Privacy Policy

At Convoxa, we believe privacy is not a feature—it is a fundamental right. We have architected our service to collect only the absolute minimum data required to function. This policy outlines our commitment to your data security in compliance with GDPR (EU), CCPA (California), and the EU AI Act.

1. Data Collection & Processing

Convoxa is designed to give you full control over your data. Transcription can run either On-Device (Offline) or in the Cloud (Online). Note generation is Cloud only.

A. Transcription

• On-Device Mode: Audio is transcribed entirely on your device. No audio or text leaves your device.
• Cloud Mode: Audio is processed using enterprise-grade infrastructure for maximum accuracy. Audio is deleted immediately after transcription, following strict automated cleanup protocols. It is never used for training.

B. Note Generation

Notes are generated in the Cloud. Your transcript is processed using secure cloud-based AI models entirely in memory—it is never written to disk, stored, or used for training.

What this means for On-Device transcription: if you transcribe on-device and never generate a note, nothing about that recording leaves your device. Generating a note sends the transcript text (not the audio) to our cloud partner for processing. Your finished recordings and notes are always stored locally on your device—and synced to your personal iCloud for Pro users—not on our servers.

C. Account & Metadata

To operate and secure the service, we collect:

• Sign in with Apple: Convoxa requires you to sign in with Apple. We receive the account identifier Apple issues for Convoxa and the email address you choose to share—which can be Apple's Private Relay address, so you never have to give us your real one. We use this to authenticate you and to attach your subscription tier and usage quota to your account. We do not ask for or store a password.
• Account Identifiers: Your account identifier links to your subscription tier and quota management. For transaction processing, we also use an anonymous transaction identifier.
• Usage Logs: Timestamp, duration of recording, locale, processing mode (Cloud/On-Device), and success/failure status.
• Live Note Counts: The number of live notes attached to a recording—typed notes, images, and PDFs—as a count only. We record how many, never what they say or show. Their contents stay on your device.
• Technical Data: Processing time, language locale, and token counts for subscription quota management.

The Golden Rule: These logs never contain the content of your audio, any part of your transcripts, your generated notes, or the text, images, or documents you attach while recording.

D. How We Use Your Email

We may occasionally email you about the product itself—to ask for feedback, to understand how Convoxa is working for you, or to tell you about a change that affects how you use it. That is the only reason we would ever contact you.

We do not send marketing campaigns, we do not use your email address for advertising, profiling, or tracking, and we never sell, rent, or share it. If you would rather not hear from us, tell us at hello@convoxa.com and we will stop.

E. Zero Tracking & No Ads

Convoxa is built for you, not for advertisers. We provide an ad-free experience and do not engage in invasive tracking:

• No Ad SDKs: We do not include any advertisement SDKs or trackers.
• No Marketing Pixels: We do not use Meta Pixels, Google Analytics, or social media tracking.
• No Data Brokering: We never sell, rent, or trade your data to third parties.

2. Third-Party Processors

We partner with industry-leading infrastructure providers who adhere to strict security standards. Our cloud partners maintain SOC 2 Type II, HIPAA, and ISO 27001 compliance programs.

3. Data Retention

• Content: We do not retain your content. In Cloud Mode, audio is processed transiently by our infrastructure and deleted right after processing, following strict automated cleanup protocols. Transcripts sent for cloud note generation are processed entirely in memory and discarded immediately—they are never written to disk.
• Account Data: Your account identifier, the email address Apple shared with us, and associated usage metadata are retained while your account is active. You can delete your account at any time through the app. Upon deletion request, all server-side account data is permanently removed within 30 days.
• Metadata: Usage logs (duration, timestamps) are retained for up to 90 days for security monitoring and resource optimization, after which they are deleted.
• Device Data: You control the data on your device. Deleting the app removes all local data immediately. Note that deleting your account does not delete recordings, transcripts, or notes stored locally on your device or in your personal iCloud (for Pro users)—these remain under your control.

4. Your Rights (GDPR & CCPA)

You have the right to access, rectify, or delete your data. You can exercise these rights from the account you signed in with, in the app settings.

• Right to Erase: You can delete any recording within the app. You can also delete your entire account through the app settings, which will permanently remove all server-side account data (account identifier, email address, usage logs, metadata) within 30 days. Your recordings, transcripts, and notes stored locally on your device or in your personal iCloud (for Pro users) remain under your control.
• Right to Object: Choose On-Device transcription and skip note generation, and no part of that recording is processed externally.
• Export: Your data is yours. You can export transcripts and notes directly from the app.

To exercise these rights, contact: hello@convoxa.com

5. International Transfers

Our infrastructure is distributed globally. When using Cloud Mode, data may be processed in the United States by our primary cloud infrastructure and AI partners, supported by our strict data deletion policies and the security standards outlined above.

6. Children's Privacy

Convoxa is not intended for use by anyone under the age of 13. We do not knowingly collect information from children.

7. Changes to This Policy

We may update this policy as our app evolves. Changes are indicated by the "Last Updated" date at the top of this page. For material changes, we will provide notice through our website or within the App interface as appropriate. We recommend checking this policy regularly to stay informed about our data practices.

8. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: hello@convoxa.com
• Operator: Karam Al-Askar (Convoxa)
• Address: Vaci ut 133, Budapest 1044, Hungary