VoIQ — Real-time AI Meeting Copilot

1. Introduction

VoIQ (“VoIQ”, “we”, “us”, or “the App”) is a real-time AI conversation copilot for iOS. The mobile app captures audio from your device microphone, streams it for transcription, and uses a language model to suggest short, actionable responses while you are in a conversation. This Privacy Policy explains what we collect, what we deliberately do not collect, why, how it is processed, who else is involved, and the controls you have.

By installing or using VoIQ, you agree to the practices described below. If you do not agree, please do not use the App.

2. Information We Collect

We collect the minimum amount of data required to operate the service:

Account data. Your email address (used for one-time-password sign-in via Supabase), a display name (required at first sign-in so we can address you in the app), the Supabase user ID, and timestamps for account creation and updates.
Session metadata. When you start a session we record the session start time, the end time, and the owning account. We use this to meter credit consumption. We do not record the audio or the resulting transcript.
Credit balance and ledger. Your current credit balance (in seconds) and an append-only ledger of every grant and spend, with reason, amount, timestamp, and an optional reference to the session that consumed it. This is required to operate a pay-as-you-go billing model.
Purchase records. When you buy a credit pack through Apple’s in-app purchase system, Apple sends us a signed transaction record. We store the signed payload, the Apple transaction identifier, the SKU you bought, the credit amount granted, and a validation timestamp. We use this both to credit your account and to handle refund or dispute requests later. We never see your payment card or Apple ID.
Diagnostic logs. Standard HTTP request logs (method, path, response code, IP address, user agent, timing) and application warnings/errors, captured by our backend logger. Authorization headers, password fields, and access tokens are redacted before the log line is written. Logs are retained for approximately 30 days.
Advertising analytics. To measure whether our ads work, the App uses the Meta (Facebook) SDK to report standard app events to Meta — install, app open, and completed purchases (the pack, price, and currency; never any conversation content). On iOS this is gated by the App Tracking Transparency permission: if you decline, no device advertising identifier is shared and Meta receives only aggregated, anonymized signals.

3. Information We Do NOT Collect or Retain

A core design decision of VoIQ is that the contents of your conversations never reach our servers. Specifically:

Raw audio never touches a VoIQ server. The microphone stream goes directly from your device to AssemblyAI over a TLS connection authenticated with a short-lived token we mint for you.
Transcript text is not stored. AssemblyAI returns transcribed turns to your device only. The text lives briefly in app memory so VoIQ can show it on screen and so the most recent turns can be sent to the language model to generate a suggestion. Once you end the session, the transcript is gone.
AI-generated suggestions are not stored. The language model’s reply streams to your device and is held only in app memory for the lifetime of the session.
Payment instrument details are never visible to us. All charging is handled by Apple.

4. How We Use Your Information

The data described in Section 2 is used only for:

Authenticating you via email-OTP sign-in.
Setting up the secure connection between your device and AssemblyAI so the App can transcribe in real time.
Generating short AI suggestions during your conversation, based on the recent transcript that your device sends with each request.
Validating Apple in-app purchases, granting the corresponding credits, and metering credit consumption across sessions.
Keeping the service operational, secure, and free of abuse (rate limiting, fraud detection, error monitoring).
Measuring whether our advertising works, strictly as described in Section 2 — never using conversation content.

5. Microphone and Audio

VoIQ accesses the microphone only after you explicitly grant permission and only while a session is active. The app shows a clear listening indicator whenever audio is being captured.

Audio is streamed over an encrypted connection (TLS) directly from the App to AssemblyAI using a short-lived token (typically 120 seconds) minted by our backend. Our backend never receives or proxies the audio bytes. AssemblyAI’s handling of that audio — including any temporary buffering they perform to produce a transcript — is governed by their own privacy policy at assemblyai.com/privacy-policy.

You can revoke microphone permission at any time in iOS Settings → VoIQ → Microphone. If you revoke it, VoIQ can no longer transcribe and the App will let you know it has no audio input.

6. Credit Balance and In-App Purchases

VoIQ uses a pay-as-you-go credit model. New accounts receive a small free credit grant (currently 2 minutes) the first time they sign in. Additional credit packs are sold through Apple’s in-app purchase system. Apple processes the payment and returns a signed transaction record to the App, which forwards it to our backend for verification with Apple’s App Store Server API.

Once verified, we record the purchase, grant the corresponding credits, and write a row in the credit ledger. The signed transaction record is retained as a tamper-evident audit artifact for the longer of (a) seven years, for tax and accounting compliance, or (b) the lifetime of your account plus any applicable dispute window.

