Privacy Policy

What Vox accesses on your device

• Microphone: accessed only while you are actively recording or pressing a Live Interpretation mic button.
• Speech recognition: Vox uses Apple's Speech framework to transcribe audio on-device by default. For some languages and devices Apple may process audio on Apple's servers — see Apple's Privacy Policy.
• Voice recordings & notes: audio files, titles, transcripts, and annotations you create — stored locally on your device (and optionally in your iCloud account — see below).
• Voice profile (optional): if you train a voice profile, only acoustic characteristics (pitch, MFCC features) are stored locally to improve TTS voice matching. Your voice samples never leave the device.

What Vox sends to OpenAI (opt-in)

• Audio data (cloud transcription): on-device transcription is the default. If you opt in to cloud transcription for higher accuracy, the audio segment is sent to OpenAI's Whisper speech-to-text API.
• Transcription text: when you request a summary, mind map, key points, action items, or Ask-The-Burrow chat, the transcribed text is sent to OpenAI's GPT API.
• Live Interpretation text: when you use Live Interpretation, the recognised sentence text (not raw audio) is sent to OpenAI's GPT API for translation. Audio remains on your device.

iCloud sync (optional)

Vox offers optional iCloud sync so your recordings, transcripts, and metadata are available across your Apple devices. When enabled, audio files sync via Apple's iCloud Drive (CloudDocuments) and recording metadata syncs via Apple's CloudKit service, both subject to Apple's Privacy Policy. You can disable iCloud sync at any time in iOS Settings → [Your Name] → iCloud → Marmot Vox. The app functions fully without it.

The Meeting Bot (optional)

The Meeting Bot is different from on-device recording, and we want to be explicit about it:

• A visible participant: when you send the notetaker into a meeting, it joins the call as a visible participant through our partner Recall.ai, which captures the meeting's audio. This necessarily includes the voices of everyone in the meeting, not just you.
• Stored on our servers: the meeting recording and its transcript are stored on our servers (hosted on Fly.io, with files stored in Tigris) so they can be processed and delivered to your devices. They are kept for 90 days and then permanently deleted, unless you delete them earlier. You can delete any meeting and its recording at any time from the app or dashboard.
• AI processing: meeting transcripts are processed by OpenAI to produce notes and summaries. Never for AI training.
• Email sign-in: the meeting service uses an email sign-in — the only Marmot feature with an account. Resend delivers sign-in links and meeting recaps you opt into.
• Consent: you must confirm, before every meeting, that participants are aware the meeting is being recorded. The bot always joins visibly, under a name that identifies it as a notetaker. Recording laws vary by place — obtaining any consent your jurisdiction requires is your responsibility.

Meeting capture on the Mac (optional)

On the Mac, Vox can record a meeting locally — your microphone plus the audio playing in the meeting app you choose (system audio). This is the opposite of the Meeting Bot: nothing joins the call, and nothing leaves your Mac.

• Stays on your device: the captured audio is stored locally like every other Vox recording, and is transcribed on-device by default. It is never uploaded to our servers.
• Captured audio includes everyone: system audio necessarily includes the voices of everyone in the meeting. Before every capture you must confirm that participants are aware the meeting is being recorded; recording laws vary by place, and obtaining any consent your jurisdiction requires is your responsibility.
• Gated by macOS: the capture uses the macOS "System Audio Recording" permission, which you can revoke at any time in System Settings → Privacy & Security.

What Vox never accesses

• Your contacts, photo library, location, or camera outside of explicit, optional flows: saving an extracted contact to your address book, importing images, tagging recordings with your location (stored locally, never uploaded), and video recording. Each is gated by its own iOS permission and revocable at any time.
• The microphone outside of an active recording or Live Interpretation turn.

