Privacy policy

Voxa is a voice-to-action assistant for macOS. The wake word “Saara” activates an on-device speech recognizer. Your audio is converted to text on your Mac and discarded; only the resulting transcript text leaves the device. That text travels over HTTPS to our backend, which routes it to a large language model so Voxa can decide what to do, and may dispatch the resulting tool calls (such as sending a Gmail message you authored, or creating a calendar event) to integrations you explicitly connected.

We store your account record, your conversation history, the memory facts you have asked Voxa to remember, and an audit log row per request. The audit log records a SHA-256 hash of the transcript — not the transcript itself — together with the list of tools that ran, hashed identifiers of any recipients (so we can investigate abuse without exposing who you spoke to), and basic latency and success metrics. OAuth tokens for connected services are stored encrypted at rest. You can export, correct, or delete any of this at any time.

For the purposes of the DPDP Act, 2023, the GDPR, and the CCPA, the data fiduciary / controller / business is:

• Operator: Adwait Keshari, sole proprietor, trading as Voxa.
• Address: Bhopal, Madhya Pradesh, India.
• Privacy contact: privacy@voxa.app
• Grievance Officer (DPDP, India): Adwait Keshari, reachable at the same address.

Voxa is a small, founder-operated product. There is no in-house data protection team. We commit to responding to every verified request within the statutory timelines (30 days under DPDP, one month under GDPR, 45 days under CCPA), and to escalating to qualified counsel where a request requires it.

We collect the smallest amount of data that lets Voxa work. The categories below are exhaustive for the current product; if we add a new category we will update this page and notify signed-in users.

• Raw audio. Your microphone stream is consumed locally by Apple's Speech framework and discarded. It is never uploaded.
• Long-term raw transcripts. Only the SHA-256 hash is retained in audit logs. The plaintext transcript exists in conversation history only if a conversation thread is active and only for as long as you keep that thread.
• Plaintext OAuth tokens. All third-party tokens are encrypted at rest.
• Plaintext recipient identifiers. We hash recipient emails and contact handles before writing them to the audit log.
• Screen contents at large. Voxa reads the title of the focused window and, when you explicitly invoke it, the text you have selected. It does not screenshot, OCR, or scrape the rest of your display.
• Browsing history, location, contacts.
• Advertising or marketing identifiers. No third-party advertising trackers run on this site or in the desktop app.

We use the data we collect strictly to operate the service and for the lawful bases described below.

• Agent execution. Forwarding your transcript to a language model so it can plan and dispatch tool calls on your behalf. Lawful basis (GDPR): performance of contract. DPDP basis: necessary for purpose for which consent was given.
• Conversation continuity. Storing your past requests so a follow-up like “send the same email but to my brother instead” resolves correctly. Lawful basis: performance of contract.
• Abuse prevention & rate limiting. Counting requests per account, watching for patterns that look like spam or scraping, and acting on third-party abuse complaints. Lawful basis (GDPR): legitimate interest.
• Product improvement. Looking at aggregated, hashed audit logs to understand which tools are popular and which ones break. We do not read your conversation content for product research; the audit log contains hashes, not transcripts. Lawful basis: legitimate interest.
• Security & fraud prevention. Investigating account takeovers, payment fraud, and platform abuse. Lawful basis: legitimate interest and legal obligation.

We do not sell or rent your personal data. We do not share it with data brokers. We do not use it to train any model that we publish or monetise.

Voxa relies on a small, named set of third-party processors. Each one receives only the categories of data needed for it to perform its function. The list below is exhaustive as of the effective date of this policy.

Voxa is operated from India. Personal data routinely crosses borders to make the product work:

• The backend application runs on a VPS in Singapore.
• Persistent storage is in the Mumbai (India) region of Neon Postgres.
• Language-model inference is performed in the United States or United Kingdom depending on the provider Voxa selects.
• Cloudflare and Sentry operate globally distributed networks.

