Voice JournalPrivacy Policy
Our approach
Voice Journal is designed to be private. Your journal entries — your audio, transcripts, photos, moods, and tags — are stored on your device. We do not sell your personal information, we do not show ads, and on iPhone and iPad we do not track you across other companies’ apps or websites (on Android, see the Meta ad measurement below, which you can turn off). We do advertise Voice Journal on Facebook and Instagram; to learn which of those ads bring people in, the app tells Meta when it is opened and when Journal Pro or a trial is bought — never your recordings, transcripts or journal entries. You can turn this off in Settings → Privacy → Share installs with Meta. You can optionally protect the app with App Lock (a PIN and, where available, Face ID, face unlock or fingerprint) so others cannot open your journal on your device.
This policy covers the Voice Journal app on Android (Google Play) and on iPhone, iPad and Apple Watch (App Store), including its widgets. It is provided by BitFuzed (registered on the App Store as Bitfuzed (PVT) LTD), “we” or “us”.
What is stored on your device
- Voice recordings you make
- Transcripts of those recordings
- Photos and captions you add
- Moods, topics/tags, places, and dates for each entry
- App settings and preferences (including optional App Lock)
This information lives in the app’s private storage on your device. If you uninstall the app, it is removed with it. We do not keep a copy on our servers unless you choose optional sync (see below).
What we collect (App Store privacy label)
This table mirrors the privacy label shown for Voice Journal on the App Store and applies equally to the Android app, where Meta additionally receives the device’s advertising ID (see “Advertising measurement (Meta)”). Most rows only apply when you use the related optional feature. Data used to track you: none.
| Category | Data type | When | Linked to you? | Purpose |
|---|---|---|---|---|
| Contact Info | Email Address | Only if you sign in | Linked to you | App functionality (your account, backup and sync) |
| Contact Info | Name | Only if you sign in and your provider shares it (e.g. Sign in with Apple or Google) | Linked to you | App functionality |
| Location | Precise Location | While location tagging is on (Settings → Privacy → Record location; on by default, and you can turn it off) | Linked to you | App functionality (tagging an entry with a place) |
| Location | Coarse Location | Approximate region (city/country level) that Firebase Analytics and Performance derive from your IP address | Not linked to you | Analytics |
| User Content | Audio Data | When you transcribe a recording | Not linked to you | App functionality — sent for transcription only, never stored on our servers |
| User Content | Photos or Videos | Only with Journal Pro while signed in (photo backup) | Linked to you | App functionality (backup) |
| User Content | Other User Content | Entry text, transcripts, mood/tags and chat questions — when processed by AI, or backed up if you sign in | Linked to you | App functionality |
| Purchases | Purchase History | If you subscribe to Journal Pro | Linked to you | App functionality (verifying your subscription); third-party advertising (Meta measures which of our ads led to the purchase — see “Advertising measurement (Meta)”) |
| Identifiers | User ID | Your Firebase account ID, only if you sign in | Linked to you | App functionality |
| Identifiers | Device ID | An app-generated device token and the Firebase app-instance ID (not an advertising ID) | Linked to you | App functionality, analytics |
| Usage Data | Product Interaction | Feature and screen events; app opens shared with Meta for ad measurement (unless you turn it off) | Not linked to you | Analytics, third-party advertising (measuring our own ads) |
| Search History | Search History | Place names you type into the place search (sent to MapTiler) | Not linked to you | App functionality |
| Diagnostics | Crash Data, Performance Data, Other Diagnostic Data | Crash reports, performance traces, device model and OS | Not linked to you | Analytics, app functionality |
App Lock
App Lock is optional and runs entirely on your device. Your PIN is stored only as a salted hash on the device — we never receive it. Biometric unlock (Face ID, Touch ID, face unlock or fingerprint) is handled by your device’s operating system; biometric data never leaves the device and is never accessible to us.
Information processed by AI
Your audio is stored on your device. To transcribe a recording, the app sends the audio over an encrypted (HTTPS) connection to our server, a small proxy hosted on Cloudflare, which forwards it to OpenAI (speech-to-text model gpt-4o-mini-transcribe) and returns the text to your device. Our server does not store your audio or your entry text.