What Stage accesses on your device

• Microphone: accessed only while you are actively recording a ramble.
• Speech recognition: Stage transcribes your audio entirely on-device using WhisperKit. Transcription does not require a network connection and your audio is never sent to a speech-to-text server.
• Voice recordings & transcripts: audio files, transcripts, and the rendered pieces you create are stored locally on your device only. Stage does not offer iCloud sync; a manual export (e.g. a backup) lives wherever you choose to save it.
• Personal Voice (optional): if you enable Apple's Personal Voice, Stage uses it on-device to perform your rendered piece in your own voice. Your Personal Voice data is managed by iOS and never leaves the device.

What Stage sends to our AI provider (opt-in)

• Transcript text (rendering): when you pick a genre and render a piece, the text of your transcript and the chosen genre are sent — over our secure managed proxy — to OpenAI's GPT API to generate the rendered piece. This is the only step that leaves your device, and it happens only when you tap to render.
• Your audio is never sent. Only text is transmitted for rendering; the recording itself stays on the device.

On-device performance (text-to-speech)

Stage performs the rendered piece back to you using Apple's on-device speech synthesis (AVSpeechSynthesizer), optionally with your Personal Voice. The performed audio is generated on your device and never leaves it — which is what lets intimate renders (a eulogy, an apology, a letter never sent) stay private.

What Stage never accesses

• Your contacts, photo library, location, or camera.
• The microphone outside of an active recording.

What Vault accesses on your device

• Camera: accessed only while you are actively scanning a document.
• Photo library: accessed only when you explicitly import an image via the Photos picker.
• Scanned documents, OCR text, and metadata: stored locally on your device (and optionally in your iCloud account — see below).

What Vault sends to OpenAI (opt-in)

• Document images: when you request AI-enhanced OCR, the image is sent to OpenAI's Vision API for text extraction.
• Extracted text: when you use AI Workspace features (summaries, Q&A, key-data extraction), extracted text is sent to OpenAI's GPT API.

iCloud sync (optional)

Vault offers optional iCloud sync so your documents are available across your Apple devices. When enabled, your scanned documents and metadata sync through Apple's CloudKit service, subject to Apple's Privacy Policy. You can disable iCloud sync at any time in iOS Settings → [Your Name] → iCloud → Marmot Vault. The app functions fully without it.

What Vault never accesses

• The microphone.
• Your contacts or location.
• The camera or photo library outside of the scan / import flow.

What Finder accesses on your device

• Camera: accessed only while you are actively scanning a document or using live camera translation.
• Photo library: accessed only when you explicitly import an image via the Photos picker or save an export.
• Contacts (optional): accessed only when you explicitly choose to save an extracted business card to your address book.
• Location (optional): if you grant permission, Finder can tag scans with your location so you can sort and group them by place. Entirely optional, revocable at any time, and never shared or uploaded.
• Scanned documents, OCR text, Spaces, inventory items, places, QR labels, and metadata: stored locally on your device (and optionally in your iCloud account — see below).

What Finder sends to OpenAI (opt-in)

• Document images: when you request AI-enhanced OCR or classification, the image is sent to OpenAI's Vision API for text extraction and understanding.
• Extracted text: when you use AI features (summaries, category briefs, chat, translation), extracted text is sent to OpenAI's GPT API.
• Sensitive documents: scans classified as identity, medical, or financial require your additional explicit consent before any cloud AI runs. On-device models are used where possible.

iCloud sync (optional)

Finder offers optional iCloud sync so your scans, Spaces, and inventory are available across your Apple devices. When enabled, your scanned documents and metadata sync through Apple's CloudKit service, subject to Apple's Privacy Policy. You can disable iCloud sync at any time in iOS Settings → [Your Name] → iCloud → Marmot Finder. The app functions fully without it.

Biometric lock

Finder offers optional Face ID / Touch ID lock to gate access to your private documents. Biometric matching happens entirely on-device via Apple's Local Authentication framework — no biometric data ever leaves your device.

What Finder never accesses

• The microphone.
• Your contacts or location outside of the explicit, optional flows above.
• The camera or photo library outside of the scan / translate / import flow.