Where data leaves the European Economic Area, the United Kingdom, or India, we rely on the lawful transfer mechanisms available to each processor: Standard Contractual Clauses (GDPR / UK GDPR), adequacy decisions where they exist, and the recipient's published commitments under DPDP. Each named subprocessor publishes its own data processing addendum and SCCs, which we have accepted as part of using their service.

• Conversation history. Kept until you delete your account or explicitly purge a conversation from the History UI in the macOS app. There is no automatic expiry; the choice is yours.
• Memory facts. Kept until you delete them, either individually from Settings or by deleting your account.
• Audit logs. Kept for twelve (12) months from the date of the request, then automatically purged. We retain audit logs for this period so we can investigate abuse complaints, resolve disputes (including chargebacks), and meet security obligations.
• Voice clone voice_id. Kept until you delete the voice from Settings, which also triggers deletion at ElevenLabs.
• OAuth tokens. Kept until you revoke the integration from Settings, or automatically deleted 90 days after last use, whichever is earlier.
• Account record. Kept until you delete your account, after which it is removed within 30 days subject to any legal obligation to retain it longer (for example, tax records of payments).

We apply the security controls a small founder-operated SaaS can reasonably maintain:

• TLS 1.2+ for all network traffic between the macOS app, the backend, and third-party APIs.
• OAuth tokens encrypted at rest using authenticated symmetric encryption; the key is held outside the database.
• Short-lived JWTs for session authentication; secrets live in the macOS Keychain on-device.
• Token-bucket rate limiting per account to contain abuse and protect against runaway loops.
• Encrypted-at-rest database backups managed by Neon.
• Principle of least privilege on infrastructure access; production credentials are not shared.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you without undue delay and in any case within 72 hours of becoming aware, in line with GDPR Art. 33 / 34 and the DPDP Act's breach-notification requirements.

You have rights over your personal data. The catalogue varies by jurisdiction; the table below maps the most important ones. To exercise any right, write to privacy@voxa.app from the email address on your account, or use the in-app controls where available.

The minimum age to use Voxa is 13 years. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, write to us and we will delete it.

Under the DPDP Act, 2023, any data subject under 18 years of age in India is treated as a child and processing requires verifiable parental consent. Voxa does not currently target users under 18 in India and does not have age-verification tooling in place; until we do, we ask Indian users under 18 not to create an account.

We also do not engage in tracking, behavioural advertising, or targeted advertising directed at children, regardless of jurisdiction.

This marketing website uses only essential session cookies required to remember your theme preference and, if you sign in, to keep you signed in. There are no advertising cookies, no third-party analytics that profile individuals, and no cross-site trackers.

The macOS app does not set cookies. Authentication uses tokens stored in the macOS Keychain, scoped to the Voxa application.

We will update this policy from time to time. The effective date at the top of the page reflects the most recent version. For material changes — for example, adding a new category of data, a new subprocessor that handles your conversation content, or shortening user rights — we will notify signed-in users by email and via an in-app notification at least 30 days before the change takes effect.

Non-material changes (typographical fixes, clearer phrasing, restructuring) take effect immediately and are noted in the change history we keep alongside the source of this page.

This Privacy Policy is governed by the laws of India, without regard to its conflict-of-law principles. Any dispute arising out of or related to this Privacy Policy is subject to the exclusive jurisdiction of the competent courts located in Bhopal, Madhya Pradesh, India, subject to the dispute-resolution clause in our Terms of Service for matters covered there.

For privacy questions, data subject requests, or grievances under the DPDP Act, 2023:

• Email: privacy@voxa.app
• Grievance Officer (DPDP, India): Adwait Keshari, Bhopal, Madhya Pradesh, India.
• Postal address: Bhopal, Madhya Pradesh, India. Specific street address available on request to verified data subjects, to keep this page from becoming a doxxing target.

We will acknowledge every privacy-related communication within 7 calendar days and respond substantively within the timeline applicable to your jurisdiction (30 days under DPDP, one month under GDPR, 45 days under CCPA).