Privacy Policy
1. Who we are
Sergei Golubnik (3-y Karacharovskiy proezd, 12, korp. 1, kv. 58, Moscow, 109202, Russia) operates the Voice Assistant AI: Sova app ("the app") and is the controller of the personal data described here. Questions and requests: sgolubnik@gmail.com.
2. What the app does
The app is a voice assistant and a live translator. It sends your speech (and, on your request, a photo) to SovaAI, plays the answer or the translation back, and keeps a money balance for this on our server. There is no account: your phone is recognised by a random identifier created by the app.
3. Data that stays on your phone
Settings, saved notes, the consent flag, the diagnostic log and the random device identifier (in the iOS Keychain). Audio and photos are never written to the phone's storage; the text of the current conversation is shown on screen and kept only while the app runs. Your location, contacts, calendar and reminders are read on the phone only when you ask for something that needs them, with the iOS permission you gave. In developer builds, the developer's own AI-provider key is stored in the Keychain and never sent to our server. The assistant's memory — the name you gave it, the topics of your recent requests (searches, prices, places, notes, calendar entries) and links from answers — is kept only on the phone; you can view, delete or turn it off in Settings → Memory.
4. Data sent to SovaAI
SovaAI is our AI service; it runs on models of OpenAI, L.L.C. (USA), our sub-processor, where the data described here is processed (for users in the EEA the contracting entity is OpenAI Ireland Ltd.). While a conversation or a translation runs, the app streams your voice, the voice of the person you talk to (translator), the text of the exchange and photos you ask for directly from the phone to SovaAI. When you use the assistant's capabilities, the exchange also contains your city and country, the names of contacts you ask about, the text of a message you dictate and the titles of calendar entries you ask about; phone numbers, e-mail addresses and exact coordinates stay on the phone. If memory is on, the start of each conversation also contains your name and your last 5 topics and 3 links from it. The sub-processor processes this data to recognise speech, produce the answer and the translation. Under OpenAI's API terms this data is not used to train models and may be kept for up to 30 days to monitor abuse. Transfers outside the EEA rely on OpenAI's Data Processing Addendum with the EU Standard Contractual Clauses. The app asks for your consent before the first byte of audio leaves the phone; you can withdraw it by deleting the app.
5. Data on our server
Our server (hosted in a data centre in Germany) receives only what is needed for the balance: the random device identifier, the App Store country and the country of your IP address, the balance with its history (starting credit, top-ups, per-session charges in seconds), session metadata (start time, model, duration, token counts) and the transaction identifiers of your App Store purchases. Your voice, photos and the text of conversations never reach our server — they go from the phone straight to SovaAI. The one exception is the assistant's internet search (search and product prices, when you ask for them): the search request, your city and country and, for a price, the photo of the product pass through our server to SovaAI; the server does not store them and keeps only the charge (time, price, token counts). When something goes wrong, the app sends the error lines of its journal (the event, the audio route, the app version and the iPhone model — never audio, photos or conversation text) to our server under the device identifier; we keep them for 30 days to fix the problem. The web server keeps standard access logs with IP addresses for up to 14 days for security. If you allow notifications, the server also keeps the notification token Apple issued for the app, whether you agreed to tips and news, the phone's system languages, region and time zone, the app version, and a record of each notification sent and whether it was opened — so that notifications come in your language, in the daytime and at most once a day. Notifications are delivered by Apple Push Notification service.
6. Apple and purchases
Top-ups are bought through Apple's App Store; Apple processes the payment under its own privacy policy. We receive the transaction identifier and refund notifications, never your payment details or your Apple ID e-mail.
7. Diagnostics
"Crash reports and statistics" in Settings is on by default; you can turn it off there at any time. While it is on, crash reports and anonymous usage events (screens, results of actions) with an installation identifier, the app version and the device model go to Firebase (Google). They never contain speech, photos, the text of conversations or advertising identifiers, and there is no cross-app tracking.
8. Legal bases (GDPR)
Providing the service and the balance — performance of a contract (Art. 6(1)(b)). Sending voice and photos to SovaAI — your consent (Art. 6(1)(a)). Diagnostics (crash reports and statistics), abuse prevention, usage limits and security logs — our legitimate interests (Art. 6(1)(f)); you can object to diagnostics at any time with the switch in Settings. Notifications about calls and messages you asked the assistant to prepare — performance of a contract (Art. 6(1)(b)). Tips and news — your consent (Art. 6(1)(a)), given with “Allow” in the app and withdrawn at any time with the “Tips and news” switch in Settings → Notifications.
9. How long we keep data
SovaAI (sub-processor OpenAI): up to 30 days. Our server: the device record and its balance until you delete them in the app ("Delete my data" in Settings) or after 24 months without use; purchase and charge records are then kept without the device identifier for as long as accounting law requires; access logs up to 14 days. On your phone: until you delete the app or clear the log. Notification records on the server: 180 days; the notification token — until you delete your data, turn notifications off in iOS or delete the app.
10. Your rights
You can access, correct, delete or export your data and object to or restrict its processing. "Delete my data" in Settings erases the device record and its balance on the server immediately. For anything else write to sgolubnik@gmail.com; we answer within 30 days. You may also complain to your data protection authority — in Russia, Roskomnadzor; in the EU, the authority of your country of residence.
11. Other people
The translator also processes the voice of the person you are talking to. Tell them that the conversation is translated through a cloud service (the app shows a card for this) and follow the laws on recording conversations in your country.
12. Children
The app is not intended for children under 13 or under the age of digital consent in your country. We do not ask for a date of birth and do not knowingly process children's data.
13. Security
All connections use TLS. The app never holds a permanent SovaAI key: the server issues a session key valid for one minute for connecting. Our server stores no names, e-mails or payment details.
14. Changes
We may update this policy; the date at the top shows the current version. If a change affects what is sent to SovaAI, the app asks for your consent again.