Privacy Policy
Last updated [ TO FILL — date this document was published ]
This document is not finished. Every amber [ TO FILL — like this ] block is a blank the operator of this app has to complete before it means anything.
The short version
- Your voice audio is never stored. It streams through our server to a transcription provider while you are talking, and then it is gone. There is no recording, no audio file, and no audio in our database.
- The text is stored. Transcripts of your conversations and the scorecards we generate from them sit in our database, attached to your account, until you delete it.
- Three AI companies see your words — Deepgram to turn speech into text, Groq to play the other person, Google to grade the conversation.
- We do not track you. There is no analytics SDK, no advertising pixel and no cross-site tracking in this app. We have nothing to sell and we do not sell it.
- You can delete your account from inside the app — Account settings. It is immediate and irreversible, and it is not quite total: payment records survive as an audit trail, and a one-way record that your email used the free trial survives so it cannot be claimed twice. Section 12 spells both out.
This summary exists so you can stop reading. It is not a substitute for the sections below, and where the two ever disagree the detailed section is the accurate one.
Who is responsible for your data
HardConvo is operated by [ TO FILL — legal entity name ], at [ TO FILL — registered postal address ]. For data protection purposes that entity is the controller of the personal data described in this policy.
Privacy contact: [ TO FILL — privacy@ email address ].
Data protection officer or EU/UK representative, if one is appointed: [ TO FILL — name and contact details, or the words “none appointed” ].
We are not naming a company, an address or a jurisdiction we have not been given. An invented controller identity would be worse than an obvious gap, because it would look like a real accountability route and lead nowhere.
What we collect, and why
This is the complete list of what we hold about you. Where GDPR applies, the last column is the lawful basis we rely on.
| What | Where it comes from | Why | Lawful basis (GDPR) |
|---|---|---|---|
| Email address and password (stored hashed), or an Apple / Google sign-in identifier | You, at sign-up | To make an account that survives closing the app, and to let you back in | Performance of a contract, Art. 6(1)(b) |
| A display name, if you set one | You | To address you in the app | Performance of a contract, Art. 6(1)(b) |
| The personas you build: a name, your relationship to that person, the situation, their traits, your goal, their opening line | You | To generate a rehearsal partner that behaves like the person you are about to talk to | Performance of a contract, Art. 6(1)(b) |
| Conversation transcripts — every turn of text, yours and the persona’s, in order | You (typed, or transcribed from your voice) and the model | To keep the conversation coherent while it runs, to show you your history, and to grade it afterwards | Performance of a contract, Art. 6(1)(b) |
| Scorecards: three scores, a summary, turning points, suggested alternative phrasings, and which model produced them | Generated from your transcript | This is the product | Performance of a contract, Art. 6(1)(b) |
| Conversation metadata: mode (voice or text), start and end time, duration, credits charged, and a latency measurement | Measured by our server | To bill credits correctly and to know whether the voice pipeline is fast enough | Performance of a contract, Art. 6(1)(b); legitimate interests for the latency figure, Art. 6(1)(f) |
| Credit balance, and a ledger of every change to it including the store transaction id of a purchase | Purchases, and our own metering | So we can tell what you have paid for, and so a purchase notification delivered twice cannot grant the same credits twice | Performance of a contract, Art. 6(1)(b); legal obligation for records we must keep, Art. 6(1)(c) |
| Short-lived voice session tickets, stored only as a hash and deleted after 30 seconds or on first use | Generated when you start a voice conversation | So the address of a live voice connection cannot be reused by anyone who sees it | Legitimate interests — security, Art. 6(1)(f) |
| Counts and timestamps of conversations started, used for rate limits | Your own activity | To stop one account running up an unbounded provider bill | Legitimate interests — abuse prevention, Art. 6(1)(f) |
| A one-way keyed record derived from your email address, created when you delete your account (no plaintext address, and the key is held on our server) | Derived from your own account at the moment you delete it | So the one-off free trial cannot be claimed again on the same email address | Legitimate interests — abuse prevention, Art. 6(1)(f) |
| Server and platform logs: IP address, timestamps, request paths, error details | Automatically, on every request | To keep the service running and to investigate faults and abuse | Legitimate interests — security and service integrity, Art. 6(1)(f) |
What is not in that table: your contacts, your location, your device identifiers, your other apps, and any audio recording. We do not ask for those and we have nowhere to put them.
