1. Information We Collect

Account Information

When you create an account, we collect your email address, display name, and authentication credentials. If you sign in with a third-party provider (e.g., Google, Apple), we receive your name and email from that provider.

User-Generated Content

• Journal entries and reflections
• Goals and checkpoint progress
• AI coach conversations
• Mindset and preference selections

Usage Data

• Session activity (duration, features used)
• Music and soundscape preferences
• Device type, browser, and operating system
• Interaction patterns to improve the experience

Push Notification Tokens

If you enable push notifications, we store your device push token to deliver reminders and updates. You can disable notifications at any time through your device settings.

Payment Information

Payment details (credit card numbers, billing addresses) are collected and processed directly by our payment processors (Stripe and RevenueCat). We do not store your full payment information on our servers.

2. How We Use Your Information

• Provide, operate, and maintain the Voxu service
• Personalize your experience (AI coaching, content recommendations, mindset-based content)
• Process subscriptions and payments
• Send push notifications and reminders (with your consent)
• Analyze usage patterns to improve our features
• Respond to support inquiries and communicate service updates
• Detect and prevent fraud or abuse

3. Third-Party Services

We use the following third-party services to operate Voxu. Each has its own privacy policy governing the use of your information:

• Supabase — Authentication and database hosting
• Stripe — Payment processing for web subscriptions
• RevenueCat — Mobile subscription management (iOS/Android)
• Groq — AI language model processing for coaching and content generation
• ElevenLabs — Text-to-speech audio generation
• YouTube — Embedded media playback (music, soundscapes, guided content)

4. Data Storage & Security

Your data is stored on secure servers provided by Supabase. We implement industry-standard security measures including encryption in transit (TLS) and at rest. While we strive to protect your information, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

AI conversations are processed in real time and are not retained by our AI providers beyond what is necessary to generate a response. Your journal entries and AI conversation history are stored in our database and associated with your account.

5. Your Rights

You have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request that we correct inaccurate or incomplete data
• Deletion — Request that we delete your account and associated data
• Export — Request a portable copy of your data
• Opt-out — Disable push notifications or marketing communications at any time

To exercise any of these rights, contact us at privacy@voxu.app. We will respond to your request within 30 days.

6. GDPR — European Users

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply under the General Data Protection Regulation (GDPR):

Lawful Basis for Processing

• Consent — For push notifications, optional analytics, and marketing communications
• Contract — To provide the Voxu service you signed up for, including AI coaching and content delivery
• Legitimate Interest — To improve our service, prevent fraud, and ensure security

Your GDPR Rights

In addition to the rights listed in Section 5, you have the right to:

• Restrict Processing — Request that we limit how we use your data
• Data Portability — Receive your data in a structured, machine-readable format
• Object — Object to processing based on legitimate interest
• Withdraw Consent — Withdraw any previously given consent at any time
• Lodge a Complaint — File a complaint with your local data protection authority

Data Retention

We retain your personal data only for as long as necessary to provide our services and fulfill the purposes described in this policy. When you delete your account, we will delete or anonymize your data within 30 days, except where we are required to retain it by law.

7. CCPA/CPRA — California Users

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

Categories of Personal Information Collected

• Identifiers — Email address, display name, device identifiers
• Commercial Information — Subscription and payment history
• Internet Activity — Usage data, interaction patterns, feature preferences
• Inferences — Content preferences derived from your usage

Your CCPA/CPRA Rights

• Right to Know — Request what personal information we collect, use, and disclose
• Right to Delete — Request deletion of your personal information
• Right to Correct — Request correction of inaccurate personal information
• Right to Opt-Out — Opt out of the sale or sharing of your personal information
• Non-Discrimination — We will not discriminate against you for exercising your privacy rights

Do Not Sell or Share

Voxu does not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.

To exercise your California privacy rights, contact us at privacy@voxu.app. We will verify your identity before processing your request and respond within 45 days.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws. When we transfer your data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses approved by relevant authorities, to protect your personal information in accordance with this policy.

9. Children's Privacy

Voxu is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that information. If you believe we may have collected information from a child under 13, please contact us at privacy@voxu.app.

10. Cookies & Local Storage

Voxu uses cookies and browser local storage to:

• Maintain your authentication session
• Remember your preferences (theme, mindset, audio settings)
• Cache content for offline access and performance

We use a service worker to cache static assets and background images for improved performance. We do not use cookies for advertising or cross-site tracking.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of Voxu after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

privacy@voxu.app