Google Fonts and Google Maps, and YouTube when you connect a channel, receive data in order to do what you asked, and they may retain it under their own terms. We do not control their retention.

5. Content Storage

We store uploaded originals in access-controlled Cloudflare R2 storage. Where protected delivery is enabled, we also store encrypted delivery copies and the key information needed to provide authorized playback or viewing.

Encrypted delivery files may be retrieved without an access check. The Platform checks authorization before releasing the information needed to decrypt them. Authorized playback or viewing decrypts the content in the recipient's browser. Realty Wave manages the encryption keys.

Withdrawing access cannot erase content or decryption information already received by a recipient.

You control access through the Platform's experience and access management tools. Changing an experience's status rotates its share link, which stops previously shared URLs from working.

Content is retained until you choose to delete it. When you delete content, it is permanently removed from our storage. Encrypted delivery copies of deleted content, and their key information, are removed by our clean-up process, normally within an hour. Content removed in response to a copyright notice is retained, with its encrypted copies, while restoration remains possible under our DMCA Policy.

Deleting content here does not delete copies published elsewhere. If a finished video has been published to a YouTube channel, deleting the source content on the Platform, disconnecting the channel, or deleting your Platform account does not remove that video from YouTube. Only you can take it down there. Rotating a Realty Wave share link likewise has no effect on a copy already published to YouTube.

6. Cookies

We use essential cookies for signing in and early access, plus Google Analytics and Google advertising cookies:

  • Session cookie: httpOnly, secure, SameSite=Lax. Used solely to maintain your authenticated session. It expires after seven days, or when you sign out.
  • Sign-in cookie: signin_nonce, httpOnly, secure, SameSite=Lax. Ties an emailed sign-in code to the browser that asked for it. It expires after 10 minutes.
  • Invite access cookie: wl_bypass allows invited users to access the sign-in flow. It expires after 30 days.

Browsing the site without signing in sets none of these.

We use Google Analytics to understand how the site is used. The Google tag loads on every page and sets Google Analytics cookies (_ga and _ga_FDTTF9BN9H), which hold a random identifier so visits from the same browser can be counted together. They last up to two years. Google receives your IP address and browser details with each measurement.

The tag also has Google's advertising features turned on. Google may set or read its own advertising cookies so that we can measure our Google Ads campaigns and show our ads to people who have visited the site, and Google may connect your visit to your Google Account if you are signed in to Google. We also use Google's demographics and interests reports, which show us the age ranges, genders and interests of visitors in aggregate; they never identify an individual. Google's use of this information is governed by the Google Privacy Policy and its explanation of how Google uses information from sites that use its services.

There is no cookie banner. You can block or delete these cookies in your browser settings, turn off personalized ads in My Ad Center, or use Google's Analytics opt-out add-on. The site works the same without them.

If you choose light or dark with the switch in the header, that choice is kept in your browser's local storage, not in a cookie, and is never sent to us.

Some pages load services from other companies, which may set or read their own cookies under their own policies: Cloudflare Turnstile on inquiry forms, the Google Maps map on area pages, and Google Fonts on every page.

We do not use fingerprinting, we do not use advertising networks other than Google's, and we do not sell what these cookies collect.

7. Third-Party Services

We use a limited number of third-party services to operate the Platform:

  • Cloudflare: Infrastructure (Workers, D1, R2). Your data is processed by Cloudflare under their data processing terms.
  • Resend: Authentication emails, contact and area inquiry notifications, and consented update emails. It receives the recipient address and message contents needed to deliver those emails.
  • Stripe (future), Payment processing for premium experiences. Stripe will handle payment data directly; we do not store credit card numbers.
  • Google and YouTube: Channel connection, reporting, and publishing, for creators who choose to connect a YouTube channel. Google Ads account connection and reporting are described in section 7.5. See section 7.1 for YouTube.
  • Google Analytics and Google advertising features: Site usage measurement with analytics cookies, and measuring and showing our Google Ads to people who have visited the site. See section 6.
  • ElevenLabs: Runs our intelligent assistant's conversations, by phone and by chat: the voice, transcription and the AI model's replies. It processes what you say or type during a conversation.
  • Twilio: Our phone line: it connects calls to the assistant and records voicemails.
  • Cloudflare Turnstile: Checks that an inquiry is sent by a person. Cloudflare processes your IP address and browser signals for that check.
  • Google Fonts: The site's typeface. Google receives your IP address and browser details when a page loads it.
  • Google Maps: The map on area pages, loaded from Google when the page opens. Google's handling of that request is governed by the Google Privacy Policy.

