This Privacy Policy explains how Lorem Software ("Lorem Software", "we", "us") collects, uses, stores, and protects information when you use the Voxxo mobile application ("Voxxo", the "App"). Voxxo is an AI-powered voice notes app that lets you record audio, transcribe it to text, generate AI summaries, translate notes, and (optionally) sync them across devices.
We designed Voxxo to be privacy-first: most of your data lives on your device. Cloud features are optional and only used when you sign in or subscribe to Voxxo Pro.
1. Who is the data controller?
Lorem Software
Owner / Founder: Mert Zeybek
Address: Değirmendere, Kuşadası, Aydın, Türkiye
Contact: info@loremsoftware.com
2. Information we collect
2.1 Information you provide
- Account information (only if you sign in): email address, display name, and an account identifier issued by Apple if you use Sign in with Apple. Apple Sign-In may return a private relay email; we use whatever email you choose to share.
- Profile preferences: language, default speech-to-text provider, and other in-app settings.
- Content you create: voice recordings, transcripts, translated text, AI summaries, folders, tags, and any text you type into a note.
- Support messages you send to info@loremsoftware.com.
2.2 Information collected automatically
- Subscription status from RevenueCat (whether you have an active Voxxo Pro entitlement, plan type, renewal status). We do not receive your full payment card or banking details — those stay with Apple.
- Diagnostic and crash logs (only if you have enabled Apple's "Share With App Developers" setting). These contain technical information about device model and OS version, not the content of your notes.
- Usage counters (e.g. seconds of speech-to-text used in the current period) to enforce free-tier limits and Pro entitlements.
2.3 Information we do not collect
- We do not access your contacts, photos, calendar, location, or browsing history.
- We do not embed third-party advertising SDKs and we do not use the App Tracking Transparency framework, because we do not track you across other companies' apps or websites.
- We do not collect your raw payment-method details.
3. How we use your information
| Purpose | What we use | Legal basis (GDPR) |
|---|---|---|
| Provide the core App: record, transcribe, summarize, translate, and (optionally) sync your notes. | Account info, content, preferences. | Performance of the contract you accept by using Voxxo. |
| Operate Voxxo Pro subscriptions and check entitlements. | RevenueCat customer ID, subscription status, usage counters. | Performance of the contract; legitimate interest in fraud prevention. |
| Improve reliability (e.g. fix crashes). | Aggregated, non-content technical logs. | Legitimate interest in maintaining a working product. |
| Respond to support requests. | Email address, message content. | Legitimate interest in helping our users. |
4. Voice, microphone, and speech recognition
Voxxo asks for microphone and speech-recognition permissions only when you start a recording. Recording is an explicit, user-initiated action — we never listen in the background.
Before any voice data leaves your device for cloud processing, Voxxo shows an explicit in-app consent dialog the first time you start a recording. The dialog names exactly what is sent (your audio recording and your transcript text) and the specific third-party services it is sent to (Deepgram, AssemblyAI, and Anthropic). No audio or transcript is transmitted to any third-party service until you tap Agree & Continue. If you tap Not now, recording does not start and no data leaves your device. The Welcome screen of onboarding additionally shows a short disclosure with links to this Privacy Policy. You can withdraw consent at any time by deleting the App or by contacting us.
- On-device transcription (default for free accounts): audio is processed by Apple's on-device speech recognition. Audio and transcripts stay on your device unless you choose to sync.
- Cloud transcription (Voxxo Pro, optional): audio is sent over an encrypted connection to our backend (Supabase Edge Functions in the Tokyo region) and forwarded to one of two third-party speech-to-text providers:
- Deepgram, Inc. — used for real-time streaming transcription. Data is processed solely to return a transcript and is not retained for model training under their enterprise terms (deepgram.com/privacy).
- AssemblyAI, Inc. — used for batch transcription with speaker separation (diarization). Data is processed solely to return a transcript and is not retained for model training under their enterprise terms (assemblyai.com/legal/privacy-policy).