Our logs record operational events and error text, not the content of your conversations. One honest exception: a database error is logged with the message the database produced, and such a message can quote a fragment of the row that caused it — so a failed write of one conversation turn could leave part of that turn in a log line. Those logs are kept for our hosting platform’s retention period and are not used for anything else.
Your voice: exactly what happens to the audio
This is the part people actually want to know, so here is the whole path, step by step.
- Your device captures the microphone as small chunks of raw audio — 80 milliseconds each — only while a voice conversation is open, and only after you have granted the microphone permission your operating system asks for.
- Each chunk is sent over an encrypted connection to our server, which forwards it immediately to Deepgram for transcription. Our server holds a chunk only long enough to pass it on. If the connection to Deepgram is still opening, a few seconds of audio wait in memory for it — never on disk — and are dropped if it does not come up.
- Deepgram returns text. Our server keeps the text and has no further use for the audio, which is discarded. Nothing writes audio to a file, a bucket or a database row.
- Partial, in-progress transcriptions — the words that appear while you are still speaking — are shown to you and then thrown away. Only the finished version of each turn is stored.
- The voice you hear back is synthesised on demand from the persona’s text, streamed to your device as it is generated, played, and discarded. It is not stored either.
We hold a written transcript of what you said, and no recording of you saying it.
What Deepgram does with the audio after it leaves us is governed by Deepgram’s terms and privacy policy, not by this one. If you need a contractual guarantee that a provider does not retain or train on your audio, that has to be agreed with that provider directly: [ TO FILL — state which provider data-processing terms are in place ].
What the AI providers see
HardConvo is not one model. Each part of a conversation goes to the company best at that part, which means your words leave our systems. Here is who gets what.
| Who | What they do | What we send them | Where |
|---|---|---|---|
| Deepgram | Speech-to-text while you talk and, by default, the persona’s synthesised voice | Your microphone audio while a voice conversation is open; the text of the persona’s replies | United States |
| Groq | Runs the persona — generates what the other person says back | The persona description and the conversation so far, on every turn | United States |
| Google (Gemini API) | Grades the conversation and writes the scorecard | The full transcript of the conversation being graded | United States |
| Cartesia · Google Gemini TTS | Alternative voice synthesis, only where the operator has configured one instead of Deepgram | The text of the persona’s replies | United States |
| Supabase | Database, authentication, and the server that runs the conversation | Everything in section 3 that is stored at all | [ TO FILL — Supabase region — check the project dashboard ] |
| RevenueCat | Records purchases and tells our server which credits to grant | Your account id, the product bought, and the store transaction id | United States |
| Apple · Google | Take the payment for in-app purchases and subscriptions | Whatever your app store account already holds. We never see your card details | United States and elsewhere |
| Stripe | Takes the payment for purchases made on the website | Your card details, entered directly into Stripe’s own form. We never see them | United States |
| hCaptcha (Intuition Machines) | Anti-abuse challenge on sign-up, where the operator has enabled it | Your IP address and browser signals, at sign-up only | United States |
Every one of these is a processor acting on our instructions for the purpose in the second column. None of them is paid to advertise to you, and none receives your data for their own marketing.
Whether a given provider retains what we send, and whether they use it to train models, is set by our contract and configuration with that provider — not by this page. The current position: [ TO FILL — for each provider, state the retention and no-training terms actually agreed, or say that only the standard public terms apply ].
Payments
We do not process payments and we never see your card. On iOS and Android the purchase goes through Apple or Google. On the website it goes through Stripe’s own hosted card form. In both cases RevenueCat sits in the middle and tells our server one thing: that account X bought product Y, with transaction id Z.
What we store from that is a ledger row: which product, how many credits it granted, and the store’s transaction id. We keep the transaction id so that a notification delivered twice cannot grant the same credits twice.
Your billing address, card number and store purchase history stay with Apple, Google and Stripe under their own privacy policies. We cannot see them and we cannot delete them.
Guest accounts
You can start using HardConvo without giving us an email address. That creates a real account with no identifier attached to it, held together only by a token in your browser or on your device.
Two consequences worth understanding. First, we genuinely do not know who you are, so we cannot answer a request about that account from anyone — including you — because there is nothing to verify you against. Second, if you clear your cookies or app data, that account becomes unreachable: the rows still exist but nobody, us included, can get back into them. Adding an email address or an Apple or Google sign-in later attaches your existing history to a real identity and fixes both.
