Privacy Policy

01 — Who we are

VoicePencil is operated by Verdorian Technologies LLC, a Tennessee limited liability company ("Verdorian," "we," "us"). Our mailing address is 200 Holland Dr, Apt J938, Clarksville, TN 37043, United States. For privacy questions, contact sm@verdorian.com.

02 — What we collect

VoicePencil has no user accounts, no sign-in, and no profile servers. The data listed below is the complete set we touch.

Voice recordings and transcripts

When you record a note, the audio file is created on your device. To transcribe it, we send the audio to Deepgram (and AssemblyAI when you import a YouTube video as a fallback). The transcript is then sent to OpenAI for summarization, action-item extraction, and other AI features. After processing, the transcript and summary are stored only on your device. We do not retain a copy on our servers.

YouTube imports

When you paste a YouTube URL into the Import feature, the URL is sent to Supadata (primary) or AssemblyAI (fallback) so the spoken content of the video can be transcribed. The same transcript-then-summarize pipeline applies as above.

Semantic search embeddings

When you opt in to semantic search, note text is sent to Voyage AI to generate vector embeddings used for relevance ranking. The embeddings are returned to your device and stored locally; they are not retained by Voyage beyond the API call.

Install ID

On first launch we generate a random install_id (a UUID) and store it on your device. This identifier is sent with every AI request so we can enforce monthly usage caps and rate limits. It is not linked to your name, email, Apple ID, or any other identity, and it is reset if you delete and reinstall the app.

Subscription status

If you purchase VoicePencil Pro through the App Store, Apple processes the transaction and RevenueCat returns your entitlement status to the app so we can unlock paid features. We do not see your payment details. We receive only the subscription state (active / trial / expired) keyed by the install ID above.

Crash and performance logs

If you have crash reporting enabled (default on), we send anonymized stack traces and device model / OS version to Sentry when the app crashes or hits an error. We strip user identifiers from these events before sending. You can disable this in Settings → AI & Privacy.

03 — What we do not collect

• No name or email. If you choose to enter your name or email in Settings (used to personalize summaries on-device), they are written only to local storage on your device. They are never transmitted to our servers or to any third party.
• No location data. Coarse location is only requested if you explicitly choose to geo-tag a note, in which case the coordinate is stored on your device with the note — not uploaded.
• No contacts, calendar content, or photos beyond what you explicitly add to a note (e.g. choosing a profile photo). Calendar permission is used only to write reminders you create from action items, never to read your calendar in bulk.
• No advertising identifiers (IDFA). We do not track you across apps or websites and do not enable Apple's App Tracking Transparency.
• No third-party advertising or analytics. No Facebook Pixel, Google Analytics, Mixpanel, Amplitude, or similar.

04 — How we use data

We use the data described in section 02 only to:

• Provide the core features of the app (transcription, summarization, action items, semantic search, learning tools).
• Enforce monthly usage caps and per-hour rate limits so paid AI providers cannot be drained by abuse.
• Validate Pro entitlements purchased through the App Store.
• Diagnose crashes and bugs (anonymized).

We do not use your data for advertising, profiling, or any model training. None of our third-party AI providers use your VoicePencil content to train their models under the contracts we have with them.

05 — Third-party processors

The following companies process data on our behalf. Each is listed with what they receive and why.

• OpenAI, L.L.C. — receives transcripts for summarization, action-item extraction, AI transforms, and ask-AI queries. Bound by their API data policy (no training on inputs).
• Deepgram Inc. — receives raw audio files for speech-to-text transcription.
• Voyage AI — receives note text to generate vector embeddings for semantic search.
• AssemblyAI Inc. — fallback transcription provider for YouTube imports when the primary fails.
• Supadata — primary YouTube transcript provider.
• Supabase, Inc. — hosts the Edge Functions that proxy requests to the AI providers. Stores only the install_id, monthly usage counters, and a short-lived transcript cache for YouTube imports. No PII.
• RevenueCat, Inc. — manages subscription state. Receives the install_id and Apple receipt; returns entitlement.
• Apple Inc. — processes all in-app purchases and provides the App Store distribution channel. We receive no payment details from Apple.
• Sentry (Functional Software, Inc.) — receives anonymized crash reports if enabled.
• Vercel Inc. and Cloudflare, Inc. — serve the marketing website you are reading now. They log standard request metadata (IP, user agent) as required to operate a web service.

