Privacy policy

1. Controller and contact

The controller for this processing is:
Nikolaos Petliakis
Lange Str. 55/1
71332 Waiblingen, Germany
Email: n.petliakis@me.com

No data protection officer has been appointed.

2. What VoiceClue is — and what the app does not do

VoiceClue analyses voice messages and audio files that you actively hand to the app, and turns them into transcripts, summaries, tasks and assessments.

The app does not record anything itself: it does not request microphone access, it does not listen in, and it does not read chat histories. Only what you share or import is processed. The app contains no analytics, tracking or advertising software; your data is not used for advertising, not sold, and not tracked across apps or services.

3. A technical, pseudonymous account

The first time you use the app, it creates an account with a random identifier — without a name, email address or phone number; there is no registration. The identifier is used for authentication, abuse prevention and enforcing usage limits.

On Android you can voluntarily link this account to your Google account; a sign-in then takes the place of the purely pseudonymous account. Without that link, the random identifier remains. Linking is optional and is not required for any feature of the app except future sync across devices. Details are in section 17.

On iOS the app additionally computes a non-reversible SHA-256 hash of an identifier from your iCloud account and sends that hash with analyses. The hash is a lasting, pseudonymous recogniser: it makes your free quota survive a reinstall or a second device on the same Apple ID — and stops the free quota from being reset by deleting the account and creating a new one. The underlying iCloud identifier never leaves your device.

Legal bases: Art. 6(1)(b) GDPR (performance of a contract); for abuse prevention and protecting the quota, Art. 6(1)(f) GDPR (legitimate interest in a fair operation that covers its costs).

4. What happens during an analysis

When you have a voice message analysed, this is the path it takes:

1. The audio file is sent to our server over TLS (Supabase, data centre in Frankfurt am Main). Sent with it are the file name and the analysis settings: time zone, output language, language hints and your vocabulary — including sender names you have saved, so that names are spelled correctly in the transcript.
2. The server has the recording transcribed by Soniox, Inc. at the EU endpoint; processing takes place in the European Union. The file and the transcription job are deleted at Soniox as soon as the result has been fetched; if deletion exceptionally fails, our server keeps a retry list and completes the deletion automatically.
3. If Soniox cannot be reached, Mistral AI SAS (Paris, France) transcribes the audio file instead.
4. From the transcript, Mistral AI produces the summary, tasks, appointments and assessment. What is sent for that is the transcript, the sender name you assigned (if any), the time zone and the target language. If you later assign a sender to an analysis or rename one, the summary is generated once more from the transcript and the new name.
5. The finished result is held on our server until your app has fetched it; the app deletes it immediately after download. Independently of that, results are deleted automatically after 24 hours at the latest. Only you can access this record (row-level security). The uploaded audio file is never stored permanently on our server.

Neither we nor Soniox nor Mistral use your content to train AI models. Data-processing agreements are in place with both providers; at Mistral, use of API data for training is additionally switched off in the account settings, and at Soniox it is excluded by contract.

Purpose: providing the analysis you requested. Legal basis: Art. 6(1)(b) GDPR. Where recordings contain special categories of data, section 2 applies: responsibility for an exception under Art. 9(2) GDPR (usually the explicit consent of the person concerned) lies with you; we do not single out such information for evaluation.

5. What stays on your device

Analyses, summaries, tasks, transcripts, sender names and photos, waveforms, the search index and settings are stored locally on your iPhone. Kept voice messages sit AES-encrypted in a local vault; in Settings you can instead choose to delete each recording immediately after analysis. The rest of the local data is protected by iOS device encryption.

Voice profiles (iOS only, and only with your consent)

So that VoiceClue can recognise voices that come back, the app computes a voice profile from a voice message: a series of numbers from which the recording cannot be reconstructed and which contains no audio. The computation runs entirely on your device; audio is never sent to a server for speaker recognition. The profile is used only to match new messages to the senders you have named, inside your own collection; it is not compared with anyone else’s data.

A voice profile can uniquely identify a natural person and is therefore biometric data (Art. 4(14) GDPR). The legal basis is your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). Without an active yes, the app computes no voice profile. You are asked once, the first time you assign a sender to a message yourself; under Settings → Voice recognition you can view and change your answer at any time. Your answer is synced across your devices through your iCloud, so that another device does not ask again; the voice profiles themselves are not transferred. If you withdraw consent, the app stops computing and comparing voice profiles; profiles already learned stay on the device until you remove them via Settings → Delete all data. Processing that was lawful before the withdrawal remains lawful.

6. Questions about your notes

When you ask the app a question, it searches your transcripts on the device only. The search itself sends no data.

