Aphelion Privacy Policy

Last Updated/Reviewed Date: November 5, 2026

Aphelion (aphelion.music) — operated by Aphelion LLC d/b/a Aphelion, a Georgia limited liability company.

Aphelion LLC d/b/a Aphelion, a Georgia limited liability company ("Aphelion," "we," "us" or "our"), respects your ("you" or "your") privacy and is committed to protecting it through our compliance with this Privacy Policy (this "Policy"). This Policy describes (i) how we collect, store, use, disclose and retain information, including Personal Data, about you in connection with our websites, including aphelion.music (the "Sites"), your Aphelion account (your "Account"), our licensing service (the "Licensing Service"; together with the Sites and your Account, the "Services"), and our applications and audio plug-ins (the "Software"), and (ii) our practices for maintaining, protecting and disclosing that information.

This Policy applies to information we collect: (i) through the Services and the Software; (ii) in communications between you and us, including email; and (iii) when you interact with our advertising on other websites and services, to the extent that information reaches us.

This Policy does not apply to information collected by: (i) us through any other means, including on any website operated by us or by a third party that does not link to this Policy; or (ii) any third party, including through any website, application or content that links to or can be reached from the Services. Section 8 names the companies that receive Personal Data from us.

We may provide additional or different privacy notices for specific features or activities.

Please read this Policy carefully. By creating an Account, buying our Software, or otherwise providing us with your information, you acknowledge that we collect, use and share it as this Policy describes. This Policy may change from time to time, as Section 14 explains.

1. Who We Are, and Defined Terms

1.1 Who we are. Aphelion LLC d/b/a Aphelion, of PO Box 5241, Atlanta, GA 31107-0241, United States, is the controller of the Personal Data described in this Policy. You can reach a person by email at contact [at] aphelion [dot] music, through our contact page at https://aphelion.music/contact, or by post at that address.

1.2 In short. We collect what we need to sell you software, deliver it, keep your license working, and stop one license being used by everybody. We advertise our own software, and we buy that advertising from Google. We do not show you other companies' advertising, and we do not make money from your Personal Data. We do not train anything on your work. Our plug-ins do not contact us at all; our applications contact us to activate a license and, for a subscription or a trial, to check it. Section 8 lists everyone who receives your Personal Data, and why.

1.3 Our browser tools. Our browser tools, Pretzel and Daub, run entirely in your browser and send us nothing. Pretzel keeps your palette settings in your browser's own storage, and when you share a palette, its settings travel in the link itself, in the part of the address after the "#", which browsers do not send to any server. Visiting either tool is otherwise like visiting any other page of our Sites (Section 7).

1.4 Defined terms. The following terms have the meanings given below wherever they appear capitalized in this Policy:

• "Account" — your Aphelion account, which holds your licenses and your downloads.
• "Licensing Service" — our service that activates licenses for our applications and, for subscriptions and trials, checks them.
• "Personal Data" — information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or household, such as a name, an email address, an IP address or a license key. Information from which all identifiers have been removed, and which cannot reasonably be re-associated with an individual, is not Personal Data.
• "Services" — the Sites, your Account and the Licensing Service.
• "Sites" — our websites, including aphelion.music.
• "Software" — our applications, Phonon, Helios and Mothlight, and our audio plug-ins.

2. Information We Collect, and Why

2.1 Your Account. Your email address and display name, and the dates your Account was created and last updated. We need them to give you an Account, attach your licenses to it, and reach you about a purchase. If you create an Account with an email address, we send you a verification email through Google's Firebase service.

If you sign in with Google, Google tells us your email address, your name, the identifier of your Google account and the link to your profile picture, and Google learns that you signed in to us. Our sign-in provider, Google's Firebase, keeps them with your Account.

If your Account belongs to an organization, the records described in Section 2.3 attach to the Account, not to the individual person who used it.

2.2 Purchases. What you bought and when, what you paid and in which currency, the resulting entitlements and license keys, whether and when you downloaded each product, and a link to your Lemon Squeezy receipt. If you allowed us to measure it (Section 7), we also keep how you came to our Sites before you bought: the link, campaign or ad, which goes to Lemon Squeezy with your checkout and comes back to us with your order. Section 3 explains what happens to your payment details.

2.3 License activation and checks. When you activate one of our applications on a device, and whenever it later checks a license (monthly for a subscription, daily for a trial, and when you change the license on a device, since a perpetual license does not check in on a schedule), we receive:

• your license key, and an identifier for that activation;
• a label for the device, so you can tell your activations apart in your Account;
• your IP address and the app version, which reach us with the request.

We keep a record of each activation, validation and deactivation: the time, the action, which license and device, the result, your IP address and the app version. We use it to enforce how many devices a license allows, and to spot a key being shared or leaked. We keep those records for 90 days and then delete them automatically.

Lemon Squeezy receives your license key and a fixed name for the activation, because license keys are issued through it.

If you activate offline, by taking a request file to a computer that is connected and bringing a signed license file back, the request carries the same details, but we never see the offline computer's IP address, only that of the computer you send the file from.

2.4 Free trials. When you start a free trial we store a one-way hash (SHA-256) of a device fingerprint derived from your computer hardware, together with your Account ID and the trial start and expiry dates. We use this only to enforce trial limits (one trial per Account, and a cap on how many Accounts may trial from a single machine) and to prevent abuse. The raw fingerprint never leaves your computer in a readable form: it is hashed on your machine before it is sent, and hashed again before we store it.

We keep the hashed trial records after the trial ends. Deleting them would let the same machine start an unlimited number of trials, which is the one thing they exist to prevent.

2.5 Signing in from inside an application. When you sign in to one of our applications, it shows you a short code and sends you to our Sites to approve it. While that is pending we hold the code, which product it is for, a hash of your device's fingerprint, and, once you approve, your Account and email address. These records delete themselves about fifteen minutes after they are created, or an hour after you approve one. We use the IP address the request came from to limit how often it can be repeated (Section 2.7), and if the sign-in starts a free trial, it goes into the activation record (Section 2.3).

2.6 The launch waitlist. If you ask to be told when a product launches, we store your email address, which product you asked about, the page you asked from, the exact wording you agreed to, and when you agreed. We use it to send you one email when that product is available, and for nothing else.

We rely on your consent, which you give by ticking the box on the form. You can withdraw it at any time by writing to us through our contact page. A person records the withdrawal, and from then on we will not email you from this list, even if the form is later submitted again with your address.

We keep your address until we have sent that email or you have withdrawn, and then remove it. So that we can show we honored your choice, we keep the record of your consent and of any withdrawal. That record is filed under a fingerprint of your address rather than the address itself, though anyone who already knows your address could match it to the record.

If you joined the waitlist before the form asked for your consent, no record of consent was kept for your sign-up, and it is held separately from this list.

2.7 Server records. Our servers record each request, including its IP address, to operate and secure our Services and to investigate abuse, and keep that record for 90 days. We also use a request's IP address to limit how often it can be repeated; that is held briefly in memory and never stored.

3. Payment Details

We never receive your card details. Lemon Squeezy is our merchant of record: it sells to you, takes the payment, handles tax and invoicing, and tells us that an order happened. When you start a checkout on our Sites, we pass your email address to Lemon Squeezy so the checkout is filled in for you. Your payment details stay with Lemon Squeezy, and its own terms and privacy policy govern that part of the sale.

4. How We Use Information

We use the information described in this Policy to:

• provide the Services, deliver the Software, attach your licenses to your Account, and reach you about a purchase (Sections 2.1 and 2.2);
• activate and check licenses, enforce how many devices a license allows, and spot a key being shared or leaked (Section 2.3);
• enforce trial limits and prevent abuse (Section 2.4);
• sign you in, and send the email the Services need (Sections 2.5 and 6.1);
• send you the one email you asked for from the waitlist (Section 2.6);
• understand how our Sites are used and measure whether our advertising works (Section 7);
• operate and secure our Services and investigate abuse (Section 2.7); and
• keep accounting records, comply with the law, and establish or defend legal claims (Section 9).

5. Why We Are Allowed to Use It (EU and UK)

6. Email from Us

6.1 Email the Services send. The email the Services send is part of providing them, not marketing: the verification email when you create an Account with an email address, which Google's Firebase service sends for us; an email when a new version of software you own is released; and any notice we owe you about your Account, a purchase, or a change to our terms or this Policy. An email about a new version tells you only what changed and how to get it, and every one has a link that turns those emails off. Resend sends these for us, apart from the verification email. Lemon Squeezy sends your receipt.

6.2 Marketing email. We send marketing email only to people who have agreed to receive it. Joining the waitlist is not that agreement: it brings one email, as Section 2.6 says.

6.3 Opting out. Every marketing email includes a clear notice that you may opt out of further marketing email from us, and a working way to do so, either a reply address or a link to a page with an opt-out, that keeps working for at least 30 days after the email is sent. Every marketing email also carries accurate header and sender information, a subject line that describes its content, and our postal address. You may also withdraw your agreement at any time by writing to us (Section 15). We act on a withdrawal promptly, and in any event within ten (10) business days. A withdrawal lasts until you agree again, and it does not stop the email in Section 6.1.

7. Cookies, Analytics and Advertising

7.1 Analytics and advertising. We use Google Analytics to understand how visitors use our Sites, and Google Ads to advertise our Software and to measure whether our advertising works. Both use cookies and similar technologies, listed in Section 7.4. Neither runs until you agree to it, wherever you are. You can decline as easily as you accept, and change your mind at any time from the Your Privacy Choices link at the foot of every page that uses them.

7.2 Global Privacy Control. We honor Global Privacy Control. If your browser sends that signal, we treat it as a request not to share your information for analytics or advertising, and our analytics and advertising cookies stay off without you having to do anything. You can turn them back on for our Sites yourself, from Your Privacy Choices.

7.3 Visit statistics. When you arrive at one of our Sites, our server records how you arrived (the campaign tags in the link, the site that sent you, and whether you came from an ad), along with the page and whether you are on a phone or a computer. It records downloads, sign-ups, waitlist sign-ups, short-link clicks, purchases, your cookie choices, and the start of a checkout or a trial the same way, and a checkout or a purchase also records the price. These records carry nothing that identifies you or your device.

7.4 Cookies and similar technologies.

Signing in sets a cookie that keeps you signed in. It is used for nothing else. Our aph_attr cookie and the Google cookies are set only with your agreement (Section 7.1). We set the Google Analytics cookies to last 13 months; the lifetimes of the Google Ads cookies are set by Google. Firebase's storage comes with the sign-in software that most pages of our Sites load, so it does not wait for that agreement. Until you sign in, it holds only that note.

8. Who Receives Personal Data

8.1 The companies that receive it. These are the companies that receive your Personal Data, and why. Google appears more than once because it does different jobs for us, and they are kept separate: signing in with Google does not feed our advertising. If we add anyone, we will list them here before they receive any data.

8.2 Legal requirements and safety. Notwithstanding anything else in this Policy, we may disclose information to comply with the law, legal process or an enforceable governmental request; to enforce our terms; or to protect the rights, property or safety of us, our users or the public.

8.3 If our business changes hands. If we are involved in a merger, acquisition, financing, reorganization or sale of assets, Personal Data may be transferred as part of that transaction, subject to this Policy or a successor's terms. We will tell Account holders before any such transfer takes effect, by email and in their Account, and you will have the opportunity to exercise your right to deletion (Section 11) before it is completed.

9. How Long We Keep It

We keep Personal Data for as long as reasonably necessary for the purposes this Policy describes, or as the law otherwise permits or requires, including to provide the Services, run our business, comply with our legal obligations, resolve disputes, and for safety, security and fraud prevention. In deciding how long, we consider our legal and business obligations, the potential risk of harm, and the nature of the information. At the end of the applicable period, Personal Data is deleted, destroyed or de-identified. The table below gives the period for each kind of record.

10. How We Protect It

We use commercially reasonable technical and organizational safeguards to protect the Personal Data we handle from accidental loss or destruction and from unauthorized access, use, alteration and disclosure, including:

• encryption in transit (TLS) for connections to the Services;
• payment details that never reach us (Section 3);
• device fingerprints hashed on your computer and hashed again before storage, so we never hold the raw value; and
• on your own computer, your license stored in the operating system's protected storage: DPAPI on Windows and the Keychain on macOS.

However, no website, application, system or online service is completely secure, and no security program can guarantee absolute protection. We cannot promise that information will never be accessed or disclosed without authorization. Email sent to or from us may not be secure, so think carefully about what you send us that way. If we learn of a breach affecting your Personal Data, we will notify you and the regulators as applicable law requires.

11. Your Rights and Choices

11.1 Your rights, wherever you live. You can ask us to show you the Personal Data we hold about you, correct it, or delete it. You can export or delete your Account data yourself, in your Account settings.

To make any request, email us at contact [at] aphelion [dot] music. It is the fastest route, and a person reads every message. We also accept requests by post to Aphelion LLC, PO Box 5241, Atlanta, GA 31107-0241, United States, and we will act on a request you send us any other way. You do not need an Account to make a request. We answer within 30 days of receiving it.

11.2 In the EU and the UK. If you are in the EU or the UK you also have the right to object to processing we base on our legitimate interests, to ask us to restrict it, to withdraw consent at any time, and to complain to your data protection authority.

If you are in the UK and want to complain about how we use your Personal Data, tell us by email or by post, as above. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome. You can also complain to the Information Commissioner's Office.

11.3 In the United States. Depending on the state where you live, you may have other rights over your Personal Data, including the right to designate an authorized agent to make a request for you. The exact scope of these rights varies by state, and there are exceptions where we may not have to fulfill a request. To exercise any of them, write to us as Section 11.1 describes. We may need to verify your identity before we fulfill a request, and we will do so by reasonable means appropriate to the sensitivity of the request, such as confirming that you control the email address on your Account. To appeal a decision about your request, write to us the same way, and we will tell you how the appeal works.

Nevada residents have a limited right to opt out of certain sales of personal data, and may send that request to contact [at] aphelion [dot] music. We do not currently sell data in a way that triggers that law's opt-out requirement.

We will not deny you the Services, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

11.4 California. The California Consumer Privacy Act (the "CCPA") applies to a business once it meets one of three thresholds: annual gross revenue in the prior calendar year above US$26,625,000, as adjusted for inflation; buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or earning 50% or more of its annual revenue from selling or sharing personal information. When we meet one, we will publish a supplemental California privacy statement and link to it here. Until then we are not subject to the CCPA.

Whether or not it applies, Californians have the rights in Sections 11.1 and 11.3. We do not make money from your Personal Data. Google's analytics and advertising cookies run on our Sites only if you agree (Section 7.1), but California law may treat what they collect as personal information we sell to or share with Google. You can withdraw your agreement at any time from the Your Privacy Choices link at the foot of every page that uses them, or by sending a Global Privacy Control signal from your browser.

11.5 Your choices about cookies and email. You can switch analytics and advertising off at any time (Section 7), stop marketing email at any time (Section 6.3), and turn off the emails about new versions from the link in any of them (Section 6.1).

12. Children

Our Software is not for children. You need to be at least 16, or older where the law where you live requires it, to have an Account, and we do not knowingly collect Personal Data from anyone younger. If you believe a child has given us their data, write to us and we will delete it.

13. Where Your Data Is

We are in the United States and our systems run on Google Cloud in the United States. Google Analytics and Google Ads data is processed by Google in the United States and elsewhere. If you are in the EU, the UK or Switzerland, your data is transferred to the United States under the European Commission's standard contractual clauses, with the UK's addendum, in the data processing terms of the companies that process it for us.

14. Changes to This Policy

Every version of this Policy is dated and kept at https://aphelion.music/legal. When we make a material change, we will tell you before it takes effect, on our Sites, in your Account and by email, and the next time you visit our Sites while signed in we will ask you to acknowledge it. Your acknowledgment records which version you have seen; it is not a condition of using the Services or the Software. If a change affects a consent you gave, we will ask for your consent again rather than rely on the old one. Other changes take effect when we post the revised Policy with a new "Last Updated/Reviewed Date."

15. Contact Us

Email us at contact [at] aphelion [dot] music, write to us through https://aphelion.music/contact, or write by post to Aphelion LLC, PO Box 5241, Atlanta, GA 31107-0241, United States. Email is the fastest route.