CanaryVolt
CanaryVolt Privacy Policy
This policy explains what CanaryVolt LLC ("CanaryVolt," "we") does with data across the CanaryVolt iOS app (voice study companion), CanaryVolt Desktop (AI assistant and note-taker for professional calls and meetings), and the canaryvolt.com website and account services.
The short version
- During a live session, audio becomes a transcript in memory, the transcript goes to an AI model, and a suggestion comes back to your screen or is spoken aloud to you. By default, none of that content is stored on our servers.
- What we do store on our servers: your account record (name, contact email, a hashed access token) and usage metering events (what kind of event, how long, how many calls, which model) — never the content of your conversations, documents, or suggestions.
- We never create voiceprints and never identify speakers biometrically. Not as a feature, not internally, not ever.
- A small set of subprocessors (listed below) process content in transit to provide transcription, AI responses, and voice output.
1. Data we process during a live session (not stored by us)
When you run a session, content flows through this pipeline and is gone when the session ends:
- Audio from your microphone (and, on Desktop, the audio of the call you are in) is captured on your device.
- Audio is converted to a transcript. On Desktop this transcription runs on your own computer where available; on iOS, audio is streamed through our server to our transcription subprocessor. Transcripts exist in your app's memory for a rolling window (on the order of minutes) and are discarded as the session moves on.
- The recent transcript, together with any documents or notes you attached (for example study materials or a meeting brief) and your mode settings, is sent through our server to our AI subprocessor, which returns a suggestion, question, explanation, or note.
- On iOS, the response may be converted to spoken audio by our voice subprocessor. On iOS study modes that use the camera, camera frames of your own materials may be sent to the AI subprocessor for reading; text extraction from imported documents (PDF/OCR) happens on your device.
Our server sits in the middle of these flows as a relay: it holds the provider API keys so your device never has them, and it forwards content without writing it down. Our server does not persist session content — no audio, no transcripts, no documents, no images, no AI output — and our server logs contain no content (they record connection identifiers, model names, token counts, latency, and status codes only). We maintain a no-content-logging policy for the relay.
2. Data we store
2.1 Account data (on our servers)
| Field | Notes |
|---|---|
| Account name | The name or handle the account was created with |
| Contact email | Optional; used for account and billing communication |
| Access token — hashed only | We store a SHA-256 hash; we cannot read your token back |
| Subscription tier | e.g., which plan you are on |
| Account timestamps and status | Creation date; whether the token has been revoked |
2.2 Usage metering events (on our servers)
To enforce plan allowances and operate the Service, each billable action writes a metering event containing: timestamp, billing month, event kind (e.g., transcription time, AI call), duration in seconds, call count, and the model used [plus a client/app identifier distinguishing iOS from Desktop — planned as Desktop metering lands]. Usage events contain no conversation content of any kind.
2.3 Payment data
Payments are handled by our merchant of record or by Apple (for App Store purchases). We do not receive or store card numbers. We receive subscription status information needed to activate your plan. Our merchant of record is Paddle.com Market Ltd, which acts as the seller for subscriptions purchased through our website and receives the billing details you provide at checkout.
2.4 On your device (not on our servers)
Both apps keep some data locally on your device, under your control:
- Settings, custom modes, and your saved context documents (extracted text of materials you import).
- iOS: session history — transcripts, AI cues, and study/session notes — is saved on the device so you can review past sessions. This history stays on your device (and in your own device backups); it is not uploaded to us. You can delete sessions in the app.
Two current limitations, stated plainly: deleting a saved context document does not remove copies already embedded in previously saved session records, and there is no single "delete everything" control yet. Both are on our fix list. In the meantime, email hello@canaryvolt.com and we will complete a full deletion by hand.
- Desktop: ephemeral by default — transcripts, audio and context live in memory only and are discarded when the session ends. Nothing about your conversations is written to disk unless you turn on the opt-in "Save session notes" setting, which is off until you do; see §3 for exactly what it stores and how to delete it.
3. Opt-in session notes (Desktop) — off by default
The defaults described above are ephemeral. Desktop has one setting that changes that, and it is off until you turn it on.
"Save session notes" (Settings → Session notes). With it on, CanaryVolt writes the end-of-session notes summary to your own Mac when a session ends. Stated exactly:
- What is stored: the AI-written notes summary for that session — a short Markdown document (summary, key points/topics, objections or decisions depending on the mode, action items, follow-ups). The raw transcript and the audio are not stored; they are discarded when the session ends, as above.
- Where: on your Mac only, in
~/Library/Application Support/CanaryVolt/sessions/, written readable by your account alone. These files are never uploaded to us. They are included in your own Time Machine or device backups if you back that folder up. - For how long: until you delete them. There is no expiry and no cap.
- How to delete: Settings → Session notes lists every saved file with its date. "Delete" removes one; "Delete all" (which asks you to confirm) removes every one. Turning the setting back off stops future sessions from writing, and deliberately deletes nothing — the list stays there so you can clear what is already saved.
