CanaryVolt Privacy Policy

Effective date: 22 August 2026 Last updated: 5 September 2026

This policy describes CanaryVolt LLC's desktop app, iPhone app, website and account services. This revision accompanies the release introducing OpenAI processing and optional account-based notes sync.

The short version

• Capture starts only when you start a session. The app shows session state, and you can end capture.
• Session content is ephemeral by default. Audio and camera images are not saved to our servers. Saving notes or transcripts locally, exporting them, or saving them to your account requires your choice.
• If you choose account storage, the saved notes and transcript are uploaded so you can access them on your signed-in devices. You can delete saved meetings.
• Our providers process the content needed for transcription, the selected AI response, and spoken output. Selecting Astra sends that request to OpenAI.
• We do not sell conversation content, use it for advertising, or create biometric voiceprints.

1. What happens during a session

Your microphone audio, and supported desktop call audio, pass through our proxy to Deepgram for transcription. The app holds a transcript in memory. The selected AI provider receives the conversation context, scenario instructions, and any materials included in the request. Explicitly shared camera images may be sent for visual assistance.

For live text help, you request a response with the cue control. Notes mode captures a transcript without generating unsolicited live answers. Summaries and other requested artifacts also involve AI processing; a session-end summary can be generated even when saving is off. The provider used for a summary or follow-up can differ from your selected live-response model.

When spoken output is enabled, the response text can go to Cartesia for speech synthesis. Supported script and rehearsal playback also uses Apple's system speech synthesis. Switching off cloud saving does not switch off the processing needed to deliver an active session.

The relay does not intentionally write request content, audio, images or generated responses to its logs. Provider retention is separate from CanaryVolt's own storage and is described below.

2. Saving, syncing and deleting meetings

Saving is optional. Local retention, exports and account storage are separate choices. Account storage requires explicit save consent; signing in alone does not upload a meeting. Where offered, an opt-in setting can save future completed sessions; you can turn it off.

An account-saved meeting contains its title, timestamps, speaker-labelled transcript, summary, optional follow-up, source app and prompt revision. It does not contain an audio recording or camera video. Saved meetings can be searched, opened, exported and deleted from your account library on supported devices. This library does not automatically add all past meetings to every live AI request. When you ask a question across saved meetings, you select the meetings and explicitly agree to model processing. We send your question and up to 24 relevant excerpts from at most 12 selected meetings to your selected provider. Answers include citations to the saved excerpts. Questions and answers are temporary and are not automatically added to the library.

Cloud notes are encrypted at rest using a server-held key and protected in transit by TLS. This is not end-to-end encryption: CanaryVolt's service can decrypt a saved meeting to return it to you. Access is restricted by your authenticated account.

Deleting a cloud meeting removes its content from the active account library. Deleting all cloud notes invalidates earlier queued saves so they cannot silently restore that library. Minimal deletion records remain to prevent stale copies and restored backups from restoring deleted content. Recovery records also retain the account, identity-provider, payment-customer and team identifiers needed to check current ownership and billing after a failure; these records contain no meeting transcript or answer. Copies you explicitly exported, copies held by other people, and your own device backups are separate and must be deleted there.

Local settings, imported reference materials and opted-in local history remain on your device. Use the app's local deletion controls to remove them. Clearing cloud notes does not erase a separately exported file. Disabling future saving does not itself erase previously saved data.

3. Account, payment and operational data

We store account identifiers, contact details, subscription and team status, and references needed to match your WorkOS identity and Stripe billing account. WorkOS manages sign-in and passwords; CanaryVolt does not receive your password. Desktop credentials use the operating system's protected storage, and iPhone credentials use Keychain. Legacy operator-issued device credentials may be supported for development; the server stores their hashes.

Representatives can explicitly enable CRM call logging in Settings. When enabled, finished sales sessions can send an AI-extracted summary, disposition, objections, next step, duration and talk ratio to their CanaryVolt CRM. The full transcript is used to generate that write-up but is not included in the CRM call record. This setting starts off and does not carry over to another account.

The optional representative interview keeps drafts on screen until you choose to share them. Submitting requires a separate consent to send your reviewed answers and the question version to CanaryVolt for human review. This submission is separate from your private meeting library. Authorized reviewers may record a review status and feedback; the workflow does not make an automated hiring decision. You can review or delete your submitted interview, and account deletion removes its personal contents.