Who phrases the answer depends on your choice under “Settings → Ask”:

“On-device AI”: the answer is phrased by the local Apple Intelligence model; no data is sent. If your device does not support it, the app shows only the matching passages, without a phrased answer.

“Super-smart AI” (VoiceClue Pro only, the default): your question and the matching excerpts are sent to our server in the EU and from there to Mistral AI. If the on-device search does not produce a clear hit, an overview of all of your analyses is sent as well — for each entry, the date, sender name, title and the first roughly 140 characters of the summary (for very large collections, the newest 2,000 entries). An AI model picks from that the analyses that could answer your question; for those — six at most — the full transcript is then sent, and the answer is produced from it.

Without VoiceClue Pro: the answer is phrased by the local Apple Intelligence model. If it is not available on your device, the question and the matching excerpts (with title, date and sender name) are sent to our server and from there to Mistral AI. An overview of all analyses is not sent in that case.

Processing is solely for answering your question. Neither our server nor Mistral AI stores the question, the excerpts or the transcripts; the endpoints are stateless and keep no conversation history. Legal basis: Art. 6(1)(b) GDPR.

7. Optional iCloud sync

If you turn on “Sync via iCloud”, the app transfers your collection — analyses, transcripts, tasks, senders including any voice profiles, and encrypted audio files and photos — through Apple’s CloudKit into your own private iCloud database. The data sits with Apple in your account, not on a server of ours; we have no access to it. Content fields use CloudKit’s encrypted fields; VoiceClue encrypts audio files and photos itself again before upload. With Apple’s Advanced Data Protection (iOS Settings → iCloud), the contents are end-to-end encrypted and not readable by Apple either; without that setting, Apple can technically access the keys.

Some settings (language, retention choice, appearance, your vocabulary, the voice-recognition answer) are synced by the app through the key-value store of your iCloud.

Legal basis: Art. 6(1)(b) GDPR (providing the feature you turned on). Apple is responsible for iCloud: apple.com/legal/privacy

8. Service providers and transfers

For transfers to countries outside the EEA we rely on an adequacy decision of the European Commission — including the EU-US Data Privacy Framework — or on the European Commission’s Standard Contractual Clauses, supplemented by technical safeguards (transport encryption, pseudonymisation, short retention). You can request copies of the safeguards at the contact address above.

9. Subscriptions and purchases

Purchases are handled through the Apple App Store; Apple is the contracting party and the recipient of the payment. We do not receive full payment details. We use RevenueCat to manage Pro entitlement (see the table). Legal bases: Art. 6(1)(b) GDPR; for fraud prevention, Art. 6(1)(f) GDPR.

10. Notifications and Live Activities

So that your iPhone can fetch the finished result, and so that the analysis display (Live Activity / Dynamic Island) works, the app registers device tokens with the Apple Push Notification service and with our server. The push notifications themselves contain no analysis content — only a job number, the processing status, and the file name as the display title. Legal basis: Art. 6(1)(b) GDPR.

11. Retention and deletion

• Local content: until you delete it in the app, delete the app’s data, or uninstall the app.
• iCloud content: until deletion through VoiceClue, clearing sync, or removal in your Apple account. “Delete all data” also removes the iCloud copy when sync is on; if that fails for lack of a connection, the app retries the deletion automatically.
• Analysis results on the server: until your app fetches them, and after 24 hours at the latest (automatic cleanup every hour).
• At Soniox: the file and the transcription are deleted immediately after the result is fetched (with an automatic retry if deletion fails). Mistral requests run through stateless endpoints with no conversation history; the provider’s short-term retention follows the Mistral contract.
• Usage and rate-limit counters: 90 days at most.
• Push tokens: until they become invalid, and 90 days after the last refresh at the latest.
• Technical server logs (no content; pseudonymous identifiers, job numbers, status codes): under our backend provider’s rules, currently up to one day.
• Website access logs at Netlify: short-term; according to the provider, generally no longer than 30 days.
• Purchase and subscription data: stored by Apple and RevenueCat for their statutory and contractual periods.

Delete account (Settings → Delete account) removes your server-side record: the technical account together with quota, entitlement and push data. What remains is only: usage counters already running (90 days at most, see above) and the non-reversible iCloud hash as a deletion marker, so that the free quota cannot be reset by deleting the account and creating a new one (Art. 6(1)(f) GDPR). Deleting the account does not cancel a subscription — you manage that in your Apple account. Local data is not affected by account deletion; you delete it with “Delete all data”.

12. Your rights

Where the statutory conditions are met, you can request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.