- Off means off: with the setting off, no session writes anything to disk. Notes are still shown to you on screen after the session; they simply live in memory and go away with the app.
Separately, and only when you ask for it: Export and Email summary write a file where you choose to put it, through the standard macOS save dialog. That is a file you asked for, in a location you picked, and it is not covered by the setting above.
Not built: cross-call memory, server-side storage of notes, and any transcript retention. Nothing in this section stores anything on our servers. If that changes, this policy will be updated before it ships.
4. No voiceprints. No biometrics. Ever.
The Service does not create voiceprints, does not perform speaker identification or voice recognition of individuals, and does not process biometric identifiers of any kind. On Desktop, "who is speaking" labels come from which audio channel the sound arrived on (your microphone vs. the call audio) — a mechanical distinction that involves no analysis of anyone's voice. This is a permanent design commitment, not a current-configuration statement.
5. Subprocessors
Content is processed by the following subprocessors solely to provide the Service. The status column says exactly what is in force today, not what we intend — where a data processing agreement has not been signed, it says so.
| Subprocessor | Purpose | Content it receives | Data-protection status |
|---|---|---|---|
| Anthropic | AI model responses (suggestions, questions, notes) | Recent transcript text; documents/notes you attach; on iOS camera modes, images of your materials | Standard commercial API terms. No separate DPA or zero-data-retention arrangement is in force yet; API inputs and outputs are retained by Anthropic under its published policy |
| Deepgram | Speech-to-text (iOS; Desktop cloud fallback) | Session audio | Model-improvement opt-out is set on every request we send (mip_opt_out=true), so your audio is not used to train Deepgram's models. No separate DPA is in force yet |
| Cartesia | Voice synthesis (iOS spoken output) | The text of the cue being spoken | Standard commercial API terms. No separate DPA is in force yet |
| Fly.io | Hosting for our relay server and account database | Content in transit through the relay (not stored); account and usage data at rest | Standard commercial hosting terms. No separate DPA is in force yet |
6. Retention
| Data | Retention |
|---|---|
| Session content (audio, transcripts, documents, images, AI output) on our servers | Not stored. Exists in memory only for the duration of processing |
| Account data | Life of the account, then deleted within 30 days of account deletion |
| Usage metering events | 24 months for billing records, then deleted or aggregated |
| Server logs (metadata only, no content) | 30 days |
| Data held by subprocessors | Per each subprocessor's own published terms — see the status column in §5. We do not control this retention until the arrangements noted there are in force |
| Data on your device | Under your control; retained until you delete it (see §2.4) |
7. Your rights (GDPR, CCPA, and similar laws)
Depending on where you live, you may have rights to access, receive a copy of, correct, delete, or restrict processing of your personal data, and to object to processing. We honor these requests for all users regardless of jurisdiction, as follows:
- Access / export: on request, we will provide a copy of the personal data we hold about you — your account record and usage events. (We cannot export your session content because we do not have it; content on your device is already in your possession.)
- Deletion: on request, we will delete your account record and revoke your token. Usage events are deleted or irreversibly de-identified subject to the billing-records retention in §6. Data stored on your own device is deleted by you, in the app or by removing the app.
- Honest implementation status: these rights are currently fulfilled manually — email hello@canaryvolt.com and we will complete requests within 30 days. There is no self-serve export or delete-account button yet; both are on the roadmap, and this policy will be updated as they ship.
Legal bases (GDPR): we process account and usage data to perform our contract with you (Art. 6(1)(b)) and for our legitimate interests in securing and metering the Service (Art. 6(1)(f)); session content is processed to perform the contract, at your initiation, and is not retained. We do not use your content for advertising and do not sell or share personal information as defined by the CCPA.
Third-party participants: in a call or meeting, other participants' speech passes through the pipeline in §1. We act on the instruction of our user, who is responsible for obtaining participants' consent (Terms §5.1). A participant who believes their data was processed may contact us at hello@canaryvolt.com.
8. Security
Provider API keys live only on our servers, never in the apps. Access tokens are stored hashed (SHA-256) at rest and travel only in the Authorization header over TLS. The apps refuse cleartext connections to public hosts. On your devices, tokens are kept in the operating system's protected storage (iOS Keychain; Electron safeStorage on desktop). Our relay's logs are metadata-only by policy. No system is perfectly secure; we will notify affected users of a breach as required by law.
9. Children
The Service is not directed to children under 13, and per our Terms users must be 18 or older. We do not knowingly collect personal data from children.
10. Changes
We will update this policy as the product evolves — in particular before any cross-call memory or server-side storage of the §3 notes ships, and whenever the subprocessor list changes. Material changes will be announced by email or in-product notice before they take effect.
11. Contact
CanaryVolt LLC
555 High St, Ste 9, Mount Holly, NJ 08060
hello@canaryvolt.com