The same route is used, with only the minimum necessary text, for mood tags, titles and topics, for the embeddings that let the chat find relevant entries, for the “ask your past self” chat — where only the few entries most relevant to your question are sent — and for the weekly recap. We do not send your entire journal.
OpenAI processes this data as our service provider. Under OpenAI’s API terms it is not used to train their models, and it may be retained by OpenAI for up to 30 days for abuse monitoring before being deleted. We do not use it to build a profile of you.
Your choice: on iPhone and iPad, the app asks for your explicit permission (“Transcribe with AI?”) before anything is sent to OpenAI, and you can turn this off at any time in Settings → Privacy → AI transcription. When it is off, your entries stay on your device and you can write them by hand.
Optional account (sign-in)
An account is not required. If you choose to sign in — with Sign in with Apple, Google, or email, via Google Firebase Authentication — to back up and sync your journal, we process the identifier from your provider (such as your email address and, if shared, your name) to create and secure your account. With Sign in with Apple you can choose to hide your email, in which case we receive Apple’s private relay address.
When you sync, your entry text — transcript, title, mood, tags, place name and coordinates, and dates — is stored in Google Firebase (Cloud Firestore). Your audio never syncs and always stays on your device.
Photo backup (Journal Pro)
Photos sync only if you have Journal Pro and are signed in. Then a smaller copy of each photo you add, with its caption, is backed up to your account so your photos come back on a new device. Before the copy leaves your device it is resized and re-encoded, and its location and other photo details (EXIF) are removed. The original photo on your device is never changed. On the free plan, or if you are not signed in, your photos stay on your device.
Apple Watch
Recordings you make on Apple Watch are transferred directly to your paired iPhone using Apple’s WatchConnectivity framework — no server is involved — and are then handled like any other entry on the iPhone.
Widgets
The iPhone Home Screen / Lock Screen widget reads only your streak count, whether you journaled today, and this week’s pattern, from a container shared between the app and the widget on your device (App Group group.com.bitfuzed.voiceJournal). It contains no entry text, and nothing leaves the device.
Location
Location is optional and only used while you are using the app. If you turn it on, an entry is tagged with a place name and its coordinates. Turning coordinates into a place name uses your operating system’s geocoder (Apple on iOS, Google on Android). Map tiles and place-name search are provided by MapTiler, which receives the map tile requests, the search text you type, and approximate nearby coordinates so it can rank place results. You can turn location off and delete your location history in Settings.
Permissions the app may request
- Microphone — to record your voice entries
- Photos / camera — to attach photos to entries (optional)
- Location (while using the app) — to optionally tag an entry with where you were
- Face ID / biometrics — for optional App Lock
- Notifications — for an optional daily reminder and trial reminder
Each is used only for the feature described, and only when you use it.
Purchases
Journal Pro is sold through Google Play on Android and the App Store on iPhone and iPad. Google or Apple processes the payment; we never see your card details. To unlock Pro, our server verifies the purchase — on iOS it verifies Apple’s signed transaction (StoreKit 2) and receives App Store Server Notifications about renewals and refunds. We store the resulting transaction and subscription state, bound to your anonymous device token.
You don’t need an account to subscribe. If you are signed in, a purchase made or restored while signed in is also linked to your account so it works on your other devices — including on Android if you subscribed on iPhone, and the other way round — when you sign in there. For that we keep, with your account ID, the plan, its end date, which store it came from and a reference to the purchase (for Google Play, the purchase token, so we can check renewals). Signing out takes Pro that came from your account off that device; Pro paid for by the device’s own Google or Apple account stays. A purchase stays linked to the account it was first used with, unless you restore it while signed in to a different account.
Analytics, diagnostics & device token
On both Android and iOS we use Google Firebase Analytics, Crashlytics and Performance Monitoring. This tells us which features people reach, when the app crashes, and when it is slow. We never send the content of your journal — no entry text, no transcripts, no audio, no photos, and no chat messages. What is sent is limited to event names, coarse buckets (for example “a recording between 15 and 60 seconds” rather than its exact length), screen views, crash diagnostics, and standard device information such as model, operating system version, and app version. Like any Firebase app, Firebase Analytics and Performance Monitoring also derive an approximate location (city or country level) from your IP address; it is used only for aggregate analytics, is not linked to you, and is never your precise location. Crash reporting is only active in copies installed from the app stores.
