Trust

Data Handling & Trust

CanaryVolt is a real-time AI assistant and note-taker for professional calls and meetings, plus a voice study companion on iOS. This page is the whole data story, in one place, for the person whose job is to ask hard questions about it.

This is the summary. The full legal detail lives in the Privacy Policy.

Ephemeral by default

A session works like this: audio is captured on the user's device, becomes a transcript in memory, the recent transcript goes to an AI model, and a suggestion comes back to the user's screen. When the session ends, that content is gone.

We store no conversation content on our servers. No audio, no transcripts, no attached documents, no AI output. Our relay forwards content; it does not write it down.
Anything the product keeps (iOS session history, saved reference documents) lives on the user's own device, under the user's control.
Desktop session notes are opt-in and off by default: with the setting on they are written to your own Mac and you can delete them in the app, and nothing is stored on our servers either way. Cross-call memory does not exist. See Privacy Policy §3.

No voiceprints, ever

We never create voiceprints and never biometrically identify speakers. Desktop's "me / them" labels come from which audio channel the sound arrived on — a mechanical fact, not voice analysis. This is a permanent design commitment.

Keys stay server-side; access is per-user and revocable

AI, transcription, and voice-provider API keys exist only on our servers. They are never embedded in, or sent to, any client app.
Each user gets an individual access token, stored by us only as a SHA-256 hash, sent only in the Authorization header over TLS. Tokens can be rotated or revoked server-side, which takes effect immediately — mid-session included.
Plan limits and rate limits are enforced on the server, where the keys are — not by client-side honor system.

What we log — and never log

We log (metadata only)	We never log
Connection identifiers, timestamps	Audio, in any form
Model name, token counts, latency, status codes	Transcript text
Usage events: event kind, seconds, call counts, model	Documents, briefs, or notes content
Account records: name, contact email, tier, hashed token	AI suggestions or spoken cue text

No-content-logging is a written policy enforced in code review, not an accident of the current build.

The product is designed to the all-party consent standard: our Terms require users to disclose AI transcription and obtain agreement from everyone in the conversation, and the product provides disclosure affordances to make that easy.
No stealth features. The desktop overlay is a normal window on the user's own screen. There is no anti-capture or concealment behavior anywhere in the product, and we will not build any. We do not inject bots into meetings and do not touch meeting platforms' media APIs.
The Terms prohibit use in evaluative settings — proctored exams, graded assessments, candidate-side interviews. One part of that is enforced in code: every AI call carries a server-side rule telling the model to refuse a live proctored exam or graded assessment it can see, which covers the iOS camera modes. The desktop app is audio-only, so there the prohibition is contractual, not technical.

Subprocessors

Anthropic (AI responses), Deepgram (speech-to-text), Cartesia (voice output, iOS), Fly.io (hosting). Content reaches them only in transit to provide the service. DPA and zero-data-retention arrangements: in progress — status published in the Privacy Policy before launch.

What we'll say honestly