AI Voice Inbox Privacy Policy

Last updated: August 11, 2026

AI Voice Inbox (the “App”) is operated by Ilia Khabadaev (“we”, “us”). This policy explains what happens to information when you record, transcribe, analyze, back up, or manage an account in the App.

The short version

Recordings, transcripts, and generated notes are stored in the App on your device. If you enable a backup destination, copies are stored in your own iCloud Drive or Google Drive.
When you request processing, audio is sent over encrypted connections through our managed service and CometAPI to Google Gemini for transcription. The resulting transcript and your instructions are sent through our managed service to OpenAI for analysis. Our application server streams that content for the request and does not save it to its database or application logs.
We store account, subscription, quota, and processing-status metadata needed to operate the service. We do not sell personal information, run advertising, or track you across other companies' apps or websites.

Information processed

Content you create

The App may process:

audio recordings;
transcripts;
your processing instructions (prompt);
generated Markdown notes and titles; and
a note location, if you grant location permission.

The original audio remains in the App's local storage. Transcripts and generated notes are returned to and stored by the App. Location is used to label the local note and its exports; it is not included in AI transcription or analysis requests.

When you ask the App to process a note, it sends the audio for transcription and then sends the transcript and your instructions for analysis. Our service does not persist audio, transcripts, prompts, provider responses, or generated notes in its database, cache, or application logs. Responses are marked not to be cached by clients or intermediaries.

Account and authentication information

If you sign in with Apple or Google, we receive the provider-specific account identifier and may receive the email address included in the verified identity token. We assign an internal account identifier. We store hashed refresh-session tokens; raw service refresh tokens are stored only in the device Keychain.

Apple and Google process sign-in information under their own privacy policies. Sign in with Apple may allow you to use an Apple relay email address.

Subscription and usage information

For App Store subscriptions, we process verified transaction identifiers, entitlement status, billing-period dates, and App Store environment. Apple handles payment details; we do not receive or store your payment-card number.

To enforce free and paid limits and make retries reliable, we store metadata such as declared and provider-reported recording duration, job and chunk identifiers, timestamps, status, retry digests, attempt counts, and quota-ledger entries. The free plan permits three successfully processed recordings in a rolling 24-hour window, up to five minutes each. Pro permits 300 minutes per App Store billing period, up to two hours per recording. Limits may change prospectively; the App will show the current offer before purchase.

Operational information

Our service creates content-free operational records such as request identifiers, response status classes, latency, rate-limit counters, and service errors. We configure the service not to log request bodies, authorization headers, tokens, audio, transcripts, prompts, or generated notes.

How information is used

We use information only to:

authenticate accounts and protect sessions;
provide requested transcription and analysis;
calculate and display usage limits;
validate, restore, and maintain subscriptions;
retry interrupted work safely;
prevent abuse and keep the service reliable; and
respond to privacy, security, and support requests.

We do not use App content for advertising or cross-app tracking, and we do not sell it.

Service providers and transfers

We disclose only the information needed for each provider to perform its service:

CometAPI receives audio and the transcription instruction to route the request to the Gemini model. CometAPI states that it does not store user request or conversation content. See CometAPI privacy policy and CometAPI help center.
Google Gemini processes the audio and transcription instruction and returns transcript content. Google's Gemini API terms distinguish paid and unpaid services and permit limited safety logging for paid services; available zero-data-retention controls depend on the exact account and features. See Gemini API terms and Gemini API zero data retention. Because the request is routed through CometAPI, we conservatively treat upstream safety retention as possible unless stricter controls are confirmed for the production route.
OpenAI receives transcripts plus instructions for analysis. We send analysis requests with provider storage disabled (store: false). OpenAI states that API data is not used to train its models unless the API customer opts in, while eligible endpoints may place customer content in abuse-monitoring logs for a limited period unless approved data-retention controls apply. See OpenAI API data controls. We conservatively treat this possible provider retention as applicable unless and until OpenAI confirms more restrictive controls for the production project.
Contabo GmbH provides the server infrastructure in Germany for our managed API and PostgreSQL metadata database. Request bodies and user content are excluded from application logs and are not stored in the service database.
Apple provides Sign in with Apple, App Store billing, StoreKit transaction verification, optional iCloud Drive backup, and related platform services.
Google provides Google sign-in and, only if you separately connect it, Google Drive backup using the drive.file scope. That scope lets the App manage files it creates or that you open with it; the App does not request general access to all Drive files.

The operator is based in Armenia. Our providers may process information in Germany, the United States, and other countries where they operate, subject to their applicable contractual, legal, and security safeguards.

Storage and retention

On-device content: remains until you delete the note or the App, subject to device backups and operating-system behavior.
iCloud Drive and Google Drive copies: remain in your own account until you delete them there. Turning off or disconnecting backup does not delete existing copies.
Service account metadata: account identity, subscription, job, quota, and status metadata remain while the account exists and are deleted when account deletion succeeds, except where retention is required by law or necessary to resolve fraud, security, or payment disputes.
Sessions: service refresh sessions expire after 30 days and may be revoked earlier. Associated database rows are deleted with the account.
Operational logs: contain request identifiers and technical status information but no recording content. Logs are access-restricted and automatically size-rotated, with no more than three 10 MB log segments retained per service. Older segments are deleted automatically when the limit is reached.
AI subprocessors: retention is described in “Service providers and transfers” and may be subject to provider safety or legal exceptions.

Your choices and rights

You can:

record and play audio without signing in; sign-in is required only for managed transcription or analysis;
deny or revoke microphone and location permissions in iOS Settings (microphone access is required to record);
enable or disable iCloud Drive backup;
connect or disconnect Google Drive and revoke access in your Google Account;
delete individual local notes and their local audio;
use Delete Account in App Settings to delete service-side account, identity, entitlement, session, job, and quota metadata; and
contact us to exercise rights available in your jurisdiction.

Deleting the service account does not delete recordings or notes on the device, copies in iCloud Drive or Google Drive, or cancel an App Store subscription. Delete those copies in the relevant storage service and manage or cancel the subscription through Apple's subscription settings.

Security

We use encrypted network transport, short-lived access tokens, device Keychain storage for refresh credentials, verified Apple and Google identity tokens, verified StoreKit transactions, rate limits, content-free logs, and restricted production secrets. No system is completely secure; report a suspected issue to hello@fabrika.ad.

Children

The App is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided information.

Changes

We may update this policy when the App, providers, or legal requirements change. We will update the date above and provide any additional notice required by law. Material changes apply prospectively unless the law permits otherwise.

Contact

Ilia Khabadaev

Aram st. 60, apt. 3-2
Yerevan 0010, Armenia

Email: hello@fabrika.ad