Privacy Policy
Bold Vocal Drill
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Bold Vocal Drill stores speech titles, dates, thesis cards, timing plans, Time Fold versions, custom recovery questions, rehearsal durations, transition timestamps, sampled loudness levels, pause markers and personal notes on your device. These project and session metadata are also sent to our application backend when connected. Microphone recordings and optional transcripts remain in the app's local storage and are not uploaded. An automatically generated installation identifier and random secret identify this installation; the secret is kept in the iOS Keychain and the server stores its hash. There is no user account, email registration or advertising identifier. The app stores the selected project, rehearsal version and time-display preferences in device preferences. The service and hosting infrastructure receive network request information such as IP address, request time, route and response status. The application disables its HTTP request logger and does not log request bodies or authorization credentials.
How we use information
We process project metadata to save and synchronize your speech preparation, restore queued edits after a connection returns, calculate timing comparisons and provide rehearsal insights. Local recordings support playback, waveform and pause review. Speech recognition is requested only in on-device mode when supported; otherwise recording and manual review remain available. The public question catalog supplies recovery prompts in Indonesian and English. Optional local notifications remind you before a selected speech. Technical request information supports service operation, abuse limits and troubleshooting. We do not use advertising, tracking SDKs, analytics providers or outbound email services.
Service providers and sharing
Our public website and API use Cloudflare to terminate HTTPS and proxy requests to the backend. Cloudflare processes connection information, requested URLs, request headers including installation authorization, and transmitted project or session metadata as needed to provide this routing. Audio recordings and transcripts are not sent through this route. Our backend and its persistent database are hosted on Railway, which processes stored metadata and network requests as infrastructure provider. Any infrastructure or access logs retained by Cloudflare and Railway are governed by their respective service practices. We do not sell your information. There are no third-party advertising, social login or analytics SDKs in the app. On-device speech recognition uses Apple's system framework without an application request to send audio to a remote recognizer. When you choose Export, Apple's share sheet sends the selected audio and text summary to the destination you choose; that recipient's practices apply. Privacy contact correspondence you initiate outside the app is received at prudence.rowntree@icloud.com and is handled by the email provider.
Data retention
Local project data, recordings and transcripts remain until you delete them in the app or remove the app's local data. The app's Application Support folder is excluded from device backups. The installation credential uses device-only Keychain storage and may remain after uninstalling the app. Server project metadata and credential hashes are retained until installation deletion, without an automatic expiration schedule. Deleting a project replaces its server content with a minimal deletion marker to prevent stale synchronization from restoring it; that marker remains until installation deletion. Railway controls the lifecycle of its infrastructure logs and any provider-managed database snapshots. Cloudflare controls any request information retained by its proxy infrastructure. We do not promise a fixed retention duration for either provider. Exported copies are outside the app's storage and follow the destination's retention.
Deleting your information
Delete a speech to remove its local recordings and project contents and queue a server deletion marker. Offline deletion is completed on the server when synchronization succeeds. Settings provides Delete all installation data, which requires a connection and waits for server confirmation before clearing local project storage and recordings. This removes active server project data, deletion markers and the stored credential hash. The local Keychain credential is retained so later use can start a new empty installation without an account. SQLite secure deletion and WAL checkpointing are used for server deletion, but application deletion does not directly erase provider-managed snapshots or infrastructure logs; any such copies follow the provider's lifecycle. Remove exported audio or summaries separately from Files or other recipients. Privacy questions or deletion requests can be sent to prudence.rowntree@icloud.com; we cannot locate anonymous installation data from an email address alone or recover a lost installation secret.
Permissions and your choices
Microphone permission is requested when you start recording. Speech recognition permission is requested only when you choose local transcription; recognition requires device support and never enables a remote fallback. Notification permission is requested only when you schedule a reminder. You can withdraw these permissions in iOS Settings. With microphone access denied, existing plans and recordings remain available but new recordings cannot be made. With speech recognition unavailable, manual pause review and timing drills still work. You can cancel a scheduled reminder in the app or disable notifications in iOS Settings. No location, contacts, camera or photo-library access is requested.
Your privacy rights
Depending on your location, you may have rights to access, correct, export, delete or restrict processing of your information. You can edit projects and notes, export audio and a text summary, delete projects and request deletion of installation data through the app. For privacy questions or requests contact prudence.rowntree@icloud.com. We may need information sufficient to verify control of the relevant installation without requesting your secret by email. There is no account-based identity or cross-device recovery. You may also contact your local data protection authority where applicable.
Security
The app uses HTTPS for backend requests and an automatically generated 256-bit installation secret stored in device-only Keychain storage. Public HTTPS terminates at Cloudflare, which can process the request contents before forwarding them over HTTPS to the pinned Railway service origin. Private API operations authorize each request against that installation; one installation cannot read or delete another's projects. The server stores secret hashes, applies request and payload limits, and uses database transactions. Audio and transcripts are kept locally in the app sandbox. These measures reduce risk but no storage or transmission method can be guaranteed secure. Keep your device protected and manage exports carefully. Losing the installation secret can make server data inaccessible; no password reset or recovery service exists.
Children’s privacy
Bold Vocal Drill is intended for adult students, professionals and speakers aged 18 and over. It is not directed to children and does not provide child accounts. If you believe a child has provided personal information through the service, contact prudence.rowntree@icloud.com so we can discuss an appropriate request, subject to the limitations of anonymous installation identification.
Changes to this policy
We may update this policy when the app's processing or service practices change. The effective date at the top identifies the current version. The current policy is available through Settings and the public privacy page without login or cookies. Material changes will be described in the updated policy and, where appropriate, in an app update. Contact prudence.rowntree@icloud.com with questions.