Privacy Policy

Vox ("Vox", "we", "us", "our") provides a capture service: you record short voice notes, type notes, share screenshots and photos, or import notes from other apps, and Vox transcribes voice with automatic speech recognition, sorts the result with a classification service and, if you choose, sends the output to services you have explicitly connected (Google Docs, Google Calendar, Notion, Todoist or Slack). This Privacy Policy explains what information we collect, why, how we use it, who we share it with, how long we keep it, and the rights you have over it. By creating an account or using Vox you agree to this Policy.

Who we are

Vox is operated by Fernando Junior, an independent developer based in Brazil. The service is available worldwide. Contact: privacy@tryvox.app.

Information we collect

We collect only what is necessary to operate the service:

• Account information. When you sign in we receive your email address, your Google account display name (if you used Google Sign-In), and a Firebase user identifier. We do not store passwords; authentication is handled by Firebase Authentication.
• Audio recordings. When you capture a voice note, or share or import one (for example a WhatsApp voice note), the recording is uploaded to our servers and transcribed. Audio is encrypted in transit (HTTPS) and deleted from storage as soon as transcription completes, usually within seconds. We do not keep your recordings; only the resulting text transcript is retained.
• Transcripts and structured output. The text of your notes and the structured output (notes, tasks, reminders, people, projects, etc.) are stored in our Postgres database (Neon) so they can be shown in the app and, if you connected a service, sent to it.
• Screenshots and photos. Vox only sees the images you share with it or pick yourself; it never browses your gallery. The text in an image is read on your device: on your phone (Android) or in your browser (web). The original image stays on your device and is not uploaded. Vox stores the text it read, a small preview of the image (a thumbnail of at most 320 pixels on the long edge, about 30 KB) in Vercel Blob, and the image's dimensions and the date it was taken (when the image includes it) in our database (Neon). Previews are private and shown only to you through short-lived signed links. Vox tags what's in a picture on your phone; the image never leaves it. On Android, Vox labels what an image shows (for example "Food" or "Dog") with an on-device model and keeps those words with the note, along with the app a screenshot was taken in when its file name says so. On the web nothing is labeled: an image with no text is saved with its date, what its file name says and your caption, if you add one. A caption is always optional. You can delete every preview at any time with "Delete all image thumbnails" in Settings, Your data; your notes and their text stay. The one exception is Read with AI: only when you tap it on a photo (after a one-time explanation), that single photo is sent to Anthropic (Claude) to read its text and numbers, kept only in memory for that request, and deleted when it ends; it is never stored by Vox. What it read is added to your note.
• Links. When a note, share or import contains a web link, Vox's server (not your phone) opens the page once to read it, so the site sees a request from our server, not from you or your device. The request identifies itself with the user agent "VoxLinkPreview/1.0", carries no cookies or credentials, and asks for the page in your language. Vox only opens public web addresses (never private-network addresses), never signs in to any site, and reads at most the start of the page. For each link Vox stores in our database (Neon) the URL, the page title, a short description, facts the page publishes about itself (for example a price, an address, a cooking time or a video's channel) and an excerpt of up to 2,000 characters of its text; and, in Vercel Blob, a small preview of the page's image (at most 320 pixels, about 30 KB), shown only to you through short-lived signed links. Vox does not store the page itself. Some sites (for example Instagram or TikTok) only show a title or require a login; Vox keeps only what the public page shows. This text is used to sort and search your note like anything you say. Deleting the note deletes its link data and preview; "Delete all image thumbnails" also removes link previews; account deletion removes all of them. The preview of a shared link that you looked at before saving but never saved is deleted after 30 days.
• Imports. When you bring in notes from elsewhere, Vox reads only what you choose to import, and shows a preview before anything is saved. WhatsApp: your device reads the chat export and only your own messages are sent to Vox (in a chat with yourself, all of them); other people's messages are never sent or stored, and voice notes you include are transcribed like recordings. Strong and Hevy: the workout file you upload. Todoist: your open tasks, read through the Todoist connection you set up. Google Keep: the notes in the Google Takeout export you pick (trashed notes are skipped, and archived notes unless you include them). Email forwarding: when you turn it on, Vox gives you a private address and accepts mail only from your verified email address; it keeps the text of the message, not its attachments. Undoing an import deletes the notes it created.
• Calendar (Android, optional). If you turn on calendar nudges, the Android app reads your calendar on your phone, only to notice when a meeting ends and ask if you promised anything. Your calendar is not uploaded. If you record an answer, the meeting title and the attendees' names are sent with it so Vox can tell who a promise is for; attendees' email addresses are never stored.
• Health Connect (Android, optional). If you import from Health Connect, Vox reads your exercise sessions and the calories burned during them, only when you start an import. Each session becomes a workout note. Vox does not read other health data.
• Store reminders (Android, optional). If you turn on store reminders, you mark up to 5 of your own stores and Android checks, on your phone, when you arrive at or leave one, also when Vox is closed (background location). Your stores' locations stay on your phone: Vox's servers only learn that you visited one of your stores, never which one or where. Turn it off in Settings › Your stores in Vox, which deletes the stores you marked.
• Questions and answers. When you use Ask to query your captures, your question and the answer are stored so we can show your question history and avoid recomputing repeated questions. Answers are built from your own captures, using the search (OpenAI embeddings) and classification (TypeSafe AI) sub-processors listed below. We never use your questions or captures to train models.
• Device identifiers. Your Firebase Cloud Messaging (FCM) push token, platform (Android / macOS / iOS), and app version, used to deliver result notifications back to your device.
• Connector credentials. If you connect Vox to a third-party service (Google, Notion, Todoist or Slack), we store the OAuth access and refresh tokens for that service so we can send your captures there and, for Todoist, read your open tasks when you import them. Tokens are stored encrypted at rest.
• Usage metadata. Capture count, daily and monthly usage totals, timestamps of capture creation and routing results, used to enforce free-tier limits and to show you usage in the dashboard.
• Technical and security data. When you send a capture we record the request's IP address to enforce per-IP rate limits and detect abuse. These records are kept only briefly (automatically pruned, typically within a day) and are not linked to the content of your captures.
• Subscription state. If you subscribe to Vox Pro, we receive your subscription status (free/pro), expiration date and an opaque store identifier: from Google Play through RevenueCat when you subscribe in the Android app, and from Stripe webhooks when you subscribe on the web. Vox does not see or store payment card details; those stay with Google or Stripe.

