Privacy Policy

01 — Who we are

VoicePencil is operated by Verdorian Technologies LLC, a Tennessee limited liability company ("Verdorian," "we," "us"). Our mailing address is 200 Holland Dr, Apt J938, Clarksville, TN 37043, United States. For privacy questions, contact sm@verdorian.com.

02 — What we collect

VoicePencil does not require a conventional account or sign-in. It does use an installation identifier and related service records to operate AI limits and subscriptions.

Voice recordings and transcripts

When you record a note, its audio is created on your device. If you request transcription, audio is sent to Deepgram through our Supabase Edge Functions. If you use summaries, action items, Ask AI, transforms, Brain Gym, or organization tools, the necessary transcript or note text may be sent to OpenAI. The resulting note data is saved locally by the App. Processing providers may keep service logs under their own policies; do not include information in a note that you would not want processed to provide the feature.

Semantic search embeddings

When embedding processing is available, saved or updated note text can be queued in the background and sent through our backend to Voyage AI, even without a separate search action. Search queries can also be processed for relevance ranking. Returned embeddings are stored locally. New Voyage processing is currently paused on our backend; existing local notes remain available.

Install ID

On first launch we generate a pseudonymous install_id (a UUID) and store it on your device. The identifier and an installation credential are sent with service requests so we can enforce monthly usage caps, protect the service, and associate an installation with its subscription entitlement. It is not a public profile, but it is linked to usage and subscription records and should not be treated as anonymous.

Subscription status

If you purchase VoicePencil Pro through the App Store, Apple processes the transaction and RevenueCat returns entitlement information to the App and our service so paid features can be authorized. Apple handles payment details. RevenueCat and related service records can associate the entitlement with the installation ID. RevenueCat also provides subscription history and analytics so we can understand subscription activity. Its customer identifier is the same installation ID used by our service, not a separate anonymous account.

Crash and performance logs

The App and its services may generate technical diagnostics, such as app version, device/OS information, and error details, to investigate reliability and security. Sentry may receive error details, session and performance information when configured in a build. TestFlight build 16 does not provide a separate diagnostics opt-out; newer opt-in controls are not yet available in that build. We do not promise that diagnostics contain no personal information. Contact us about diagnostic records.

03 — What we do not collect

• No conventional account or advertising profile. There is no sign-up or login. A display name, if you add one, is stored locally and may be included in Ask AI requests so the assistant can address you by name. An email entered in Settings is stored locally for your own reference.
• No location permission. VoicePencil does not request location access to provide its features.
• No contacts access. Calendar access is optional. When granted, VoicePencil can read events for today and write calendar entries you choose to create. A photo is optional and is used only when you choose a profile image.
• No advertising identifiers (IDFA). We do not use App data for cross-app or cross-site advertising.
• No third-party advertising trackers. We do not use your App content for cross-app or cross-site advertising.

04 — How we use data

We use the data described in section 02 only to:

• Provide the requested features, including transcription, summaries, action items, semantic search, learning tools, and organization.
• Apply monthly limits, prevent abuse, and secure the services.
• Validate subscription entitlements purchased through the App Store.
• Understand subscription activity using RevenueCat history and analytics.
• Investigate reliability and security issues.

We do not sell personal information for advertising or use note content to create advertising profiles. Third-party processing is subject to the applicable provider terms and privacy policies.

05 — Third-party processors

The following companies process data on our behalf. Each is listed with what they receive and why.

• OpenAI, L.L.C. — receives the optional display name and text needed for summaries, action-item extraction, AI transforms, Ask AI, Brain Gym, and organization tools.
• Deepgram Inc. — receives raw audio files for speech-to-text transcription.
• Voyage AI — when enabled, receives note text and search queries for embeddings, including background note indexing.
• Supabase, Inc. — hosts Edge Functions that route AI requests and supports installation, usage-limit, and authorization records. A request may pass through this service to reach the relevant AI provider.
• RevenueCat, Inc. — manages subscription entitlement information associated with the App installation and Apple purchase.
• Apple Inc. — processes all in-app purchases and provides the App Store distribution channel. We receive no payment details from Apple.
• Sentry (Functional Software, Inc.) — may receive technical error and diagnostic information when used for reliability monitoring.
• Vercel Inc. — hosts this website and processes standard request metadata, such as IP address and user agent, to deliver and secure it.

