Privacy Policy

What we collect

• Email address. Used to sign you in, send transactional email (account confirmations, deletion confirmations), and identify your reps.
• Transcripts. The text that the transcription service produces from your recording. Stored against your account so the score has something to read and so your history works.
• Crash and diagnostic data. If the app crashes or a request fails, we capture the error context so we can fix it.

What we do NOT collect

• No third-party tracking pixels or analytics SDKs.
• No advertising identifiers (IDFA, GAID).
• No contacts, calendar, or address book access.
• No location data.

Audio handling

On the web: your audio is uploaded to the Sayable backend so the transcription service (whisper.cpp running on our servers) can convert it to text. The audio file is deleted from disk immediately after the score is computed. Only the transcript and the score are kept.

On iOS: your audio never leaves the device. Transcription runs on-device. We only see the transcript and the score that the device sends back.

Retention

Reps (transcript + score + prompt id + timestamp) are kept until you delete them or delete your account. When you delete your account, the row is soft-deleted immediately so future sign-ins return a 410. Thirty days after that, the row is hard-purged from our database along with every rep, transcript, custom prompt, and subscription record attached to it. The 30-day window exists so we can recover an account if a user tells us the deletion was a mistake.

How to export your data

Sign in, then request GET /api/users/me/export. The response is a single JSON file containing your user row, every rep, every custom prompt you authored, and your subscription history. The browser will save it as a download. The same endpoint backs the iOS Settings > Privacy and Data > Export my data action.

How to delete your account

Open Settings, then Account, then Delete my account. The confirmation flow is two steps to slow accidental deletes. After you confirm, your account is soft-deleted immediately, open sessions are revoked, and a 30-day hard-purge job is scheduled. Apple subscriptions need to be cancelled in iOS Settings > Apple ID > Subscriptions because Apple does not expose a server-side cancel API; the app shows you the deep link to that screen as part of the flow.

Third-party processors

• Resend. Sends transactional email (account confirmations, deletion confirmations). Sees your email address and the message body.
• Stripe. Processes web subscriptions ($49/month). Sees your email address and the payment metadata Stripe needs to charge a card.
• Apple StoreKit. Processes iOS in-app purchases. Sees the App Store account identifier (not your Sayable email).
• PostHog product analytics. Bounded to four events (rep_started, rep_completed, score_received,subscription_purchased). Autocapture, pageview, pageleave, dead-click, console capture, and session replay are all disabled. Transcripts, audio, and email values NEVER reach PostHog (a property-name sanitizer strips any key matching transcript, recording, audio, oremail before send).
• Sentry crash reporting. Receives stack traces and error context when something breaks, so we can fix it. Transcripts and audio are never attached to error reports.