What Build accesses on your device

• Camera & LiDAR sensor: accessed only while you are actively scanning a room. Raw camera frames and point clouds are processed entirely on-device via Apple RoomPlan.
• Location (optional): if you grant permission, Build may tag scans with your approximate location for organization. Entirely optional, revocable at any time.
• 3D models, measurements, floor plans, snapshots: stored locally on your device.

What Build sends to OpenAI (opt-in)

• Structured room metadata: when you request AI design suggestions, room dimensions, furniture placements, and layout data are sent to OpenAI's GPT API.
• No raw scan data: raw camera frames, LiDAR point clouds, and 3D model files (USDZ) are never transmitted to any third party.

Shared 3D tours (web viewer)

When you publish a 3D tour and someone opens its web link (the /viewer/ or /embed/ pages), our server records the visitor's IP address to count unique views and produce the aggregate view, duration, and share statistics shown back to you in the app. IP addresses are used only to de-duplicate view counts, are stored in aggregate (capped), are never sold, and are not used to identify individual visitors. No cookies or trackers are placed on the visitor's device.

Biometric lock

Build offers optional Face ID / Touch ID lock to gate access to your saved scans. Biometric matching happens entirely on-device via Apple's Local Authentication framework — no biometric data ever leaves your device.

What Build never accesses

• The microphone.
• Your contacts or photo library.
• The camera or LiDAR sensor outside of an active scan session.

What Hera accesses on your device

• HealthKit (with explicit per-type permission): heart rate, resting heart rate, HRV, sleep duration and stages, steps, active calories, workouts, respiratory rate, VO2 max, weight, body fat percentage, water intake, mindful minutes, and basal body temperature (BBT). Each data type requires individual authorization through iOS Health permissions. You can decline any type — the app remains functional with manual logging.
• Onboarding profile: life stage, cycle history, period dates, average cycle length, health goals, height, weight, dietary preferences, and activity level. Stored locally on your device.
• Symptom logs, mood check-ins, water intake, journal entries: stored locally on your device.
• Cycle predictions and BBT charts: computed locally from your data; not sent to any server.

What Hera sends to OpenAI (opt-in)

• Coach messages: when you tap one of the AI coaches (Aria, Luna, Nora, Nova, Sage), your message and a small set of wellness context — recent symptoms, current cycle phase, optionally your sleep quality — are sent to OpenAI's GPT API via our managed proxy.
• No raw HealthKit data (heart rate streams, sleep stages, workout details) is ever transmitted. Only the contextual signals you explicitly include in a coach prompt are sent.
• No data is sent until you grant AI consent. If you choose "Use Device Only" on the consent dialog, no coach messages are ever transmitted.

Subscription state

If you subscribe to Hera Premium, your subscription status (active / expired / billing-grace-period) is synced via Apple's StoreKit and our backend so premium access works across your Apple devices. Payment is handled entirely by Apple — we never receive your card details, billing address, or full Apple ID. Billing, renewal, and cancellation terms live in our Terms § 03 — Subscriptions & Billing.

Cloud sync (optional)

Optional cloud sync of cycle data, symptom logs, and your onboarding profile is end-to-end encrypted between your device and our backend. We cannot read your synced wellness data. You can disable cloud sync at any time in Settings → Privacy & Sync; the app functions fully without it.

Health data export

You can export a doctor-ready PDF report of your cycle history, symptom patterns, and biometric trends from inside the app. Exports are generated entirely on-device. The PDF is yours — Hera does not transmit a copy to any server.

What Hera never accesses

• Your microphone, camera, photo library, contacts, or location.
• HealthKit data of types you have not explicitly authorized.
• Any astrology, divination, zodiac, tarot, or natal-chart data — Hera is wellness only.

Adult-focused

Hera is designed for adult users tracking their menstrual cycle, fertility, and overall wellness. It is not directed at users under 18.