Our proprietary production process separates audio analysis from visual-story planning. Your master audio goes to Music.ai for initial analysis; the resulting chords, tempo, and transcribed lyrics inform the storyboard. We do not send your master audio to ChatGPT. Services used for generation receive only the instructions or reference material their task needs:

  • Music.ai: Initial audio analysis for chords, tempo, and lyric transcription. It receives the recording for that analysis and may store it under its service terms. We do not opt into training on your material.
  • OpenAI: Text-based interpretation and visual-story planning for production projects. We use transcribed lyrics and musical analysis for this work, not your master audio.
  • Cloudflare Workers AI and AI Gateway: Text and image generation, and the gateway that routes model calls.
  • Google (Gemini and related generative models), Image, video, and music generation.
  • ByteDance / BytePlus ModelArk: Video generation, including Seedance, through an AI gateway or directly for a production project. Receives the scene instructions and reference media needed for the requested render.
  • ElevenLabs: Speech synthesis. Receives the narration text to be spoken.
  • HeyGen: Presenter video. Receives the still image and the audio to animate.
  • Anthropic (future), Metadata generation. Not in use today.

None of these providers is permitted to train on what we send, and we do not send them anything you have not asked the Platform to work on.

Apart from the sharing you direct yourself, described in 7.3, and area inquiries shared, with your permission, with a local real estate professional, described in 1.6, we do not share your data with any other third-party services.

7.1 YouTube API Services

The Platform uses YouTube API Services.

We use data obtained through YouTube API Services only to provide the features you connected a channel for. We do not sell it, we do not share it with other creators, and we do not use it to train machine learning models.

On advertising, two different things are worth separating. We do not use data from a connected YouTube channel or Google account to target advertising, to build advertising audiences, or for any advertising purpose of our own. If you separately authorize a promotional campaign for your own production, that campaign uses the agreed material only to carry out what you asked for. Its scope and any required permissions are agreed before it begins. A production agreement does not authorize additional access to a connected Google or YouTube account.

Stored YouTube data is limited to the channel identity and permission record described in 1.5, together with the reports described below.

When you authorize channel reporting, the Platform retrieves and stores reports for your connected channel and its videos. These can include views and impressions, watch time and average view duration, engagement, and traffic sources.

Reports contain aggregate performance figures, not individual viewer identities. Reports and measurement captures are retained for 24 months. You can delete stored reports. Disconnecting the channel deletes them, once the seven-day period described below ends, and deleting your account deletes them too.

Connecting a channel does not itself request or store a performance report. Reporting requires the relevant permission and a report request or collection schedule you authorize.

7.2 Deletion and the one thing we keep

When you disconnect a channel, the Platform stops using it immediately and the stored credentials are erased.

One thing is kept deliberately, and only one: an encrypted copy of the credential needed to ask Google to withdraw the permission. Without it, a withdrawal that has not yet succeeded could never be completed. It is never used for anything else, and it is erased as soon as Google confirms the withdrawal.

If the withdrawal has still not been confirmed after seven days, we erase that credential anyway and stop trying. What remains is a record that a withdrawal was requested and was not confirmed. It holds no credential and no usable credential or report data, and its purpose is so that we can tell you the truth about what happened rather than assume it.

The disconnected channel's record stays visible to you for up to seven days so you can see what happened to it, and is then removed.

If you withdraw access at Google rather than here, we check authorization periodically and during channel operations. Once we confirm access is no longer valid, we promptly remove the stored connection data. If you revoked by accident, connect the channel again and it is set up fresh.

7.3 Sharing you direct

The Platform is designed to be driven by AI agents as well as by people. If you issue an API key, or connect an external agent or application through the Platform's agent interface, that agent can read the content and experience data your key permits, and it operates under whoever runs it rather than under us. That is sharing you initiated, and you control it by issuing and revoking keys.

Credentials are never included. An agent cannot read your connected-account tokens, your encryption keys, or any third-party credential the Platform holds, and no agent path exposes them.

7.4 Approved production and promotional use

A separate production agreement may authorize publication of a finished work and excerpts on Realty Wave channels, our website, social media, or in presentations and paid promotion. These uses require your express written permission for that project. Supplying a song or listing photographs, property videos, floor plans, or other materials, requesting an invite, or connecting a channel does not grant permission to use your work to market the Platform.

7.5 Google Ads and Google API Data

Creators can connect a Google Ads account to view accessible accounts and request campaign reporting. Stored daily figures include impressions, clicks, cost, video views, and conversions, with the account currency and time zone needed to interpret them. These figures do not identify individual viewers.

Connecting an account creates no campaigns and spends nothing. Campaign creation or changes require a separate authorized action. Disconnecting stops the Platform’s access; it does not pause or stop a campaign already running in Google Ads. Manage those campaigns in Google Ads.

Report snapshots are retained for 24 months. Disconnecting does not delete them, so your campaign history stays readable; deleting your account deletes them, together with campaign, experiment and switch records. A snapshot preserved as evidence for an experiment can remain while that evidence record is retained.

Credentials are encrypted before storage. On disconnect, usable credentials are erased and we ask Google to withdraw access. An encrypted credential needed to complete an outstanding withdrawal can remain for up to seven days, solely for that purpose, as described in section 7.2.

