Privacy Policy

Last updated: June 2026

        Short version: We don't store your audio. We don't sell your data. We collect only what's needed to run the service — your account email, credit balance, and session metadata (duration, timestamp). Your voice is transmitted to Groq (or Together AI as fallback) for transcription and discarded.
      

1. What We Collect

We collect the following categories of data:

Account information: Email address and encrypted password (stored by Supabase).
Usage data: Session timestamps, session duration in milliseconds, and credits deducted per session. This is stored in your credit ledger.
Audio: Transmitted to Groq (primary), Together AI, or Deepgram (fallbacks) for transcription. We do not store audio recordings. Each provider's data retention policies apply to the duration of their processing pipeline.
Transcribed text: Returned to your device and not stored on our servers.

2. What We Do Not Collect

Audio recordings — they are transmitted and discarded, not stored.
The content of your dictations — we never see, log, or store the text you dictate.
Clipboard contents or keystrokes beyond the simulated paste event.
Any information from the applications where you dictate.

3. How We Use Your Data

To authenticate you and maintain your session.
To track credit balance and session usage for billing purposes.
To enforce the $10/month spending cap.
To send account-related emails (confirmation, low balance warnings if enabled).

We do not use your data for advertising, profiling, or sale to third parties.

4. Third-Party Services

Voxa uses the following third-party services:

Groq (groq.com): Primary processor for audio transcription. Your audio is transmitted to their servers for processing. Their privacy policy governs data handling during API calls.
Together AI (together.ai): Fallback processor for audio transcription, used when Groq is unavailable. Their privacy policy governs data handling during API calls.
Deepgram (deepgram.com): Secondary fallback processor for audio transcription. Their privacy policy governs data handling during API calls.
Supabase (supabase.com): Hosts your account, authentication, and credit ledger. Data is stored in their managed PostgreSQL infrastructure.
Paddle: Processes payments as Merchant of Record. They collect billing information required for payment processing.
Cloudflare: Hosts this website. Standard CDN and DDoS protection applies.

5. Data Retention

Your account and credit ledger are retained as long as your account is active. If you delete your account, your data is deleted from our database within 30 days, subject to any legal retention requirements.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and associated data.
Object to or restrict certain processing.

To exercise any of these rights, contact us at hello@getvoxa.app.

7. Security

We use industry-standard practices: HTTPS for all data in transit, Supabase Row Level Security to ensure users can only access their own data, and bcrypt password hashing via Supabase Auth. We do not have access to your plaintext password.

8. Changes to This Policy

We may update this Privacy Policy. We will notify you of material changes by email or through the application with at least 30 days notice before changes take effect.

9. Contact

Privacy questions: hello@getvoxa.app