Privacy policy
Draft, pending legal review. This text may change before VoText launches.
This policy explains what VoText does with your data when you use the VoText app for iPhone and iPad and this website. The short version comes first; the details follow.
In short
- Your recordings, transcripts and read-aloud audio are stored on your device, not by us.
- When you ask VoText to transcribe audio or read text aloud, that audio or text passes through our servers to one AI service. Our servers delete it within 24 hours of the result.
- The app names the AI services and asks for your permission before anything leaves your device.
- You can use VoText without an account. We show no ads, use no tracking tools and never sell your data.
Who is responsible
VoText is provided by [To be filled in by the owner: legal name of the data controller], [To be filled in by the owner: registered address] (“we”, “us”). We are the controller of the personal data described here.
- Company registration: [To be filled in by the owner: company registration number (MERSİS)]
- Email: support@votext.app
- Representative in the European Union: [To be filled in by the owner: EU representative (GDPR Art. 27)]
- Representative in the United Kingdom: [To be filled in by the owner: UK representative (UK GDPR Art. 27)]
What stays on your device
Recordings, transcripts, your edits, exported files and read-aloud audio are saved inside the app on your iPhone or iPad. We do not store them on our servers and we do not sync them. Audio files are excluded from iCloud Backup. Other app data can be part of your device backup, which Apple handles under your Apple Account.
If you delete the app without exporting, your transcripts are gone. We cannot restore them, because we never had them.
What we process and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Audio you send for transcription, with its length and format | To create your transcript | Contract (Art. 6(1)(b)) |
| Text you send to be read aloud | To create the audio | Contract (Art. 6(1)(b)) |
| The results: transcript text and generated audio | To deliver them to your device | Contract (Art. 6(1)(b)) |
| A random account ID created on first launch, and sign-in tokens | To keep your credits and purchases separate from everyone else’s | Contract (Art. 6(1)(b)) |
| Your email address and one-time sign-in codes, if you sign in with email | To sign you in and let you keep your credits on other devices | Contract (Art. 6(1)(b)) |
| The identifier Apple gives us and the email address Apple shares (which can be a private relay address), if you use Sign in with Apple | To sign you in | Contract (Art. 6(1)(b)) |
| Purchase records from Apple: transaction and product IDs, dates, renewal and refund status. Never your card details | To add credits, handle renewals and refunds, and keep accounts | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for accounting |
| Credit records: balance, credits reserved and charged per job, job type, length, language, which AI service handled it and whether it succeeded | To charge correctly, never twice, and to answer support questions | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in controlling costs |
| Device attestation data from Apple (an App Attest key identifier and signed checks, or a DeviceCheck token) | To confirm that requests come from the real app on a real device, and to give starter credits only once per device | Legitimate interests (Art. 6(1)(f)) in preventing fraud and abuse |
| Your choice about AI services: yes or no, the version of the list you saw, and when | To respect and prove your choice | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Server logs: IP address, time, type of request, app version and error codes | To keep the service secure, stop abuse and fix errors | Legitimate interests (Art. 6(1)(f)) |
| Messages you send us | To answer you | Contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)) |
Server logs never contain your audio, text, transcripts or email address.
Before the app sends any audio or text to an AI service, it asks for your permission and names the services. You can withdraw that permission at any time in Settings, AI providers and privacy. Where the law of your country requires consent for this, for example for some transfers abroad, we rely on that permission (Art. 6(1)(a) GDPR). If you say no, VoText still records, keeps and exports your files, reads text with your device’s own voice, and on supported devices transcribes some languages on the device.
What we do not do
- We do not show ads and do not use advertising identifiers.
- We do not include analytics or tracking tools in the app or on this website.
- We do not access your location, contacts or photos.
- We do not sell your data or share it for advertising.
- We do not use your audio, text or transcripts to train AI models, and the AI services we use may not use our requests to train theirs: we only choose plans whose terms rule that out, free plans included, and where a service trains on data unless the customer opts out, we have opted out for our account.
AI services and other providers
To transcribe and read aloud, VoText uses Soniox, xAI, ElevenLabs, Google, and Groq. Which one handles a request depends on the language and the task. Our servers are run by Railway, sign-in emails are sent by Resend, and this website is hosted by Netlify. The full list of service providers says what each one receives and links to its privacy policy.
These companies process data only to do the job for us, under data processing terms. Some keep data for a limited time under those terms, for example to detect abuse, and then delete it.