Realty Wave’s use and transfer of data received from Google APIs, including YouTube and Google Ads, adheres to the Google API Services User Data Policy, including its Limited Use requirements. Connected-account data is used for the features you authorize. It is not sold, used to train AI models, or used to build advertising audiences. Human access is limited to your affirmative permission, security needs, legal obligations, or permitted aggregate internal operations.

8. Data Retention

  • Content: Retained until you delete it through the Platform
  • Account data: Retained until you delete your account
  • Authentication codes: Automatically expire after 10 minutes
  • Session tokens: Expire based on session duration settings
  • API usage records: Retained for 90 days for usage reporting and abuse prevention
  • Playback records: Retained for 90 days
  • Protected-content access records: Retained for 90 days for delivery diagnostics, security, and abuse prevention, or removed earlier when required by our account-deletion procedures
  • Encrypted delivery copies and associated key information: Follow the retention rules for their source content. When source content is deleted, these copies and key information are also removed through our cleanup process
  • Connected-account reports: Normally retained for 24 months, with the deletion behavior and experiment-evidence exception described in sections 7.1 and 7.5
  • Conversations with our intelligent assistant: Our copies of transcripts and summaries are kept for 24 months. Recordings and transcripts held by our conversation provider, and voicemail recordings, are kept for 90 days. The contact list entry for a conversation is kept like an inquiry, below. You can ask us to delete yours sooner at any time
  • Enquiries, invite requests and area inquiries: Retained until we delete them. You can ask us to delete yours at any time
  • Updates list: Until you unsubscribe or ask us to remove you
  • Upload IP logs: Retained for legal compliance and abuse prevention

When you delete your account (via the dashboard or the delete_account MCP tool), your associated data is permanently removed, including your profile, content, API keys, access records, and sessions.

Two things survive an account deletion. The first is the DMCA audit record: where a takedown or counter-notice action was taken on your content, the record of that action is not tied to your account and is retained for legal compliance, as our DMCA Policy describes. The content itself, its upload metadata, and any counter-notice you filed are removed with your account. The second is described in sections 7.2 and 7.5. If you had connected a YouTube or Google Ads account and a permission withdrawal is still outstanding, the encrypted credential needed to complete that withdrawal survives the deletion for no more than seven days. It is used for nothing else. After that it is erased whether or not the withdrawal succeeded, and what remains is a record that it was requested and not confirmed, holding no credential and no usable credential or report data.

9. Your Rights

You have the right to:

  • Access your data: View all data associated with your account through the Platform dashboard or API
  • Delete your data: Permanently delete your account and all associated data at any time
  • Download your media: Download your media through the Platform
  • Correct your data: Update your profile, content metadata, and account information at any time
  • Withdraw consent: Stop using the Platform and delete your account at any time
  • Disconnect a connected account: Remove a connected YouTube or Google Ads account. Disconnecting stops access and asks Google to withdraw the permission. It does not remove published videos or stop running Ads campaigns

You can also revoke the Platform's access directly in your Google Account permissions, without using the Platform at all.

If you delete your account, we remove your stored connection records and ask Google to withdraw any permission you granted.

If a withdrawal is not confirmed, we report it as unresolved rather than as complete. We retry temporary failures for a limited number of attempts. Other failures, and any failure that is still unresolved after seven days, need either our intervention or, more reliably, your own removal of the Platform in your Google Account permissions. We will not tell you a permission has been withdrawn when we have not been able to confirm it.

Two things can outlive an account deletion, and section 8 lists both. The first is described in sections 7.2 and 7.5: the encrypted credential needed to complete an outstanding withdrawal, kept for no more than seven days, and afterwards a record holding no credential and no usable credential or report data. The second is the DMCA audit record described in section 8 and in our DMCA Policy.

Revoking access at Google may affect more than one permission you granted to Realty Wave from the same Google Account, because Google groups them by application. If you use more than one connected channel, check the rest after revoking.

To exercise any of these rights, use the Platform directly or contact us at hello@realtywave.ai.

10. Children's Privacy

The Platform is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

If you believe a child under 13 has provided us with personal information, please contact us at hello@realtywave.ai.

11. Security Measures

We implement appropriate technical and organizational measures to protect your data:

  • Platform-issued API keys are stored as SHA-256 hashes (we never store the raw key)
  • Passwordless authentication eliminates password-related attack vectors
  • Session tokens are hashed before storage
  • Rate limiting protects against brute-force attacks
  • IP and email blacklisting for abuse prevention
  • All data encrypted in transit (TLS) and at rest
  • Authorization checks before releasing decryption keys for protected delivery, with encryption keys stored separately from delivery files
  • File type validation including magic byte verification on uploads

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify registered users via email. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

That does not apply to your connected accounts. Continuing to use the Platform is never treated as permission to access additional data from a connected Google or YouTube account, or to use data already obtained from one for a new purpose. Either of those requires a new authorization from you, requested at the time, and we will not obtain it by revising this page.

13. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at:

hello@realtywave.ai