Firebase Analytics uses an app-instance identifier. It does not collect an advertising identifier — on Android its advertising-ID collection is switched off, so only Meta’s ad measurement below can read it — and we do not attach your account to analytics. On iOS, the app does not use the advertising identifier (IDFA), is built without Firebase’s ad-ID support, turns off Analytics’ ad-related signals, and does not ask for tracking permission, because it does not track you.
The app also creates a random device token of its own. It is not an advertising ID; it is used to apply fair-use limits to AI features and to tie a Journal Pro subscription to your device (and, if you are signed in, to your account). A few small, anonymous milestone events (such as finishing onboarding, a first entry, viewing the plans, a first chat, or starting a trial) are sent to our own server with this token so we can understand how people get started.
We do not sell this data, we do not combine it with your journal, and we show no ads in Voice Journal.
Advertising measurement (Meta)
We advertise Voice Journal on Facebook and Instagram. So that we can tell which of those ads lead to installs and subscriptions, the app includes Meta’s App Events SDK. It sends Meta Platforms only that the app was opened, and Journal Pro subscription or trial purchases (product, price and currency), together with device details such as model and operating-system version and, on Android only, the device’s advertising ID.
It never receives your voice recordings, transcripts, journal entries, photos, moods, places, chat messages, email address or account. Nothing in the app sends Meta any event of its own.
On iPhone and iPad the app never asks for permission to track you and does not collect the advertising identifier (IDFA); installs are measured through Apple’s privacy-preserving SKAdNetwork instead. This runs only in release builds from the app stores, and not at all when you turn off Settings → Privacy → Share installs with Meta. On Android you can also reset or delete your advertising ID in your phone’s settings. Meta’s own use of this data is covered by its Privacy Policy.
Who processes data for us
- OpenAI — transcription and AI features (minimum audio/text only).
- Google Firebase — Authentication, Cloud Firestore (sync, only if you sign in), Analytics, Crashlytics and Performance Monitoring.
- Cloudflare — hosts our server (the proxy for AI requests and purchase verification).
- MapTiler — map tiles and place search.
- Meta Platforms — measures our Facebook and Instagram ads: receives app opens and store purchases as described above, never journal content or your account. See Meta’s Privacy Policy.
- Apple — App Store billing, Sign in with Apple, and WatchConnectivity (Apple Watch to iPhone transfer).
- Google Play — billing on Android.
These providers process data only to provide their service to us, and are required to provide the same or equal protection of your data as described in this policy.
Data retention & deletion
- On-device data is kept until you delete an entry or uninstall the app.
- Signing out removes the journal from the device (once it is backed up to your account). Synced data stays in your account until you delete it. Deleting your account also removes the journal from the device you delete it on.
- You can delete your account, all synced data including backed-up photos, and the journal on your device from inside the app (Settings → Account → Delete account). On iPhone and iPad this also revokes your Sign in with Apple token. You can also request deletion through our account deletion page or at the address below.
- Our server does not store your audio or entry text. Data sent to OpenAI may be kept by OpenAI for up to 30 days for abuse monitoring, then deleted.
- Subscription records are kept while they are needed to provide Journal Pro and as required by law.
Your choices & withdrawing consent
- Turn off AI transcription in Settings → Privacy → AI transcription (iPhone and iPad).
- Turn off location tagging and delete location history in Settings.
- Stop sharing app opens and purchases with Meta in Settings → Privacy → Share installs with Meta. On Android you can also reset or delete your advertising ID in your phone’s settings.
- Revoke microphone, photos, location or notification permissions in your device settings.
- Sign out, or delete your account and synced data, in Settings → Account.
- Uninstall the app to remove all on-device data.
Children
Voice Journal is not directed to children under 13 (or the minimum age in your region), and we do not knowingly collect their personal information.
Changes to this policy
Material changes will be reflected by the “Last updated” date above.
Contact
Voice Journal is developed by BitFuzed. Questions or requests, including data deletion: contact@bitfuzed.com.