Refund requests must be submitted to Apple. If Apple notifies us that a transaction was refunded, we record the refund in the ledger; we do not attempt to claw back credits that have already been consumed before the refund notification arrives.

Credits are consumable, do not expire, and are not transferrable between accounts.

7. Third-Party Sub-processors

We rely on a small set of vendors to operate the service. Each is bound by their own terms and only receives the data needed to perform their function:

Supabase — email one-time-password authentication. Supabase stores your email address and the authenticated session token. It does not store your transcripts, sessions, credits, or any other application data.
AssemblyAI — real-time speech-to-text transcription of your microphone audio. AssemblyAI receives the audio stream directly from your device.
OpenRouter — routes prompts to large language models (currently Google Gemini variants) so the App can produce suggestions during your conversation. OpenRouter receives the recent transcript turns sent with each suggestion request, but not the audio.
Apple App Store — handles in-app credit purchases and provides us with signed transaction records.
Meta Platforms — advertising measurement. The Meta SDK inside the App reports the install, app-open, and purchase events described in Section 2 so we can attribute installs and purchases to our ads, subject to your App Tracking Transparency choice on iOS.
Hosting and infrastructure providers — cloud infrastructure used to run the VoIQ backend and Postgres database that hosts the data described in Section 2.

8. Data Storage and Security

Account data, session metadata, credit balances, the credit ledger, and purchase records are stored in a Postgres database operated by VoIQ. Authentication is handled by Supabase Auth, which stores your email and session token in its own systems.

All network traffic between the App and our backend uses HTTPS or WSS with TLS. Supabase access tokens are verified server-side via JWKS on every request; tokens never appear in our logs. The AssemblyAI API key never leaves our backend — the App only ever sees a short-lived, per-user token. Apple in-app purchase receipts are cryptographically verified against Apple’s App Store Server API before any credit is granted.

No system can guarantee absolute security, but we follow industry-standard practices to limit access, monitor for misuse, and recover from incidents.

9. International Data Transfers

Our backend, database, and sub-processors are operated in regions that may be outside your country of residence (typically the United States or European Union, depending on the provider). If you access VoIQ from a region with data-protection rules — such as the European Economic Area, the United Kingdom, or Brazil — you understand that your data will be transferred to and processed in those regions. Where required, transfers rely on lawful safeguards (such as the European Commission’s Standard Contractual Clauses with our sub-processors).

10. Data Sharing

We do not sell, rent, or trade your personal data. We share data only:

With the sub-processors listed in Section 7, strictly to provide the service.
With Meta Platforms, for advertising measurement only, as described in Sections 2 and 7 and subject to your iOS tracking permission.
When required by law, valid legal process, or to protect the rights, property, or safety of VoIQ or our users.
In connection with a merger, acquisition, or sale of assets — in which case we will notify you and ensure the receiving party is bound by terms at least as protective as this Policy.

11. Data Retention

We retain the data we collect for the following periods:

Account data — for the life of your account. Deleted when you request account deletion.
Session metadata — for the life of your account.
Credit balance and ledger — for the life of your account. The ledger is append-only so individual entries are never edited, even after a refund.
Purchase records — the longer of (a) seven years from the transaction date, for tax and accounting compliance, or (b) the life of your account plus any applicable dispute window.
Diagnostic logs — approximately 30 days.
Audio, transcripts, AI suggestions — not retained. See Section 3.

12. Your Rights and How to Exercise Them

Depending on your location, you may have the right to access the personal data we hold about you, correct inaccurate information, delete your account and associated data, object to or restrict certain processing, request a copy of your data in a portable format, and withdraw consent for microphone access at any time.

You can exercise the display-name correction right directly inside the App (Settings → Display name). For everything else — access, deletion, restriction, portability, complaints — email us at the address in Section 15 from the email address attached to your account. We respond within 30 days under the GDPR and the LGPD, and within 45 days under the CCPA.

You can also delete your account directly via the Account Deletion page on this site, without contacting us first. Deletion removes your account data, session metadata, and credit balance. The credit ledger and purchase records may be retained in anonymized form to satisfy our tax and accounting obligations described in Section 11.

13. Children’s Privacy

VoIQ is not directed at children under 13 in the United States, under 16 in the European Economic Area, or the equivalent minimum age in your jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app and reflected in the effective date at the top of this page. Continuing to use the App after an update means you accept the revised policy.

15. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise any of the rights described in Section 12, please contact us at comercial@morya.tech.