Directly in the app:

• Settings → Export data produces a JSON file with your history, transcripts, summaries, tasks, appointments, sender names and settings (Art. 20). Not included are voice profiles (biometric characteristics of the people speaking, derived by the app and not provided by you), kept audio files and sender photos; the export file names these exclusions itself. You can obtain copies of the audio files or photos by asking, in any form.
• Settings → Delete all data removes history, kept voice messages, sender profiles including voice profiles and photos — and, when sync is on, the copies in your iCloud as well.
• Settings → Delete account — see section 11.

For anything else, a message in any form to n.petliakis@me.com is enough. For security we may ask for proof that the request comes from you; we reply within one month (Art. 12(3) GDPR).

You have the right to lodge a complaint with a data-protection supervisory authority — for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

13. Children

VoiceClue is not directed at children. Under our terms of use (German), use requires a minimum age of 16; we do not knowingly collect data from children under 16.

That limit is deliberate: from the age of 16 you can, in Germany, validly consent to data processing yourself under Art. 8 GDPR. This matters above all for consent to voice profiles (section 5), which must not take place without valid consent.

14. Data security

We use encrypted transport (TLS), pseudonymous account identifiers, access controls with row-level security, encrypted local storage of audio on iOS, and additional encryption for iCloud audio files. Access to the backend is limited to what is required. No technical measure can guarantee absolute security.

15. No automated decision-making

The AI evaluation produces content (transcript, summary, suggestions); it does not make a decision based solely on automated processing that has legal effect or similarly significant effect within the meaning of Art. 22 GDPR. AI results can be wrong — do not rely on them alone for anything important (more in the terms of use, in German).

16. Website

The website voiceclue.com is hosted by Netlify (see the table in section 8). When you open it, technical log data is processed in order to deliver the page and to keep it stable and secure (Art. 6(1)(f) GDPR). There are no analytics, marketing or advertising cookies, and no tracking.

17. Android-specific points

This section adds the points on which the Android app differs from the iOS app. Where this section does not say otherwise, everything above applies to Android unchanged.

No free-quota anchor. The iCloud-based identifier in section 3, which on iOS stops the free quota from being reset by deleting the account and creating a new one, has no equivalent on Android. Android has neither iCloud nor a comparable device-wide identifier for this — the Android app does not send any additional identifier of that kind.

Voice profiles on Android too — without syncing across devices. The consent-based voice recognition described in section 5 also exists on Android, on the same legal basis and computed on the device only. One difference: because Android has no iCloud, your consent answer is not synced across devices — if you use VoiceClue on another Android device, the app asks there again.

“Questions about your notes” on the server only. The on-device “Apple Intelligence” option described in section 6 does not exist on Android — it depends on a model that is part of iOS. On Android, every question that receives a phrased answer is therefore always sent to our server and from there to Mistral AI, to the same extent as under “Super-smart AI” or “Without VoiceClue Pro” in section 6. If the on-device search finds nothing and there is no connection, the app shows only the matching passages, without a phrased answer.

No push notifications. Android currently registers no device tokens and uses no push service; section 10 does not apply to Android. The app fetches the finished result only while it is open.

No sync across devices. The iCloud sync described in section 7 does not exist on Android; there is currently no way to match your collection between two devices, or between Android and iOS. Your collection stays on that device alone.

Optional sign-in with Google. In Settings you can voluntarily link the pseudonymous account from section 3 to your Google account. Your device then sends a signed sign-in token, through Google’s Credential Manager, to our auth service (Supabase, see the table in section 8); from that we store your email address and a Google identifier on your existing account. In the usual case your identifier stays the same — quota and purchase history move with it, and no second account is created. If the Google account already belongs to a VoiceClue account, the app signs you in there; the pseudonymous account previously created on this device is then no longer used. We receive no contacts, no content from your Google account, and no right to access it. Linking is optional; without it the app works unchanged, except that future sync across devices requires it. Legal basis: Art. 6(1)(b) GDPR (providing the feature you turned on). Google is responsible for the sign-in itself: policies.google.com/privacy

Purchases through Google Play. Purchases on Android are handled through Google Play; Google is the contracting party and the recipient of the payment. We do not receive full payment details. As on iOS, we use RevenueCat to manage Pro entitlement (see the table in section 8). Legal bases: Art. 6(1)(b) GDPR; for fraud prevention, Art. 6(1)(f) GDPR.

18. Changes

We update this policy when the app, the service providers or the law change. The version published here, with the date above, is the one that applies. This English text translates the German policy of the same date; if the two ever differ, the German version prevails.