Privacy Policy

The short version

• Vochestra keeps its workspace, recent activity, notes, learned habits, action receipts, and captures locally, subject to the retention limits below.
• The Gemini Live conversation sends audio directly from your Mac to Google under your own API key. Content needed for a request may also be sent directly to Gemini; this can include screen, file, terminal, browser, clipboard, contact, email or message, note, and remembered-context data.
• The Vochestra operator does not receive that raw conversation or requested content through the Gemini connection. We receive it only if you deliberately include it in a report, support message, contact form, or early-access request.
• We do not sell or rent personal data, and we do not use it for advertising.

Data processed from your Mac

Gemini voice conversation. When voice mode is active, microphone audio is streamed directly to the Google Gemini Live API using the Google API key you supplied. Gemini returns speech, transcripts, and tool requests. Google processes this data under your Google account, API settings, and Google's terms and privacy policy; the Vochestra operator is not an intermediary for this traffic.

Speaker echo and media reference. When you use Mac speakers, Vochestra can use Apple's ScreenCaptureKit to read system-output audio locally as an acoustic reference. This helps distinguish your voice from Vochestra's own speech, music, and video playing through the speakers. The reference stream is processed in memory; Vochestra does not store it or transmit it to Gemini or the Vochestra operator. Microphone audio can still naturally contain sound audible in the room.

Context used to answer or act. Vochestra does not send every local item automatically. When your request needs content, however, the relevant content may be placed into the Gemini conversation. Depending on what you ask, that can include a screenshot or screen text, file name/path/content, terminal or agent output, public-browser page text and link targets, clipboard or selected text, contact details, email/message content or recipient, notes, learned preferences, recent conversation context, and tool results. Avoid asking the app to process content you do not want Google to receive.

Captions. Vochestra uses Apple's on-device speech recognizer only when the current Mac and language support on-device recognition. It does not silently switch that recognizer to Apple's network service. If on-device recognition is unavailable, the caption fallback is Gemini's transcript from the already-networked voice conversation.

Coding-agent tools. Terminal panes and their display are local to your Mac. Claude Code, Codex, Gemini CLI, OpenCode, Cursor, Grok Build, and other tools you configure may send prompts, attached files, or agent context to their own providers according to your account and configuration. Deep-reasoning fallback currently supports configured Claude Code or Codex CLIs in restricted, non-interactive modes; it does not use Gemini CLI or Grok Build for that fallback.

Websites and Mac services. A public page opened in Vochestra's canvas browser is requested directly from that website, which will receive ordinary web-request data such as your IP address. Actions involving mail, messages, calendars, contacts, maps, music, or other apps are also subject to the privacy practices of the services and accounts you use.

Local storage and retention

• Secrets. Your Gemini API key and license key are stored in the macOS Keychain.
• Recent activity. User and assistant transcript entries, plus tool capability names without tool arguments, are retained for up to 30 days, capped at 500 entries and 300 characters per entry.
• Usage totals. Aggregate token, turn, tool-call, and session counters remain until you reset them. API-reported token counts are used directly; a cost for an unknown future model may use the closest published rate and is labeled as an estimate.
• Learned habits. Inferred app, folder, agent, and site preferences are kept for up to 90 days and may be evicted sooner when the bounded store reaches capacity.
• Notes. Notes you explicitly ask Vochestra to remember remain until you delete local conversation and learned data.
• Action receipts. A bounded safety ledger keeps privacy-safe action state for up to 7 days, with at most 512 entries. It stores a hash of canonical arguments rather than raw arguments.
• Workspace and captures. Canvas layout, settings, and user-requested screenshots/captures remain until you remove or reset them. They are separate from the conversation-and-learned-data deletion control.

Vochestra's private application-support and capture directories use owner-only POSIX permissions (0700), and the protected local data and capture files it creates use owner-only permissions (0600). These permissions reduce access by other local accounts; they do not replace FileVault, a strong macOS login password, or normal device security.

Data the Vochestra operator collects

License, trial, and activation. When you receive or activate a trial, or buy and activate a paid license, we store the associated email, license key, plan, paid-or-trial status, terminal limit, entitlement-policy version, trial start and expiration when applicable, and activation details: device name, macOS version, app version, and a one-way hash derived from the Mac hardware identifier. We use these records to issue access, enforce its device, feature-scale, and time limits, and distinguish trial access from paid licenses. The app enforces the live agent-or-shell-terminal count locally per Mac; it does not send us a live list of your running terminals.

Optional app analytics. App analytics are off by default. If you enable them in Settings, the app can send event types such as app launch or voice-session start, timestamp, app version, and a SHA-256 device pseudonym. A daily reliability rollup can include tool capability names, coarse outcome counts, latency buckets, fixed failure categories, and OS/app version. It does not include prompts, transcripts, tool arguments, file paths, URLs, app targets, screen content, or raw error strings.

Reports you send. If you submit an in-app report or crash report, we receive what you write, any attachment you choose, optional contact email, and diagnostic metadata such as app/macOS version, device name, and machine hash. We do not attach your API keys automatically. Review the report before sending it.

Purchases and messages. Creem, our Merchant of Record, processes payment-card data; we receive purchase email, plan, order reference, and amount. If you contact us or request early access, we receive the name, email, use case, and message you submit so we can respond.

Website analytics. This site uses first-party event collection and Vercel Analytics. The first-party events can include page path, anonymous browser and tab identifiers, viewed section, clicked site control, referrer host, campaign tags, device class, language, and coarse country/region/city supplied by Vercel. The random browser identifier is stored in local storage; the tab identifier and viewed-section list are stored in session storage. These events do not contain Vochestra app conversations or local Mac content.

Service providers

• Google — Gemini AI under your API key, plus Firebase/Firestore for our license, app analytics, reliability, report, and website-event records.
• Vercel — website hosting, request infrastructure, coarse request geography, and Vercel Analytics.
• Creem — payment processing and Merchant-of-Record services.
• Our mail service — delivery of license, support, contact, and early-access email.
• Providers you configure — coding agents, websites, and connected Mac or cloud services process data under your own accounts and instructions.

Retention of operator records

We keep trial, license, and purchase records while needed to operate access and satisfy accounting, tax, fraud-prevention, and legal obligations. Support, report, app-analytics, reliability, and website-analytics records are retained while needed to support and improve the product; we do not currently promise one fixed deletion interval for every backend record. You may request deletion of data tied to you, subject to records we must keep for legal or security reasons.

Your controls and rights

• Turn off optional app analytics in Vochestra Settings.
• Use the in-app deletion control to clear recent conversation activity, explicit notes, learned habits, session caption history, and the action ledger. Aggregate usage totals, settings, canvas content, captures, and Keychain items have separate controls or must be removed separately.
• Ask us to access, correct, or delete personal data we hold by emailing info@vochestra.app. Please write from, or identify, the purchase email so we can locate the record.

Security

Network connections use TLS. Local secrets use the macOS Keychain, and private local support files use the permissions described above. Access to our backend is restricted to the operator and necessary service providers. No storage or transmission method is completely secure, so keep macOS and your configured tools up to date and review sensitive actions before approving them.

Children

Vochestra is not directed to anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we will update the date above and post the current version here.

Contact

Questions about privacy? Email info@vochestra.app.