Privacy Policy

1. Who We Are

VoxZen ("we", "us", "our") operates an AI-powered communication coaching mobile application. We are committed to protecting your personal data and respecting your privacy rights.

For the purposes of applicable data protection laws, VoxZen acts as the data controller for personal information collected through the App. Questions: privacy@voxzen.app

2. Information We Collect

• Account information: email address, display name, password (stored as a salted hash)
• Onboarding profile: communication style, challenges, identity descriptor, primary goal, daily practice goal
• Voice recordings: when you use speech analysis or voice coaching features (processed in real-time, not stored permanently)
• Text inputs: questions, responses, and messages sent to Nova AI Coach

• Usage data: lessons completed, XP earned, streak counts, session duration, features used
• Device information: device type, operating system version, app version
• Push notification tokens: when you grant notification permission
• Crash and error reports: anonymized technical data

3. How We Use Your Information

• Creating and managing your account
• Personalizing your learning journey based on your goals and communication style
• Providing AI coaching responses tailored to your progress
• Tracking your progress, XP, streaks, and achievements
• Delivering push notification reminders (if enabled)

• Analyzing aggregated, anonymized usage patterns to improve content quality
• Identifying technical issues and improving app performance

• Verifying your identity and preventing fraud
• Complying with legal obligations
• Enforcing our Terms of Service

4. Legal Basis for Processing (GDPR)

If you are located in the European Union, United Kingdom, or European Economic Area, we process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide the Service
• Legitimate interests: Analytics, service improvement, fraud prevention, and security
• Consent: Voice processing, marketing communications, and optional analytics
• Legal obligation: Compliance with applicable laws and regulations

5. India — DPDP Act 2023

If you are located in India, the Digital Personal Data Protection Act 2023 (DPDP Act) governs how we process your personal data.

We process your personal data based on your consent. By creating a VoxZen account and using the Service, you provide informed, specific, and unambiguous consent to the processing described in this policy.

• Right to Access: Request information about the personal data we hold about you
• Right to Correction & Erasure: Request correction or deletion of personal data
• Right to Grievance Redressal: Raise a grievance — we acknowledge within 48 hours and resolve within 15 business days

Grievance Officer (India): privacy@voxzen.app — Subject: DPDP Grievance

6. Voice & Audio Data

• Collection: Recordings captured only when you actively initiate a voice feature
• Transmission: Audio transmitted using TLS 1.3 encryption
• Processing: Transcribed via OpenAI's Whisper API; analyzed for communication metrics in real-time
• Retention: Voice recordings are NOT stored permanently — deleted immediately after transcription (within minutes)
• No training: Your voice recordings are never used to train AI models without your explicit written consent

7. Data Sharing & Third Parties

We do not sell, trade, or rent your personal information to third parties. We share your data only with service providers:

• Supabase Inc. — database hosting and authentication
• OpenAI, L.L.C. — AI language model and speech processing
• RevenueCat, Inc. — subscription management
• Expo (Meta Platforms) — push notification delivery

All service providers are contractually bound to process your data only on our instructions. We never share your voice recordings, coaching conversations, or personal messages with advertisers or data brokers.

8. Data Retention

• Account data: Retained for the lifetime of your account, plus 30 days after deletion request
• Coaching conversations: Retained for up to 12 months, then automatically deleted
• Voice recordings: Deleted immediately after processing (within minutes)
• Voice transcripts: Retained for up to 90 days
• Payment records: Retained for 7 years to comply with financial regulations
• Deleted accounts: All personal data deleted within 30 days of account deletion request

9. Your Privacy Rights

• Right to Access: Request a copy of the personal data we hold
• Right to Correction: Request correction of inaccurate data
• Right to Deletion: Use "Delete Account" in app settings
• Right to Portability: Request your data in machine-readable format

• Right to Object to processing based on legitimate interests
• Right to Lodge a Complaint with your local supervisory authority

To exercise your rights: privacy@voxzen.app — we respond within 30 days.

10. Children's Privacy

VoxZen is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe your child has created an account, contact privacy@voxzen.app — we will delete the account and all associated data within 72 hours.

11. Data Security

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Row-Level Security (RLS) — users can only access their own data
• Salted password hashing
• JWT-based authentication with short-lived tokens

In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

12. International Data Transfers

VoxZen operates primarily in the United States. If you access the Service from outside the United States, your personal information may be transferred to and processed in the United States. For transfers from the EU/EEA/UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident:

• Right to Know what personal information we collect
• Right to Delete your personal information
• Right to Correct inaccurate information
• Right to Opt-Out of Sale — WE DO NOT SELL personal information

To submit a request: privacy@voxzen.app with subject "California Privacy Request". We will respond within 45 days.

14. Cookies & Tracking

VoxZen is a native mobile application and does not use browser cookies. We use AsyncStorage to cache app settings locally on your device. We do not use cross-app tracking technologies and do not participate in advertising ecosystems.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will display a prominent notice within the App for at least 30 days, send an email notification to your registered address, and update the "Last updated" date at the top of this policy. Your continued use after the effective date constitutes your acceptance.

16. Contact & Data Requests

Privacy inquiries: privacy@voxzen.app — Subject: [Privacy Request] - [Your Request Type]

General support: support@voxzen.app

Delete your account: Profile → Settings → Account → Delete Account (all data deleted within 30 days)

We acknowledge requests within 5 business days and complete them within 30 days.