Local by default. Explicit at every boundary.

Bundled local cloning, dubbing, transcription, and speech workflows run on your machine. Their recordings, generated audio, transcripts, and derived voice data are written to storage you control; this website and the VoiceStudio control plane do not receive them.

The app can use the network when you ask it to check for updates, download a model, or configure an explicitly network-backed adapter. A network-backed adapter is a separate processing choice and follows that provider's notice and terms. Local operation remains available without an account, API key, or Cloud connection.

Pro runs voice, dubbing and transcription work on your computer, and those files are not sent to us. To run Pro, the app signs you in and checks your licence, so the data below is sent. Features you turn on yourself, such as remote workers, settings sync or an online translator, send what they need to the destination you chose.

Account. You sign in through our own identity service at id.voicestudio.sh. It holds your email address, name and profile details, and records each sign-in with its time, IP address, country and browser details. Sign-in events and session network details are removed after 90 days.

Licence and devices. Activating a device sends a random installation ID, a device name (your computer's hostname unless you change it), the platform, app version, operating-system version and a device key. Each licence check also records the IP address, its country and the time, replacing the previous values on that device record. Your devices appear in your account, and an organisation's admins can see its members' devices. A valid licence keeps Pro working offline for up to 72 hours.

Trial. To allow one trial per account and device, we keep the account, the start and end dates, and hashes of the random installation ID and device key. We do not use a hardware identifier. This record is kept after account deletion.

Settings sync. This is off by default. When you turn it on, your settings, shortcuts, favourites and device preferences are stored on our servers with the device's name, platform, app version, IP address and country. This data is not end-to-end encrypted, so we can read it. Voice sync is off by default. Turning sync off stops syncing; choosing to remove the data from the cloud deletes it.

Your own sync storage. Sync to your own WebDAV or S3 server is end-to-end encrypted before upload, and nothing reaches us.

Usage analytics. The Pro desktop app automatically sends usage and error metadata to Supermetry (app.supermetry.com), and there is no switch to turn this off. It covers screens viewed, features used, sessions, installs, updates, crashes and coarse error classes, linked to a random installation ID and, when you are signed in, a hashed account ID. It never includes your text, audio, files, raw error messages, email address or account ID. The Pro phone apps ask first and have a Privacy switch.

Dashboard activity. While you are signed in to the dashboard we record the kind of page you have open, whether the tab is in use, the main actions you take and errors you hit, so our support staff can see when you may need help. Only our staff can see it, every look is logged, and we keep it for 30 days and delete it with your account. We never record what you type, and we record nothing if your browser sends Do Not Track or Global Privacy Control.

Updates. Update checks go to appapi.voicestudio.sh. Stable checks carry no credential, and beta checks carry your account token. Installers download from Cloudflare R2 through short-lived links.

Bug and content reports. Bug reports are sent only when you choose to send them or turn on automatic crash reports, which are off by default. Logs are scrubbed of tokens and home-folder paths first. If you tap Send on a phone content report, we receive the reason, your note, any prompt text you include, and the platform, app version and model. We keep it for 180 days.

Deleting your account. Request deletion in the dashboard, which you can open from Settings → Account in the app. After review, and within seven days of approval, we delete your stored content, synced data and credentials, delete your login and anonymise your user record. We keep orders, payments, licences, device records (including the device name and last IP address), usage, audit and trial records, for tax, fraud prevention and licence records.

Cloudflare delivers this site and its same-origin API routes. It necessarily processes request metadata such as IP address, user agent, requested URL, timestamps, and security signals. The site sets no advertising cookies, runs no advertising scripts, and does not sell visitor information.

The maintainer avatar from GitHub and ranking badge from Trendshift can be requested directly by your browser. Those services receive ordinary request metadata, including your IP address and this site's origin-level referrer. Star, release, and download metadata are fetched by our server. Fonts, prerecorded audio, and other site assets are served from this domain.

We measure how the public pages are used with analytics software we operate, including app.supermetry.com and plausible.voicestudio.sh; no third-party analytics service receives the data. For a page view it sends the page address, the referrer, your screen width, and how long the page was open and how far you scrolled. It sets no cookies and stores nothing in your browser. Like any web server, ours sees the IP address and browser user agent of the request that carries these events.

It runs only on the public pages (the home page, product pages, documentation, and the checkout page), never in the signed-in app, and not when your browser sends Do Not Track or Global Privacy Control.

The Studio showcase and voice cards primarily play prerecorded audio and never request microphone access. If you use an editable Text-to-speech preview, the same-origin route receives up to 200 characters of text and the selected voice settings. When a reviewed VoiceStudio preview backend is configured, the route forwards that request to it for on-demand synthesis; otherwise it returns a bundled sample. It never forwards preview text to a third-party TTS provider.

