privacy

effective 13 october 2026

this page describes how voboard handles your voice, drafts, account, and usage data. if those practices change, we update this page and ask for new permission when needed.

the short version

your recording never lands on voboard servers. cloud speech goes from your iphone to openai.
signed-in account sync stores saved history (including transcripts and drafts), notes, dictionary, snippets, styles, formats, and scratchpad. we do not store audio, screenshot images, or surrounding cursor context in sync. OpenAI may retain AI requests under its policy.
your saved content is cached separately for each account on each device and syncs automatically across iPhone and Mac. OpenAI sharing is a separate permission. guest content on Mac stays local.
the iphone app sends anonymous product signals and a hashed install identifier to telemetrydeck while anonymous usage is on. you can turn it off in settings. our service separately keeps account-linked usage metadata for limits and product analytics.
on-device English audio stays on the phone. transcripts still go through our service to OpenAI for rewriting.
OpenAI sharing needs your permission in the app. screenshot replies need a separate permission too. both can be revoked in settings.

who we are

voboard is operated by rohan bojja. write to hello@voboard.app.

what voboard is

a voice keyboard for iphone. ios will not let a keyboard extension use the microphone, so the voboard app does the listening. the keyboard shares commands and results with the app, and inserts the result where you are writing. full access allows this sharing and network access. for screenshot replies you request, the keyboard can send the screenshot text or image directly to our service using your signed-in session. full access does not give voboard access to what you type with other keyboards.

open voboard yourself to allow OpenAI sharing and start a voice session, then switch back to the app where you are writing. the keyboard controls that active session; it does not launch voboard for setup, voice, styles, or upgrades. basic typing and switching keyboards with the globe key work without full access or AI permission.

the separate Mac app defaults to on-device English speech. optional pro cloud speech sends audio directly to OpenAI only after you enable cloud audio sharing. AI cleanup is separately opt-in; cleanup, transforms and voice commands send chosen text, limited nearby field context and writing instructions to OpenAI. Accessibility access lets voboard capture and verify a destination field before inserting. some editors use a temporary clipboard paste; previous contents are restored unless you copy something newer. voboard never submits the message. screenshot replies use a separately selected image or window and require additional screenshot-sharing permission. audio, screenshot images and external field snapshots are not stored in account sync. signed-in saved text syncs with your iPhone; guest content stays on this Mac.

permission before AI processing

before voice or AI editing, the app explains that OpenAI receives cloud audio, transcripts, clipboard or scratchpad text you choose to rewrite, nearby text used as context, and style instructions. cloud transcription may also receive dictionary words and spoken aliases as hints. choose allow OpenAI sharing to use those features, or not now to keep them off. microphone permission and full access do not replace this choice. on-device audio stays on the phone, but its transcript still needs OpenAI sharing for the rewrite.

screenshots have an additional permission that names the text or image sent to OpenAI. both permissions must be on before a screenshot is processed, including from the keyboard or a Shortcut. the keyboard cannot turn either permission on. in settings → privacy, turn off share with OpenAI or screenshot replies to stop future requests for those features. turning off OpenAI sharing also turns off screenshot permission and stops active AI work. that does not disable account sync, erase saved account content, or recall data already processed by OpenAI.

the current disclosure requires a new choice from existing users too; an older screenshot permission does not carry forward. the disclosure and settings both link to this policy.

account content and AI requests

account sync stores your latest 200 history entries, including saved raw transcripts and rewritten text, plus notes, dictionary entries, snippets, custom styles and formats, and scratchpad. this happens automatically while signed in, including when OpenAI sharing is off. audio recordings, screenshot images, and surrounding cursor context are not stored in sync. text you save in a note, draft, or history entry may include text from a clipboard or screenshot.

AI requests pass through the proxy in memory and are not printed into application logs. saved account content is stored separately in Cloudflare D1; it is not end-to-end encrypted. the operator console shows account and usage metadata, not a content viewer. service administrators with database access can access stored content for operating the service.

what leaves the phone

your account

email, or the Hide My Email relay address Apple gives us, and the Apple user id when you use Sign in with Apple. we do not ask Apple for your name. the display name we store is that email. a hashed password is stored only when you create one. the session token lives in the iphone keychain and is sent as a bearer token. the app shares the active session credential with its keyboard extension for authenticated screenshot reply requests. a session row on our side may include an ip address and user agent. sessions last up to 90 days. new accounts start on the free plan.

subscriptions

if you buy voboard pro, apple handles the payment; we never see card details. the app buys and restores through revenuecat, which checks the purchase with apple and tells us about renewals, expiries and refunds; older app versions send us the signed transaction apple gives them instead. from those we keep the product, the transaction id, the expiry date, whether it was refunded or revoked, and whether it will renew, linked to your account through a random id we generate. revenuecat knows your purchases by that same random id, not your email. when you delete the account we ask revenuecat to delete its record too. we keep our own purchase record after you delete the account, like usage totals, so refunds and disputes can be checked.

cloud transcription

when voboard pro uses cloud speech — for a supported language or your chosen engine — the app asks our proxy for a short-lived openai realtime token. that request sends language codes and a short hint (for indic speech, that it may be mixed with english). the hint may include words and spoken aliases from your personal dictionary to improve recognition. it does not send audio.

the iphone then opens a websocket straight to openai and streams 24 kHz pcm between your first tap and the tap that stops dictation. the recording does not go through voboard. the token is minted to last up to an hour. we store that a token was minted, the model name, and the time — not the recording.

on-device transcription

when the engine is on-device (automatic for english on ios 26, or if you pick on-device), apple's speech recognizer runs on the phone. that audio does not leave the device. the resulting transcript still goes to the proxy for the rewrite step below.

a voice session keeps the microphone available so later dictations can stay in the host app. it ends after an idle timeout (15 minutes unless you change it). audio only leaves the phone while a cloud dictation is listening, and it goes to openai, not to us.

the rewrite

after a transcript (or clipboard / restyle / chosen scratchpad text) is ready, the app posts it to our proxy with the writing-mode instructions and, when the keyboard had any, a small field snapshot: the kind of field, the return-key label, up to 320 characters before the cursor and 160 after. password and new-password fields are skipped. context over 4,000 characters is dropped rather than stored.

the proxy forwards that to openai chat completions and returns the cleaned text. we store token counts, the model name, and the time so we can enforce a daily cap and see spend. we do not log the AI request body. saved transcripts and drafts are retained separately by account sync.

dictionary corrections are applied locally. saying “insert” followed by a saved snippet cue inserts that snippet without sending its saved text for an AI rewrite. cloud speech still sends the audio of the cue for transcription. copying a snippet or editing the scratchpad does not send that saved text to OpenAI; choosing to rewrite it does.

reply to a screenshot

reply to screenshots is off until you allow OpenAI sharing and confirm the separate screenshot permission in the app. when you send a screenshot of a chat or a profile to draft a reply or an opener, the app or keyboard first reads the chat itself and, when it can, posts only that text through our proxy to openai. when it can't (a profile, photos, or a script the phone doesn't read), the jpeg is posted instead. we do not log that request, and we do not store the jpeg or the extracted chat text. the phone deletes the jpeg after the draft is ready.

the finished draft is saved in account history, marked as coming from a screenshot. that entry keeps the draft's words. if you also spoke a gist, it keeps that transcript; a reply made only from the screenshot leaves the transcript empty. it also keeps the style, casing, format, editing level, reply intent, and the time. it does not keep the picture or the chat text that was sent to openai. signed-in history syncs automatically and keeps the latest 200 entries until you delete them or the account. usage rows for the same request store token counts, the model name, and the time. those rows do not store the words.

usage metadata

after every successful dictation, the app reports the speech engine (cloud or on-device) and duration to our proxy for aggregate usage analytics. on-device audio stays on the phone, and on-device rows do not consume cloud quota. this report contains no audio or text.

anonymous product analytics

anonymous usage is on by default in the iphone app. while it is on, the app sends feature names and coarse labels to telemetrydeck: for example, the speech engine, a built-in writing style, language choice, a speaking-time bucket, or a general error category. custom style names and the original error message are excluded. the sdk also sends a hashed install identifier, a session identifier, session statistics, and device/app information such as device type, operating-system and app versions, and language/region settings. we do not give telemetrydeck your voboard account id, email, transcripts, drafts, prompts, audio, or screenshots. the keyboard extension and native mac app do not send telemetrydeck signals.

turn off anonymous usage in settings → privacy to stop new feature signals. the app queues one final signal recording that choice. signals queued before that choice or requests already underway may still be delivered. turning the setting off does not remove analytics already received by telemetrydeck. these signals are used for product analytics, not advertising or tracking across other companies' apps.

this does not turn off the account-linked usage metadata described above. our service uses those counts, durations, engine and model names for daily limits, cost reporting, and product analytics. those records do not contain your words or screenshots.

password-reset protection

to limit abusive reset requests, our service keeps request counts and protected identifiers derived from the requested email address and the client's IP address. these counters store keyed hashes, not the raw email address or IP address. they do not record whether an account exists or whether a reset email was delivered.

the early-access list

if you leave your email in the early-access form on this site, we store that address, which apps you asked about (iPhone, Mac, or both), which page the form was on, and when. we use it to email you about access to those apps: an invitation, which creates a free account for that address, or a note that the app is available. it is not a marketing list and we do not share it. the form also keeps a request count under a keyed hash of your IP address, like the reset counters above, so one network cannot flood it; the raw IP address is not stored with your request.

local storage and synchronization

each account has its own local cache and offline edit queue. signing out hides that content; signing back into the same account restores it.
history keeps the latest 200 entries across devices. notes and other saved content remain until deleted, subject to the app's storage limits.
deletions reach other devices when they next sync. deleting the app removes its local cache, not your server copy.
simultaneous edits preserve a conflict copy in notes instead of silently replacing your work.
recording recovery, undo state, text-field insertion context, and device preferences remain local. the session token stays in the keychain.
old history without an account owner is deleted during the upgrade. other unowned writing settings are retained locally but are not assigned to or uploaded into an account.

who else processes this

openai. cloud audio (realtime), rewrite text, and screenshot text or jpegs for reply drafts (chat completions). we do not have zero-data-retention enabled. openai states that api inputs are not used to train their models unless a customer opts in, and that they may keep api traffic for abuse monitoring for up to 30 days. that is their policy, not ours — read their data controls.
apple. on-device speech recognition, the usual iphone permissions (microphone, speech recognition), and Sign in with Apple. if you hide your email, the address we store is Apple's private relay address.
revenuecat. subscription purchases and restores: the random account id, your app store purchase history for voboard, and basic device and app details it needs to check purchases with apple. we turned off its advertising-identifier collection.
cloudflare. the proxy and the account database, which also holds the early-access list, run on cloudflare workers and d1. password-reset mail is sent with cloudflare email sending when that is turned on. they may keep technical request metadata (path, status, time). we do not choose one country for every request.
telemetrydeck. receives the anonymous product signals, hashed install identifier, session information, and device/app metadata described above. those records are separate from your voboard account and are not used for advertising. see telemetrydeck’s privacy policy.
operators. the person running voboard can see your email, your plan, and usage totals in the operator console. synced content is not exposed there, but administrators with database access can access it. screenshot images and audio are not stored by account sync. screenshot drafts are history entries, as described above.

we do not sell your data. we do not run ads. we do not track you across other companies' apps. telemetrydeck receives the anonymous analytics described above while anonymous usage is on.

how long we keep what we keep

account and profile: until you ask us to delete them, or we close the account.
sessions: up to 90 days, or until you sign out on that device.
the early-access list: until you ask us to remove you, or you delete the account made with that address. its IP counters expire at the end of a one-hour window, with the same cleanup as below.
password-reset protection: IP counters expire at the end of a 15-minute window and email counters at the end of a one-hour window. expired rows are removed in batches during requests and hourly cleanup; deletion can take longer if cleanup is delayed or has a backlog.
usage rows (counts, tokens, duration, speech engine, model name): these are not tied to a foreign key, so they can outlive the account. after a delete they no longer resolve to your email — they show as a deleted account. they never contained your words.
synced history: the latest 200 entries until you delete them or delete the account. notes and other synced content: until deleted. deletion markers and operation receipts retain IDs, not deleted text, until account deletion to prevent offline retries restoring content.
after account deletion, hashes of formerly valid session tokens may remain until their original expiry (up to 90 days) so returning devices can erase cached content. they contain no account ID or saved text.
purchase records: retained after account deletion to check subscriptions, refunds, and disputes. they keep the transaction and former account identifiers, but the deleted account no longer resolves to your email.

your choices

turn off share with OpenAI in settings → privacy to stop future AI requests. ordinary typing still works.
turn off screenshot replies separately in settings → privacy. the keyboard cannot turn it back on.
pick on-device transcription when the language allows it, so audio stays on the phone.
clear history in the app.
turn off anonymous usage in settings → privacy to stop new telemetrydeck feature signals; previously queued signals or requests already underway may still be delivered.
sign out to drop the token from this iphone. that does not delete the account.
email hello@voboard.app to be taken off the early-access list.
delete the account from settings, or email hello@voboard.app to see, correct, or delete it. we will remove the account, password, sessions, profile, and synced content, and revoke Sign in with Apple when it is linked. usage counters and purchase records may remain without your email, as described above.

children

voboard is not directed at children under 13. if we learn we have an account for a child under 13, we will delete it.

changes

if our data practices change, we update the date and the relevant sections. changes that need new permission will ask for it in the app before processing; continued use does not replace that permission.

contact

hello@voboard.app