Cookies
The website sets cookies for one purpose: keeping you signed in. They hold your session token so the server can tell it is you between page loads. Signing out clears them.
There are no analytics cookies, no advertising cookies and no third-party tracking of any kind on this site — not because we turned them off, but because no such code exists in the app. That is also why you are not being asked to accept anything.
Where the anti-abuse challenge is enabled on sign-up, hCaptcha may set its own storage when it runs. That happens on the sign-in screen only.
Security
What is actually implemented, rather than a list of adjectives:
- Everything is transported over TLS, including the live voice connection.
- Database access is restricted per row: a signed-in account can read and write only its own conversations, messages, scorecards, personas and credit balance. The database enforces this, not the app.
- The address of a live voice connection carries a single-use ticket that expires in 30 seconds and is stored only as a hash — not your login token — so a leaked URL is worth one conversation, once.
- The website ships a strict Content Security Policy, so a script that somehow got into a page could neither run nor phone home.
- Your password is stored by our authentication provider as a hash, never in plain text.
None of that is a promise that nothing can go wrong. If a breach affects your personal data and the law requires us to tell you, we will.
How long we keep things
Plainly: there is no automatic expiry. Your conversations, transcripts and scorecards stay in your account until you delete them or delete your account. We do not currently run a job that ages anything out, and we would rather say so than describe a retention schedule we do not operate.
- Voice session tickets: 30 seconds, or immediately on use.
- Credits, and the ledger of how you got them: credits never expire. Purchase records are kept for as long as we need them for tax and accounting — [ TO FILL — retention period required in your jurisdiction, e.g. 7 years ] — and they survive deletion of your account in pseudonymised form (section 12).
- The record that an email address has used the free trial: kept indefinitely, because a record with an expiry date would simply hand the free trial back out again on that date (section 12).
- Server and platform logs: kept for our hosting platform’s log retention window — [ TO FILL — log retention period, from the Supabase plan in use ].
- Database backups: deleting your account removes your data from the live database immediately, but a copy can persist in an encrypted backup until that backup ages out — [ TO FILL — backup retention period, from the Supabase plan in use ].
Deleting your account
You can delete your account from inside the app, without emailing anyone: Account settings → Delete account. You are asked to type a confirmation word first, because this cannot be undone.
Deletion here is thorough but it is not total, and the honest version of that is worth more than a reassuring one. Two things survive on purpose. Both are described below.
What deletion removes
Your login record is deleted, and the content keyed to it goes with it: your profile, every persona you built, every conversation, every message in those conversations, every scorecard, and your credit balance.
Deletion also removes the authentication records that would otherwise survive because nothing links them back to a deleted user: the sign-in audit entries (including the one written about your deletion, which carries your email address), any pending sign-in flow records, and your refresh tokens.
What is kept after you delete, and why
- Payment records. When you delete your account we keep the credit transactions themselves — amount, reason, store transaction id and date — with your account identifier removed; the store transaction id remains traceable by our payment processor, so this record is de-identified rather than anonymous. Lawful basis: our legal obligation to keep transaction records, Art. 6(1)(c), and our legitimate interest in an auditable financial trail, Art. 6(1)(f).
- A record that this email address has used the free trial. If you used your free trial and then deleted your account, we keep a one-way keyed hash of your email address and the date, and nothing else, so that the free trial cannot be claimed twice. Lawful basis: legitimate interests in preventing abuse of a free allowance, Art. 6(1)(f). It is not used for any other purpose.
What is actually stored is one row holding an HMAC-SHA256 of your normalised email address — lowercased and trimmed, with any+tagremoved and, for Gmail addresses, dots removed — keyed with a secret held in our server-side secret store, plus the date it was recorded. No plaintext address, no account id, and nothing about what the account did. A row is written only if the free conversation was actually used; accounts that never used it leave nothing behind. Because the value is keyed, it cannot be reversed by anyone who obtains the table without also holding that key.
Three limits on that second one, stated plainly. It is keyed to an email address, not to a person: a different address is a different record, and the free conversation is single-use per email rather than single-use per human. Because addresses are normalised before hashing, an address of your own that genuinely contains a + may be treated as the same address as one without it. And a guest account has no email address at all, so nothing can be recorded for one.
What deletion also does not remove
- Any remaining credits are gone, not refunded. If you have a balance you paid for, spend it or keep the account.