06 — Retention

• Notes, transcripts, recordings, and embeddings: stored locally until removed. Creating an export or backup makes another copy; it does not remove the original.
• Installation, entitlement, and usage-limit records: retained as needed to operate the service, enforce limits, and protect against abuse. Monthly counters reset at the start of the next UTC month.
• Provider and service logs: retained according to the applicable provider or service policy. We do not make a blanket zero-retention promise for those processors.

07 — Your rights and controls

• Export local data: Settings → Data & Privacy → Export My Data. This creates a local export you can share or save.
• Delete local data: Settings → Data & Privacy → Delete All My Data. This deletes local app records after confirmation and attempts server-side deletion. Exported or shared files and some previously created files may remain; contact us if deletion fails.
• Control AI processing: Settings → AI Features → Enable AI Features. See section 04 for current TestFlight background-indexing limitations. Requests already sent to providers cannot be recalled.
• Revoke permissions: microphone, calendar, photos, notifications, and speech-recognition permissions can be managed in iOS Settings. Apple speech recognition may process speech using on-device or cloud services, depending on your device and Apple settings.

Delete All My Data is a local-device control. It does not promise immediate deletion of provider logs, exported files, device backups, or all service records. For a request about installation, subscription, or service-side data, email sm@verdorian.com with enough information for us to locate the relevant App installation.

08 — Security

We use technical and organizational measures intended to protect service requests and local data. AI provider keys are kept server-side, and AI requests are routed through Supabase Edge Functions rather than exposing those provider keys in the App.

No system is perfectly secure. If you discover a vulnerability, please email sm@verdorian.com with the details.

09 — Children's privacy

VoicePencil is not directed to children under 13. The App Store listing displays the applicable regional age rating. We do not knowingly collect data from children under 13 in the United States, or under 16 in the European Economic Area. We do not implement child-directed features such as targeted advertising. If you are a parent or guardian and believe a child has used VoicePencil and would like that data removed, email sm@verdorian.com.

10 — California privacy notice (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete that information, to correct inaccuracies, and to limit the use of sensitive information. The complete list of data we collect is in section 02 above; the controls to exercise these rights are in section 07.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is therefore no "Do Not Sell or Share My Personal Information" mechanism to provide — the answer is already "we do not."

11 — EU/UK privacy notice (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, the following additional notice applies.

• Controller: Verdorian Technologies LLC, the entity identified in section 01.
• Legal basis for processing: performance of a contract (GDPR Art. 6(1)(b)) for delivering the AI features you request; legitimate interests (Art. 6(1)(f)) for security, abuse prevention, and crash diagnostics. Where we rely on consent (Art. 6(1)(a)) — specifically for AI processing — you may withdraw it at any time as described in section 07.
• Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). The in-app controls described in section 07 apply to local data. For a request that requires service-side review, contact us at the address below.
• International transfers: our processors are predominantly based in the United States, and data may be processed outside your country. Applicable safeguards depend on the processor and agreement. Contact us for information about the safeguards relevant to your request; we do not represent that every processor uses the same transfer mechanism.
• Right to lodge a complaint with your local supervisory authority (e.g. ICO in the UK, CNIL in France, BfDI in Germany).

12 — Changes to this policy

We may update this policy to reflect product changes or legal requirements. The effective date at the top of the page is the source of truth. If we make a material change — for example, adding a new third-party processor or changing what we collect — we will update this page and, where appropriate, request new consent in the App before a new AI feature is used.

13 — Contact

Privacy questions, deletion requests, vulnerability disclosures, and supervisory correspondence: