Privacy Policy

# Voxly — Privacy Policy **Last updated:** February 27, 2026 Voxly ("we", "us", "our") is a voice-first social network operated by Voxly Social. This policy explains what data we collect when you use Voxly (the mobile app, the website at https://voxlysocial.com, and related services — together the "Service"), why we collect it, and the choices you have. If you have any questions, email us at **privacy@voxlysocial.com**. --- ## 1. What we collect ### Data you give us - **Account info** — email address, password (stored as a bcrypt hash — we never see the plaintext), first name, last name, unique `@username`, date of birth (used to verify you are 18+), and an optional profile photo and bio. - **Phone number** — only if you sign in with SMS OTP. Verified via a one-time code sent through Twilio. - **Voice recordings** — voice captions on posts, voice comments, voice DMs, and audio streamed inside Live Voice Rooms. These are the core of Voxly and are always tied to your account. - **Photos and videos** — anything you upload to a post or a story, including EXIF metadata that is stripped server-side. - **Payments** — if you subscribe to Voxly Premium ($5.99/mo), payment is handled entirely by Stripe. We never see or store your card number; we only see Stripe's customer / subscription ID. - **Voluntary metadata** — hashtags, feelings, tagged users, and location names you attach to a post. Location is a text name (e.g. "Brooklyn, NY") — we do **not** read your GPS unless you type in a place manually. ### Data we collect automatically - **Device info** — device type, OS version, app version, and a Capacitor-generated device token (Android/iOS) used for push notifications if you opt in. - **Usage data** — timestamps of your posts, likes, comments, follows, and app opens. Used for the "For You" feed and to prevent abuse. - **Log data** — IP address, request URL, and error stack traces. Retained 30 days for security and debugging. ### Data we do NOT collect - We do not read your device contacts, calendar, or precise GPS location. - We do not use ad-tracking SDKs or third-party advertising networks. - We do not sell your personal data to anyone. Ever. --- ## 2. How we use it - **Deliver the Service** — show your posts to your followers, play back your voice, connect you in Live Rooms, route DMs. - **Moderation** — voice content is transcribed with OpenAI Whisper and classified by an LLM to catch violent, sexual, or hateful audio before it goes public. We keep the moderation label with the post; we do not keep the raw transcript beyond 24h. - **Anti-abuse** — rate limiting, spam prevention, blocking, and account recovery. - **Communication** — sending optional daily digest emails via Resend if you opt in, and system emails (password reset, magic link, receipts). - **Product improvement** — aggregated, non-identifying usage counts. We do **not** use your voice or photos to train AI models. --- ## 3. Who we share it with (sub-processors) We share the minimum amount of data with each of these vendors so they can help us run the Service: | Vendor | What they see | Why | |---|---|---| | **Emergent Object Storage** | Uploaded audio, photos, videos | Media hosting | | **MongoDB Atlas** | All non-media data (posts, users, DMs, etc.) | Database | | **LiveKit Cloud** | Live Room audio streams (transient — not stored) | Real-time voice | | **Stripe** | Email + Stripe customer ID | Premium subscription payments | | **Twilio** | Phone number | SMS OTP delivery | | **Resend** | Email address | Sending emails | | **OpenAI** | Voice audio (transient — deleted after transcription) | Whisper voice moderation | | **Google (OAuth)** | Email + name (only if you sign in with Google) | Sign-in | | **Tenor (Google)** | Your GIF search query | GIF picker in DMs | | **iTunes Search (Apple)** | Your music search query | Background music picker | | **Apple / Google Push** | Anonymized device token | Push notifications (opt-in) | We do not sell data to advertisers, brokers, or any other third party. --- ## 4. Your rights Wherever you live, you can: - **Access** your data — email us and we'll send you a JSON export. - **Delete** your account — Settings → Delete account. This removes your profile, posts, stories, DMs, and voice recordings within 30 days. Some anonymized log data may persist for security. - **Correct** wrong info — edit it in your profile, or email us for anything not editable. - **Opt out** of push notifications, email digests, and tagged-user notifications — all toggleable in Settings. - **Withdraw consent** at any time by deleting your account. If you're in the EU/UK you also have the right to lodge a complaint with your local data protection authority. If you're in California, you have the additional CCPA rights of Know / Delete / Correct / Portability / Non-discrimination. To exercise any of these rights email **privacy@voxlysocial.com**. We respond within 30 days. --- ## 5. Security - All traffic is HTTPS/TLS 1.2+. - Passwords are hashed with bcrypt (cost 12). - Media is stored on Emergent Object Storage behind signed, expiring URLs. - Access to production data is limited to a small number of engineers under mandatory 2FA. No system is 100% secure, but we take this seriously. If you find a vulnerability, please email **security@voxlysocial.com** — we don't sue researchers acting in good faith. --- ## 6. Children Voxly is **18+ only**. We verify age at signup via a date-of-birth gate and a self-attestation checkbox. If we learn we've collected data from anyone under 18, we delete it immediately. Parents / guardians who suspect their child is on Voxly should email **privacy@voxlysocial.com**. --- ## 7. International transfers Voxly is operated from the United States. If you use Voxly from outside the US, your data will be transferred to and processed in the US and any regions our sub-processors operate in. We rely on the EU Standard Contractual Clauses where applicable. --- ## 8. Retention - **Account & content** — kept until you delete your account, then purged within 30 days. - **Voice moderation transcripts** — deleted 24h after moderation. - **Payment records** — retained 7 years for tax/audit compliance. - **Server logs** — 30 days. --- ## 9. Changes to this policy We'll update the "Last updated" date at the top and, for material changes, notify you via in-app banner and email at least 14 days before the change takes effect. --- ## 10. Contact - **Privacy questions**: privacy@voxlysocial.com - **Security reports**: security@voxlysocial.com - **General support**: support@voxlysocial.com - **Mailing address**: available on request. Thanks for trusting us with your voice.