- AI features (summaries, titles, tags, action items, edits, translations): when you trigger one of these features, the relevant transcript text (not the raw audio) is sent through our backend to Anthropic, PBC (the Claude API) solely to generate the requested output. Anthropic does not use API inputs or outputs to train its models (anthropic.com/legal/privacy).
We have data-processing agreements in place with each of Deepgram, AssemblyAI, and Anthropic that require them to provide the same or equivalent level of data protection as set out in this Privacy Policy, including confidentiality, security, and a prohibition on using your data to train AI models.
5. Where your data lives
- On your device: WatermelonDB (SQLite) stores all your notes, transcripts, and metadata locally. Audio files are stored in the App's sandboxed file system.
- In the cloud (only if you sign in and/or sync is enabled): Supabase project hosted in Tokyo, Japan. Data is encrypted in transit (TLS 1.2+) and at rest. Row-Level Security policies ensure that one user can never read another user's data.
- Apple: handles all in-app purchases. We never see your card details.
- RevenueCat: stores anonymized subscription state.
6. Sharing with third parties
We share information only with the limited set of processors required to operate Voxxo. Each processor is contractually required to provide the same or equivalent level of data protection set out in this Privacy Policy:
| Processor | Purpose | What is shared |
|---|---|---|
| Supabase Inc. | Database, authentication, storage, and edge functions. | Account info, notes, transcripts, audio files (only if you sign in / sync). |
| RevenueCat, Inc. | Subscription management. | Anonymized subscription state and customer ID. |
| Apple Inc. | Sign in with Apple, App Store payments, on-device speech recognition. | Apple-issued user identifier, transaction info. On-device speech stays on device. |
| Deepgram, Inc. | Cloud speech-to-text (real-time). Pro users only, when cloud STT is enabled. | Audio recording for transcription. Not retained for training. |
| AssemblyAI, Inc. | Cloud speech-to-text (batch with speaker diarization). Pro users only. | Audio recording for transcription. Not retained for training. |
| Anthropic, PBC | AI summaries, titles, tags, action items, edits, and translations (Claude API). | Transcript text only (no raw audio). Not retained for training. |
We do not sell, rent, or trade your personal data to anyone. We never share data with advertising networks.
7. International transfers
Because Voxxo is operated from Türkiye and uses cloud providers in Japan, the United States and the EU, your data may be transferred outside your country of residence. Where required (e.g. for EU/UK users), we rely on Standard Contractual Clauses or equivalent safeguards offered by our processors.
8. How long we keep your data
- Notes, transcripts, recordings: kept until you delete them or delete your account.
- Subscription records: kept as long as you have a Voxxo account, plus up to 7 years for tax/accounting compliance.
- Support emails: kept for up to 24 months after the conversation ends.
- Diagnostic logs: kept for up to 30 days.
9. Your rights
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data (you can edit your profile from Settings).
- Export your data (Settings → Export All Notes).
- Delete your account and all associated data (Settings → Delete Account, or see our Account Deletion page).
- Withdraw consent or object to processing.
- Lodge a complaint with your local data protection authority.
Send any request to info@loremsoftware.com. We respond within 30 days.
10. Children
Voxxo is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has used Voxxo, contact us and we will delete the data.
11. Security
We use TLS for all network traffic, row-level security in the database, scoped service tokens for backend functions, and Apple's secure enclave (via expo-secure-store) for credentials on device. No system is perfectly secure, but we follow industry best practices.
12. Changes to this policy
If we make material changes, we will update the "Last updated" date at the top and, where appropriate, surface a notice inside the App. Continued use after the change means you accept the updated policy.
13. Contact
Questions, requests, or complaints?
Mert Zeybek — Lorem Software
Değirmendere, Kuşadası, Aydın, Türkiye
info@loremsoftware.com