Stripe handles website payments and representative payout onboarding. Card numbers and representative bank credentials go to Stripe, not the apps. We retain the billing, commission and tax records needed to operate the account and meet our obligations.

To meter usage, investigate failures and determine costs, we record metadata such as account and session identifiers, app, request purpose, model, prompt revision/hash, token counts, cache counts, connection duration, audio duration, latency and completion status. These records contain no transcript, prompt text, audio, images or generated answer. Counts and duration measurements are operational estimates until reconciled with provider billing.

4. Providers and their data handling

• OpenAI: processes Astra requests, including supplied conversation context and explicitly shared images. We use the API with response storage disabled (store: false). This disables Responses application-state storage; it does not promise zero retention. Standard abuse-monitoring logs can be retained for up to 30 days, with applicable exceptions, and prompt caching has its own retention. API data is not used to train OpenAI models by default unless the customer opts in. See OpenAI API data controls.
• Anthropic: processes Claude requests, including Fable, and configured summary or follow-up requests. It receives the context and materials submitted for that request under its commercial API terms.
• Deepgram: processes session audio for transcription. Our requests set its model-improvement opt-out flag.
• Cartesia: receives text requested for cloud-generated spoken output.
• Fly.io: hosts the proxy, account services, operational records and encrypted optional notes library. It handles content in transit and the data we persist.
• WorkOS: handles identity, authentication and team invitations, including sign-in contact details and security events.
• Stripe: handles checkout, subscription billing and representative payouts under its own terms and privacy policy.
• Resend: supports configured transactional email. Conversation content is not automatically included in those emails.
• Apple: supplies the operating system, Keychain, speech and distribution services. Your own iCloud or device backups follow your Apple settings and terms.

Providers receive data needed for their service. Their published terms, retention rules and applicable processing agreements also apply. We do not claim an approved zero-data-retention arrangement, a particular hosting region, or a separately negotiated agreement unless we have verified it for the production account.

5. Retention and requests

Unsaved session content is held for processing and in-app review, then cleared as the session lifecycle and app closure require. Opted-in local data stays until you delete it. Account-saved notes stay until deleted; capacity limits are shown by the service.

Account data is kept while the account is active. The apps provide a confirmed Delete Account flow that removes your WorkOS identity and personal cloud data and revokes access. Before confirming, you separately choose whether to stop future Stripe renewals or keep subscriptions billing; external subscriptions must be managed with their provider. Personal access ends when deletion is accepted. Prepaid team seats for other members can continue until the billing period ends. Deletion does not itself issue a refund. The app also clears its saved personal data on the device where you confirm; exported copies and data on other devices are separate. Some provider cleanup may complete asynchronously. Financial, tax, security and legal retention obligations still apply. Financial records and minimal deletion guards can remain after account deletion. Provider-held records and existing backups follow their applicable retention policies; deletion from the active library does not promise immediate erasure of every backup.

Operational retention targets are 30 days for ordinary server logs and 24 months for billing usage records, followed by deletion or aggregation. Retention and backup procedures are part of our operational responsibilities.

You may request access, correction, an export, deletion or other applicable privacy rights at hello@canaryvolt.com. The apps provide controls for saved-meeting export and deletion. Requests that cannot be completed in the app are handled by our team; we aim to respond within 30 days, subject to applicable law and identity verification. Tell us if your request includes both cloud data and account closure.

Depending on your location, our legal bases include providing the service you request, complying with legal obligations, and legitimate interests in security and billing. Optional retention is your choice. We do not sell or share personal information for cross-context behavioural advertising.

6. Participant consent and security

You are responsible for obtaining any consent needed from meeting participants before capture. A participant may contact us about their data at the address below.

We do not create voiceprints or identify speakers biometrically. Desktop ME and THEM labels reflect microphone versus call-audio channels; they do not identify a person by their voice.

Provider secrets stay on the proxy. Client requests to public servers use encrypted connections. We use account access controls, encrypted cloud-note storage and content-free operational logging. No system is perfectly secure; we address incidents and notify affected people as required by law.

7. Age, changes and contact

The service is for adults aged 18 or older and is not directed to children. We update this policy when data handling changes and provide notice of material changes before they take effect.

CanaryVolt LLC 555 High St, Ste 9, Mount Holly, NJ 08060 hello@canaryvolt.com