- An active subscription is not cancelled by deleting your account. It lives in your Apple or Google account and only you can cancel it there — iOS: Settings → your name → Subscriptions; Android: Play Store → Payments & subscriptions. A renewal that arrives after deletion is still charged and has no account left to credit, so the money buys nothing. See the Terms of Use.
- Nothing is restored if you come back. Signing up again, even with the same address, creates a brand-new empty account: no past purchases, and no free trial.
- Purchase records held by Apple, Google, Stripe and RevenueCat. Those are their records, under their policies.
- Anything the AI providers retained under their own terms when we sent them a request. We can stop sending; we cannot reach into their systems.
- Records we are legally required to keep, such as transaction records for tax purposes.
- Copies inside encrypted database backups, until those backups age out (section 10).
- Server log lines already written. Those age out on the schedule in section 10 rather than on request.
If you are signed in as a guest and you have lost the token that identifies you, we cannot delete that account for you — we have no way of knowing which one is yours. See section 7.
Who else sees your data
The processors in section 5, for the purposes stated there. Beyond that: nobody, with three exceptions.
- If we are legally compelled — a valid court order or equivalent legal process. Where we are permitted to tell you, we will.
- If it is necessary to establish, exercise or defend a legal claim, or to investigate abuse of the service.
- If the business is sold or reorganised, in which case your data moves with it and this policy continues to apply until you are told otherwise.
We do not sell personal data. We do not share it for cross-context behavioural advertising. There is no advertising in this product.
Where your data is processed
Most of the providers in section 5 are in the United States, so if you are in the UK, the EEA or Switzerland your data will be transferred there.
The transfer mechanism we rely on: [ TO FILL — state the mechanism — e.g. Standard Contractual Clauses, the UK Addendum, or the EU–US Data Privacy Framework where the provider is certified ].
Your rights
If the UK or EU GDPR applies to you, you have the right to access your data, to correct it, to have it deleted, to restrict or object to our processing of it, to receive a portable copy, and — where we rely on consent — to withdraw that consent at any time.
The fastest route for most of these is the app itself: your history is visible to you at any time, and deletion is one screen away. For anything else, write to [ TO FILL — privacy@ email address ] and we will respond within one month.
You also have the right to complain to your data protection supervisory authority. In the UK that is the Information Commissioner’s Office; in the EEA it is the authority for your country. Our lead supervisory authority, if we have one: [ TO FILL — lead supervisory authority, or “not applicable” ].
Automated decision-making: the scorecard is generated by a model, but it has no legal or similarly significant effect on you — it is feedback on a rehearsal. Nothing in this app makes an automated decision about your access to anything.
US state privacy rights
If you live in California, or another US state with a comprehensive privacy law, you have the right to know what we collect, to get a copy, to correct it, to delete it, and not to be discriminated against for exercising any of that.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of. Deletion is in the app; for anything else, write to [ TO FILL — privacy@ email address ].
Sensitive subjects, and what not to type in
People rehearse the conversations that matter, which means transcripts here can touch health, money, relationships, immigration status, religion, sexuality and worse. We know that. We do not analyse it for anything other than producing your scorecard, we do not build profiles from it, and we do not use it to train models.
Two things we ask of you, because they are the parts we cannot control:
- Do not include more detail than the rehearsal needs — especially other people’s medical, financial or identifying details. The persona works from traits and a situation, not from a case file.
- Remember that what you type or say is sent to the providers in section 5 to be processed. If something must never leave your device, do not put it in a conversation.
If a conversation stops being a rehearsal — if you are describing real danger to yourself or from someone else — the persona is built to break character and point you to help rather than carry on playing a part. In the US you can call or text 988; elsewhere, findahelpline.com lists local services. HardConvo is not a crisis service and cannot alert anyone on your behalf.
Children
HardConvo is not for children. The minimum age to use it is [ TO FILL — minimum age — this policy and the Terms both assume 18, and it must match the age rating declared in App Store Connect and Google Play ], and we do not knowingly collect personal data from anyone below it.
If you believe a child has created an account, write to [ TO FILL — privacy@ email address ] and we will delete it.
Changes to this policy
If we change what we collect, who processes it, or how long we keep it, we will update this page and change the date at the top. If the change is significant we will tell you in the app before it takes effect.
Contact
Privacy questions, rights requests, and anything you think this page gets wrong: [ TO FILL — privacy@ email address ].
Postal address: [ TO FILL — registered postal address ].