Apple handles payments, Sign in with Apple and device checks as an independent company under its own privacy policy. We receive only the records described above.
This website
votext.app is hosted by Netlify. It sets no cookies and runs no analytics. Netlify processes visitors’ IP addresses in its server logs to deliver the site and protect it from attacks.
Transfers outside your country
Our servers are hosted by Railway in [To be filled in by the owner: hosting region]. The AI services and other providers are based in the United States, and data can be processed there or in other countries where they operate.
When data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where needed), or on the EU-US Data Privacy Framework where the provider is certified under it. For users in Türkiye, transfers abroad follow Article 9 of the Personal Data Protection Law No. 6698 (KVKK), using standard contracts notified to the Personal Data Protection Authority or another safeguard the law allows. You can ask us for a copy of the relevant safeguards.
How long we keep data
| Data | How long |
|---|---|
| Audio and text you send, and the results | While the job runs, then deleted from our servers within 24 hours after it finishes, fails or is canceled |
| Account ID, credit records and your choice about AI services | Until you delete your account |
| Email address or Apple identifier | Until you delete your account |
| Sign-in codes | Stored only as a one-way hash and valid for 10 minutes |
| Purchase records | [To be filled in by the owner: statutory retention period], as tax and accounting law requires, also after you delete your account |
| A one-way fingerprint of the device attestation key | Kept after account deletion, so starter credits cannot be claimed again on the same device. It says nothing else about you |
| Server logs | [To be filled in by the owner: number of days] days |
| Messages to support | As long as needed to handle your request and any follow-up |
Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time without affecting what happened before.
- Delete your account: in the app, or by email. How to delete your account and data.
- Everything else: email support@votext.app. We answer within one month. We may ask you to confirm that the account is yours before we act.
You can also complain to a data protection authority: in the EU, the authority in your country (list of EU authorities); in the UK, the Information Commissioner’s Office; in Türkiye, the Personal Data Protection Authority (kvkk.gov.tr). We would appreciate the chance to fix things first.
VoText makes no decisions about you based solely on automated processing that have legal or similarly significant effects.
Notice for users in Türkiye (KVKK)
This section is our notice under Article 10 of the Personal Data Protection Law No. 6698 (KVKK).
- Data controller: [To be filled in by the owner: legal name of the data controller], [To be filled in by the owner: registered address]. Tax details: [To be filled in by the owner: tax office and tax number]. VERBİS: [To be filled in by the owner: VERBİS registration status].
- Purposes: the purposes in the table above: providing transcription and read-aloud, managing accounts, credits and purchases, preventing fraud, keeping the service secure and meeting legal obligations.
- Legal reasons (KVKK Art. 5): processing is necessary to perform the contract with you (Art. 5(2)(c)), to comply with legal obligations (Art. 5(2)(ç)), and for our legitimate interests without harming your fundamental rights (Art. 5(2)(f)). Where the law requires it, we rely on your explicit consent (Art. 5(1)).
- Method of collection: electronically, through the app and this website.
- Recipients: the service providers listed on the service providers page, most of which are abroad, under Article 9 of KVKK as described above; and public authorities when the law requires.
- Your rights (KVKK Art. 11): to learn whether your data is processed; to request information about it; to learn the purpose and whether it is used for that purpose; to know the third parties it is transferred to in Türkiye or abroad; to request correction of incomplete or inaccurate data; to request deletion or destruction under Article 7; to request that correction or deletion be notified to those third parties; to object to a result against you that comes solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
- How to apply: in writing to the address above, by registered electronic mail (KEP) to [To be filled in by the owner: KEP address], or by email to support@votext.app from the address registered with your account, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer within 30 days, free of charge unless the law allows a fee.
Children
VoText is not directed to children under 13, and we do not knowingly collect their data. If you are under 16, or under the age of digital consent where you live, use VoText only with a parent’s permission. If you believe a child has given us personal data, email us and we will delete it.
Security
Data travels encrypted between the app, our servers and our providers. Audio and text on our servers are stored only temporarily and deleted on schedule. Keys for the AI services exist only on our servers, never in the app. Access to our systems is limited to what each task needs and is logged.
Changes to this policy
If we change this policy, we update the date at the top. If a change matters to how your data is used, we tell you in the app before it applies. If the list of AI services changes, the app asks for your permission again before sending anything to a new service.
Contact
Questions about privacy: support@votext.app.