Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Third Space LLC, a Wyoming limited liability company ("Third Space", "we", "us"), collects, uses, shares and protects personal information in connection with Background Noises: the apps for iPhone, iPad and Android (the "Apps"), the web player and website at bgnoises.com, and the emails we send (together, the "Service"). Background Noises is a product of Third Space LLC. Your use of the Service is also governed by our Terms of Service.

1.1 Who is responsible for your information

Third Space LLC is responsible for the personal information this policy describes and decides how and why it is used; in the words of European law, it is the controller. The service behind Background Noises, that is the stream of music and sound, the account service and the rendering of the noise colors and the tones, is run for us by eleMusic Inc. ("eleMusic"), a separate company, as our processor: it handles your personal information only on our instructions and only to run the Service for us, under a data processing agreement, and it gives that information the same or equal protection as this policy. Background Noises plays music and sound streamed by eleMusic, a separate service. Section 3.10 describes the information that moved to that service. An App that has not taken the latest update still connects to the earlier service, which we run ourselves under our Privacy Policy of March 8, 2026, until the App updates. The Legal Center lists that policy and how to get a copy. You can reach us using the details in Section 16.

The Subprocessors page lists eleMusic and the companies that work under it or beside it, what each receives, and where.

2. Information we collect, at a glance

3. More about what we collect

3.1 Accounts and sign-in

You can use the Apps and the web player without an account: the first time you play a sound, or start a purchase or a restore in an App, we create a guest account for that device or browser, with no email address or name. Like any account, it has the sign-in sessions Section 2 describes. To keep a Plan on more than one device, you sign in with Apple, with Google, or with an email address and a password, which we store only as a one-way hash. With Sign in with Apple you may share a private relay email address instead of your own. We receive no Apple or Google password. We do not ask for your age or date of birth.

3.2 Purchases

Web purchases are handled by Stripe on pages Stripe hosts. Stripe collects your card details, name, email and billing address; we receive identifiers, the Plan and its status, and the billing country, never your full card number. Purchases in the Apps are handled by Apple or Google; we receive the identifiers of the transaction or purchase so that we can verify it with the store and give your account the Plan you bought, and the store tells us when a subscription renews, is refunded or ends.

3.3 Audio made on request

While binaural beats, the journeys and the Beat Builder are paused, the Service makes no audio on request and keeps no audio of that kind for you, and no screen saves a preset. The Beat Builder presets that moved from the earlier service stay with your account, unused, as Section 3.10 describes.

3.4 Listening records and saved listening sessions

The Player sends us a record of what played and for how long. These records are tied to your account and contain no other personal information. We do not sell them or use them for advertising.

The web player's account settings also offer Keep my listening sessions, which is off unless you turn it on. While it is on, the web player saves in your account a record of each session you finish that lasted a minute or more: when it started, how many whole minutes it lasted, and which sound or station played. These are records of your listening that the Player measured. Turning the setting off stops new records, and the web player then offers to delete the sessions already saved; deleting your account deletes them too (Section 8.1).

3.5 Apple Health and health information

The Apps do not write to or read from Apple Health, Health Connect or any other health service, and they send us no health data. If you let an earlier version of the iPhone and iPad App write your listening sessions to Apple Health as mindful minutes, those entries stay in Apple Health, and the Health app may still list the access you gave; the updated App does not use it, and you can remove it in the Health app's settings. We do not use health information for marketing or advertising, and we do not seek any health information about you.

3.6 Diagnostics

The servers that run the Service send error reports to an error-monitoring provider, after removing email addresses, passwords and sign-in tokens from them. The Apps may send crash reports to the same provider, with your sign-in token removed; the web player sends none. We do not use session replay or screen recording.

3.7 What we do not collect

We do not collect your precise location, contacts, photos, microphone or camera recordings, advertising identifiers or full payment card numbers, and the Apps do not ask for access to any of them. The Apps do not track you across other companies' apps or websites.

3.8 Sign in with Google

If you sign in with Google, we request only the standard openid, email and profile permissions. We use the identifier, email address and name Google gives us only to create your account, sign you in and contact you about the Service. We do not sell this information, use it for advertising, or use it to train AI or machine learning models. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove our access in your Google Account settings at any time.

3.9 The sounds and AI

We do not use your personal information to make sounds, and neither we nor eleMusic use it to train or improve AI models. If a category of sound is generated with AI models (the How the sound is made page says which), eleMusic makes it in advance, separately from your use of the Service. The companies whose models eleMusic uses, among them Google through the Gemini API for the music stations, receive only the instructions eleMusic writes, never your personal information (Subprocessors, Section 5).

3.10 Information that moved to the new service

When we moved Background Noises from the earlier service, which we ran ourselves, to the service eleMusic Inc. runs for us, we copied to it the information needed to keep existing accounts working: account email addresses and sign-in links, and password hashes, which we replace with a stronger hash the next time you sign in; Plans and their store and Stripe identifiers, and whether an account has had a web trial; whether the earlier service recorded the account as agreeing to marketing email (its terms counted creating an account as agreeing); and the balance of credits bought and not used. The copy also brought along the saved Beat Builder presets, which stay with the account and appear in a copy of its data, although nothing uses them while the Beat Builder is paused; and the whole credit balance, free credits included. On October 20, 2026 we corrected the copied balances: only the credits bought and not used count, and those are held and refunded on request; free credits cannot be used. The tracks made in the old app, the old listening records and any health information were not copied. If the earlier service recorded you as agreeing to marketing email, we do not use that record to send you marketing email until you confirm it. Nothing was sold or transferred to another company: eleMusic Inc. processes this information for us, on our instructions, and we remain responsible for it.

When the earlier service is shut down, we keep an encrypted archive copy of its database for about 120 days, for legal compliance and disputes, and then delete it. The archive leaves out the old health readings, listening records and audio.

4. How we use information

We use personal information to provide the Service (accounts, playback and Plans); to verify purchases and process payments, renewals, refunds and cancellations; to communicate with you about your account, purchases, security and changes to our terms; to keep the Service secure and prevent fraud and abuse, including repeated trials; to find and fix problems and improve the Service, using aggregated or de-identified information where we can; to comply with law and enforce our agreements; and, only if you agreed to it, to send you marketing email. We do not use personal information for targeted advertising, and we do not make automated decisions about you that produce legal or similarly significant effects.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows:

• Service providers that run the Service for us, under contracts that limit their use of it. We choose providers whose published privacy and security commitments, in our judgment, give the information they receive the same or equal protection as this policy. The main one is eleMusic Inc., which runs the stream of music and sound, the account service and the rendering of the noise colors and the tones for us (Section 1.1). Under it and beside it: hosting and the database (Render); the catalog and playback service and sound rendering (Modal); audio storage and delivery (Amazon Web Services); payment processing (Stripe); email delivery (Resend); the mailboxes you write to (Google Workspace); error monitoring (Sentry); and app updates (Expo). The Subprocessors page lists each one, what it receives, where, and whether we or eleMusic engage it.
• Apple and Google, when you sign in with them, buy through their stores, use AirPlay or Google Cast, or install the Apps; they handle that information under their own policies.
• Stripe, which also uses some payment information for its own purposes, such as preventing fraud, under its own privacy policy.
• For legal reasons: to comply with law or legal process, enforce our Terms, prevent fraud or protect the rights and safety of anyone.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to this policy, except Google user data, which we transfer only with your consent.
• With your consent or at your direction.

6. Cookies and similar technologies

bgnoises.com does not set cookies and loads no advertising or analytics scripts. The web player keeps the items it needs to work in your browser's local storage: your sign-in token, a guest token waiting to be joined to an account you sign in to, your place in each sound's play order, listening records not yet sent, a copy of the public sound list, your settings, and the sign-in tokens of sessions you signed out of while our service could not be reached, kept only so that it can end those sessions later. For one browser tab only (session storage) it also keeps a check value for a Google or Apple sign-in that tab started, and the screen to come back to after a sign-in or a payment page. Some of these are sent to us: the sign-in and guest tokens to sign you in, the check value with that sign-in, your place in the play order with each request for a sound, the listening records that Section 3.4 describes, and any kept sign-in tokens, to end their sessions. The copy of the sound list and your settings stay in your browser. The home page at bgnoises.com reads whether the web player's sign-in token is present, so that it can send a signed-in visitor on to the player, and keeps one item in that tab's session storage, bgnoises.forwards: the times it did so in the last ten seconds, so that it never forwards you more than three times in a row. That item is never sent to us. Clearing your browser's data for bgnoises.com signs you out. Stripe's checkout and billing pages, and Apple's and Google's sign-in pages, use cookies under their own policies. Because we do not track you across other websites, we do not change how the Service works in response to a browser's Do Not Track signal; we treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we do not do in any case.

7. Your choices

• Sign out at any time.
• Turn Keep my listening sessions on or off in the web player's account settings; when you turn it off, the web player offers to delete the sessions already saved (Section 3.4).
• Unsubscribe from marketing email with the link in any marketing email; we honor it within 10 business days.
• Cancel a Plan in Manage billing (web) or in your Apple or Google subscription settings (Apps).
• Remove our access to your Google or Apple account in their settings.
• Delete your account (Section 8).

8. Access, correction, deletion and copies

You may ask us to confirm whether we hold personal information about you, give you access to it or a copy in a portable format, correct it, or delete it. Write to privacy@thirdspaced.com from the email address on your account; a request sent to our support address, joshua@thirdspaced.com, counts as well. We verify requests before acting on them, respond within 45 days (or the shorter period your law requires), and do not charge for them unless a request is manifestly unfounded or excessive. An authorized agent may make a request for you with your signed permission. If we decline a request, we explain why, and you may appeal by replying; we answer appeals in writing within 60 days.

8.1 Deleting your account

You can delete your account in the App, in the web player, or by writing to us (how to delete your account). Deletion removes your email address, name, password and sign-in links, your Plan record, your Credits and their history, any Beat Builder presets, your listening records, your saved listening sessions and your reports, and it ends every signed-in session. We keep these in our own systems: a closed record of the account without its email address or name, so that it cannot be recreated by mistake; the records of the Terms you accepted, as evidence of our agreement; the record of each credit pack you bought (the App Store, Google Play or Stripe transaction identifier, the product, its credits and its status), with its link to your account removed, so that the same purchase can never be credited to another account; the record of each App Store or Google Play subscription the account held (the store's transaction or purchase identifier, the product and its status), with the closed account record, because a store subscription can outlive the account and must never be taken over by a new one; if the account had a web trial, the one-way codes Section 2 describes, made from its email address and from the card that started the trial, so that each person gets one trial; and the records of the account's sign-in sessions (when each started and was due to expire, and the IP address and browser or device type it came from), which we keep as security records. For a Web Plan, our Stripe account also keeps the customer record (your email address, name and billing address) and the invoices, as records of the payments, for tax and accounting. Apple and Google keep the records of purchases made through them under their own policies. Deleting your account does not cancel a subscription billed by Apple or Google; cancel it in the store. Deleted information can remain in backups until they are overwritten in the normal course.

9. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy. In particular: account information while your account exists; sign-in sessions until they expire or you sign out, and the record of each one (when it started, and the IP address and browser or device type it came from) while your account exists and, after you delete it, as a security record, for which no end date is set yet; saved listening sessions until you delete them in the web player or delete your account (turning Keep my listening sessions off stops new ones); purchase and Credit records while your account exists; after you delete it, only what Section 8.1 describes: the credit-pack records, with their link to you removed, and the App Store and Google Play subscription records and the one-way trial codes, for which no end date is set yet, in our own systems, and, for a Web Plan, the customer record and invoices in our Stripe account, as records of the payments, for as long as tax and accounting law requires us to keep them (Apple and Google keep the records of purchases made through them under their own policies); Terms acceptance records as long as we may need to show what was agreed; support messages as long as needed to handle the matter; diagnostics and logs for the limited periods the providers' settings set. Information on your device stays until you sign out, clear it or remove the App.

10. If you are in the European Economic Area, the United Kingdom or Switzerland

Third Space LLC is the controller of your personal information, and eleMusic Inc. processes it for us. We rely on these legal bases: performance of our contract with you (accounts, playback, purchases); our legitimate interests (security, fraud prevention, fixing faults and improving the Service), balanced against your rights; your consent (marketing email, saved listening sessions), which you may withdraw at any time; and compliance with legal obligations (tax and accounting records). You have the right to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to withdraw consent, and to lodge a complaint with your local data protection authority. We process information in the United States, where the account service, its database and the audio are hosted, and some of the providers on the Subprocessors page may also process it in other countries, as that page says; where the law requires, transfers rely on the European Commission's standard contractual clauses or another lawful mechanism.

11. US state privacy rights

Depending on where you live, US state law may give you rights to know, access, correct and delete your personal information, to obtain a portable copy, to opt out of its sale, of targeted advertising and of certain profiling, and to appeal our decisions. We offer the requests in Section 8 to everyone. We do not sell or share personal information, use it for targeted advertising, or use sensitive personal information for purposes that carry a right to limit. California residents: in the past 12 months we collected the categories of information in Section 2 (identifiers, commercial information, internet activity and, for account sign-in, an email address with a hashed password) for the purposes in Section 4, disclosed them for business purposes to the recipients in Section 5, and sold or shared none of them. We do not discriminate against anyone for exercising these rights.

12. Children

The Service is not directed to children under 13, and you must be at least 13 to use it (16 in the European Economic Area and the United Kingdom); users under 18 need a parent's or guardian's permission. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, write to us and we will delete it.

13. Security

We and eleMusic use reasonable safeguards: encrypted connections, passwords stored only as one-way hashes, signed tokens that expire, private storage reached only through time-limited links, keys for Background Noises kept separate from the keys of eleMusic's own products, and access limited to people who need it. No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. If a security incident affects your personal information, we will notify you and the authorities as the law requires.

14. Emails

We send emails needed for the Service, such as sign-in and password links, receipts and notices about your account, purchases, security or changes to our terms; you cannot opt out of these while you have an account. We send marketing email only if you agreed to it with a separate checkbox, and every one has an unsubscribe link.

15. Changes to this policy

We may update this policy. When we do, we change the date and version at the top. If we make a material change, such as a new use or disclosure of personal information, we will tell you by email if we have your address and with a notice in the Service at least 30 days before it takes effect, unless the law or a security need requires a shorter period. Earlier versions are available on request.

16. Contact us

For questions about this policy or to make a privacy request: Third Space LLC, Attn: Privacy, 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801; email privacy@thirdspaced.com, or joshua@thirdspaced.com for anything else. The Contact page lists every way to reach us.