How we use your information

• To run the capture pipeline: transcribe voice, sort what you say, share or import, and send the results to services you connected.
• To display your captures and account information in the Vox dashboard.
• To send you push notifications when a capture has been processed.
• To enforce daily, monthly, and per-capture quotas.
• To process subscription payments through Google Play or Stripe.
• To diagnose errors and prevent abuse (rate limits, fraud detection).

Google API services and limited use

When you connect a Google account, Vox requests the following OAuth scopes. We follow the Google API Services User Data Policy, including its Limited Use requirements:

• openid, email, profile: to identify the connected account.
• drive.file: to create a single Google Doc titled "Vox — Voice Notes" in your Google Drive and append your captures to it. This scope grants access only to files Vox itself creates; we cannot read or modify any other file in your Drive.
• calendar.app.created: to create calendar events when you speak time-bound reminders (for example, "dentist next Tuesday at 3 pm"). This scope only covers events Vox itself creates; we cannot read the rest of your calendar.

Google user data obtained through these scopes is used solely to provide the Vox features described above. We do not transfer it to third parties for advertising, do not allow humans to read it (other than for security investigations or with the user's explicit consent), and do not use it to train generalized AI / ML models.

Sub-processors

We share data with the following service providers, only to the extent necessary to operate Vox:

• Firebase / Google Cloud: authentication, push notifications.
• Vercel: application hosting, temporary audio storage until transcription, and image previews (thumbnails).
• Neon: managed Postgres database (your notes, the text read from images, and account data).
• Upstash: asynchronous job queue (QStash).
• OpenAI: speech-to-text transcription (Whisper) and text embeddings for search.
• Anthropic: reading one photo when you choose Read with AI on it. The photo is sent for that single request and is not used to train models.
• TypeSafe AI: a classification API provider that sorts each transcript (what kind of note it is, dates, people). It returns labels, not generated text. Zero data retention is only available on its enterprise plan, so transcript text sent for classification is handled under TypeSafe's standard retention terms.
• RevenueCat: subscription state synchronization.
• Stripe: payment processing for subscriptions bought on the web.
• PostHog (US): product analytics. We send pseudonymous usage events (page views, feature interactions, error counts) tied to your account ID. No transcripts, no audio, no recording content is ever sent.
• Sentry: error and crash reports from the apps and servers (technical details such as device, browser, app version, the failing request and the error message).
• Cloudflare: DNS and inbound email routing for our support, privacy and security addresses, and, when you enable email forwarding, receiving the emails you forward to your Vox address.

Each sub-processor is bound by their own privacy and security commitments. We do not sell your personal data and do not share it with advertisers.

International transfers

Vox is operated from Brazil and uses sub-processors based primarily in the United States and the European Union. By using the service you consent to your data being processed in those jurisdictions. We use the Standard Contractual Clauses where required.

Retention

Captures and their transcripts are retained until you delete them or your account. Audio recordings are deleted as soon as they are transcribed, not stored long-term. Image previews and the text read from images are kept with their note: deleting the note deletes its preview, "Delete all image thumbnails" removes every preview while keeping the text, and account deletion removes all of them. Undoing an import deletes the notes it created. Account deletion is processed within 7 days; backups are purged within 30 days. Aggregated, non-identifiable usage metrics may be retained longer for service-improvement purposes.

Your rights

Subject to applicable law (including the GDPR in the EU, the LGPD in Brazil, and the CCPA in California), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (full account deletion is available from the in-app settings).
• Export your data in a portable format (Markdown, with links to image previews and the text read from them).
• Withdraw consent for any optional data processing.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email privacy@tryvox.app. We will respond within 30 days.

Children

Vox is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Security

We use TLS for all data in transit and rely on the encryption-at-rest provided by our sub-processors. OAuth tokens and API keys are stored encrypted in our database. We follow the principle of least privilege when requesting OAuth scopes.

Changes to this Policy

We may update this Policy from time to time. Material changes will be announced via email or in-app notice at least 14 days before they take effect.

Contact

Questions, requests, complaints, or data-subject requests: privacy@tryvox.app.