The application does not persist preview text or generated preview audio and excludes request bodies from application logs. The hosting edge still processes ordinary HTTP metadata as described above. Do not enter secrets, personal data, or text you are not allowed to process into a public preview.

If you enter your email on the Cloud page, we store the normalized address, your explicit consent and its purpose, submission time, delivery state, and a non-secret retry key. A commercial enquiry can also contain the company and message you choose to provide.

Early-access details are used for an automatic receipt and one Cloud launch notice. Commercial-enquiry details are used for an automatic receipt and to answer that enquiry. They are not used for training, advertising, a newsletter, or an unrelated campaign.

PostgreSQL is the authoritative record. Email, internal notification, and CRM/webhook delivery are bounded retryable projections. We keep active form records for at most two years, then delete the record and delivery history in bounded retention batches. Retry keys expire after 30 days. Distributed rate-limit buckets become eligible after their 10-minute or one-hour window and are removed by the next bounded retention pass.

For abuse prevention, the website edge sends the control plane a signed visitor IP address and edge request marker. The control plane immediately converts the IP address to a keyed one-way digest; it never stores the raw address in the marketing tables. A hidden honeypot and distributed IP/address limits supplement the edge's bot controls.

Approved notification, email, and CRM/webhook processors receive only the fields needed for the relevant delivery. Their identity, processing region, deletion support, and contract must be recorded in the deployment processor inventory before forms are enabled. Provider response bodies and submitted contact details are excluded from application logs.

Reply to a message, or write to privacy@voicestudio.sh, and we will handle a verified access, export, correction, consent-withdrawal, or deletion request. Deletion clears the contact fields and cancels pending deliveries. We retain only a keyed suppression digest so the address is not silently re-added; it is not used to contact or profile you.

A live-database deletion can remain in encrypted backups for no more than 35 days. A restored backup must reapply completed deletion cases before it can serve traffic.

Buying Pro or Lifetime sends your payment details to a third-party payment provider, and the payment processors it works with, under their own notices. VoiceStudio never receives or stores card or other payment details. The order record keeps your email, plan, seat count, billing country (and, for India, state and any GSTIN you give), amounts, any coupon code you enter, the payment provider used and its order or transaction reference, and the payment status, including failed attempts and the provider's reason for a failure. It also keeps the IP address your checkout request came from and the user agent your browser sent, which names your browser and operating system. To record which country that IP address is in, we send the IP address, and nothing else, to an IP-geolocation service and keep only the country it returns.

Buying through the App Store or Google Play is handled by Apple or Google under their own notices. We keep the store's transaction identifiers and encrypted purchase evidence, and we keep them after account deletion.

We use these details for fraud prevention and abuse limits (rate limiting), order support, tax and invoicing records, and investigating payment problems, and so the order and its Commercial License can be verified and refunded. Only VoiceStudio platform administrators can see order records, and every view of one is logged. Order records, including the IP address and browser, are kept indefinitely. The payment provider may process your payment outside your country under its own notice. Purchases are for adults; we do not knowingly collect children's data.

Retention, processors and deletion are summarised in the data policy. Refunds and delivery are covered in the refund policy and the delivery policy.

The subscription page records the email address, topics you choose, the source of the request, the version of the consent text, and the time and country of confirmation. Requesting a subscription sends a single-use confirmation link; opening the page alone does not subscribe you. Customers are not subscribed merely because they have an account, order, or licence.

Unsubscribe and preferences links use expiring tokens and need no account. Unsubscribing from everything clears the address and other contact fields in the same transaction. We retain only a keyed one-way digest and the unsubscribed state so the address is not silently added again. Account, purchase, licence, and transactional email records are separate and are not changed.

Unconfirmed requests are deleted after seven days. Confirmed subscriptions must be reconfirmed every 24 months or the address is removed. Mailing emails contain no tracking pixel or click tracking. Delivery processors receive only what is needed to send the chosen topic and handle bounces or complaints.

The public Cloud API and hosted job submission are not released. Documentation and disconnected screens that describe them are previews, not live services.

Before a hosted Cloud release is enabled, this notice must be updated with its final processors, regions and retention rules.

You can ask what we hold about you, ask for a portable copy, correct it, withdraw consent, or ask us to delete it. Write to privacy@voicestudio.sh. If we do not resolve a complaint, our grievance officer and the escalation steps are on the contact page.

The VoiceStudio repository maintainers own this public notice. A material data-flow change must update the reviewed inventory, this page, and the effective date in the same release. Qualified counsel must review the intended launch surface and jurisdictions before hosted customer-content processing or payment is enabled.

Questions or rights requests go to privacy@voicestudio.sh. If a release cannot meet its published notice, the affected surface stays disabled or is rolled back; the local desktop product remains usable.