06 — Retention

• Notes, transcripts, embeddings: stored on your device until you delete them or delete the app.
• install_id and monthly usage counters (on Supabase): retained while you use the app. Usage counters reset on the first of each month. You can reset the install_id at any time by deleting and reinstalling the app.
• YouTube transcript cache (on Supabase): 30 days, then automatically purged. Keyed by video ID, not by install_id.
• AI provider logs: retained by the provider per their own policies. OpenAI: up to 30 days for abuse monitoring; Deepgram, Voyage, AssemblyAI, Supadata: see their respective privacy policies.
• Crash reports: 90 days in Sentry.

07 — Your rights and controls

• Delete all data: Settings → AI & Privacy → Delete All Data. This wipes all notes, embeddings, and local preferences and removes your install_id's usage record from Supabase.
• Export your notes: Settings → AI & Privacy → Export Data. Produces a structured JSON file of every note, transcript, and action item.
• Disable AI processing: Settings → AI & Privacy → Disable AI. Stops all communication with third-party AI providers; the app continues to work for basic note-taking without summaries or action-item extraction.
• Revoke AI consent: Settings → AI & Privacy → Revoke Consent. You will be re-prompted before the next AI action.
• Disable crash reporting: Settings → AI & Privacy → Crash Reports.
• Revoke permissions: microphone, calendar, photos, and location permissions can be revoked at any time in iOS Settings.

If you cannot exercise a right through the app, email sm@verdorian.com with your install_id (found in Settings → About) and we will action your request within 30 days.

08 — Security

All network traffic between the app, our Edge Functions, and AI providers is encrypted with TLS 1.2+. We never embed third-party API keys in the app binary; every AI call is brokered server-side through our Supabase Edge Functions, which authenticate using the Supabase platform's JWT verification. We follow the principle of least privilege for our backend service-role keys and rotate them periodically.

No system is perfectly secure. If you discover a vulnerability, please email sm@verdorian.com with the details. We will respond within 5 business days.

09 — Children's privacy

VoicePencil is rated 4+ on the App Store. We do not knowingly collect data from children under 13 in the United States, or under 16 in the European Economic Area. We do not implement child-directed features such as targeted advertising. If you are a parent or guardian and believe a child has used VoicePencil and would like that data removed, email sm@verdorian.com.

10 — California privacy notice (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete that information, to correct inaccuracies, and to limit the use of sensitive information. The complete list of data we collect is in section 02 above; the controls to exercise these rights are in section 07.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is therefore no "Do Not Sell or Share My Personal Information" mechanism to provide — the answer is already "we do not."

11 — EU/UK privacy notice (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, the following additional notice applies.

• Controller: Verdorian Technologies LLC, the entity identified in section 01.
• Legal basis for processing: performance of a contract (GDPR Art. 6(1)(b)) for delivering the AI features you request; legitimate interests (Art. 6(1)(f)) for security, abuse prevention, and crash diagnostics. Where we rely on consent (Art. 6(1)(a)) — specifically for AI processing — you may withdraw it at any time as described in section 07.
• Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). Most are exercisable directly in the app; for any you cannot resolve there, contact us at the address below.
• International transfers: our processors are predominantly based in the United States. Transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework where applicable.
• Right to lodge a complaint with your local supervisory authority (e.g. ICO in the UK, CNIL in France, BfDI in Germany).

12 — Changes to this policy

We may update this policy to reflect product changes or legal requirements. The effective date at the top of the page is the source of truth. If we make a material change — for example, adding a new third-party processor or changing what we collect — we will surface an in-app notice the next time you open VoicePencil and update the AI consent version so you can review and re-accept.

13 — Contact

Privacy questions, deletion requests, vulnerability disclosures, and supervisory correspondence: