Privacy Policy
Last updated: 2026-07-09
This policy covers the Iconic Voices website (iconicvoices.io), the web player at iconicvoices.io/app, and the Iconic Voices apps for iOS and Android. It describes what we collect today, in the present tense — nothing here is a plan or a placeholder.
1. Who we are (data controller)
Data controller:
Iconic Voices (legal entity name to be published here before app launch),
registration (number to be published).
(registered postal address to be published)
Privacy contact: [email protected].
2. Data we collect
- Account data — your email address, a user ID, and a password hash. Authentication is handled by Supabase Auth, hosted in the EU (Ireland) region. We never see or store your plaintext password.
- Listening progress — the book, position, chapter, and completion flag for titles you play, so playback resumes across your devices.
- Bookmarks — the positions you save, plus an optional short note (up to 140 characters).
- Purchase and subscription records — which books and plans your account has access to, and the transaction records our payment processors report to us. Your card or PayPal details go to the payment processor directly; we never receive them.
- Waitlist and notify-me emails — the email address you submit in a notify-me form, together with which page you submitted it from.
- Feedback and support correspondence — what you send us via the feedback form or by email.
- Error reports — if a page breaks, our error monitor (Sentry) receives a technical report. Email addresses, IP addresses, tokens, and passwords are scrubbed in your browser before the report is sent.
- Aggregate analytics — cookieless, anonymous page-view counts via Plausible. Optional analytics and marketing tools run only with consent — see the Cookie Policy.
3. The iOS and Android apps
The apps are free companions to your account and collect only the account data described above: your email address, user ID, listening progress, and bookmarks. In particular:
- Local listening statistics stay on your device. Figures the apps show you (such as minutes listened) are computed and stored on the device and are never transmitted to us.
- The apps contain no advertising, no advertising identifiers, no tracking, and no third-party analytics or crash-reporting SDKs.
- The apps share no data with third parties. Supabase and Cloudflare are our own processors (they host our backend); nothing is shared with anyone for their own purposes.
- The apps do not access your location, contacts, photos, microphone, or files.
This section is written to say exactly what the Apple "App Privacy" label and the Google Play "Data safety" declaration for the apps say — if you ever spot a mismatch, tell us at [email protected] and we will fix it.
4. Legal bases (GDPR)
| Processing | Legal basis |
|---|---|
| Account, sign-in, playback, progress and bookmark sync | Contract — Art. 6(1)(b) |
| Purchases, entitlements, receipts | Contract — Art. 6(1)(b) |
| Tax and accounting records | Legal obligation — Art. 6(1)(c) |
| Waitlist / launch emails, marketing cookies | Consent — Art. 6(1)(a) |
| Security, fraud prevention, error monitoring (Sentry) | Legitimate interest — Art. 6(1)(f) |
| Cookieless aggregate analytics (Plausible) | Legitimate interest — Art. 6(1)(f) |
5. How long we keep it
| Data | Retention |
|---|---|
| Account (email, user ID) | Until you delete the account, plus a 7-day recovery window; residual copies leave backups within 30 days |
| Listening progress & bookmarks | Deleted together with the account |
| Transaction records | Up to 7 years (tax-audit requirements) |
| Waitlist / notify-me emails | Until you unsubscribe or ask us to delete them |
| Support and feedback correspondence | Up to 24 months |
| Error reports (Sentry) | 90 days |
6. Processors we use
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, authentication, application APIs | EU (Ireland) |
| Cloudflare | Website hosting and CDN, audio storage (R2), bot protection (Turnstile) | Global network; EU-US Data Privacy Framework certified |
| PayPal | Billing for legacy subscriptions | US; EU-US DPF |
| Paddle / Stripe | Checkout, when new purchases resume — the processor is named at checkout and on your receipt | EU / US |
| Resend | Transactional email (receipts, account email) | US |
| Sentry | Error monitoring (IP addresses and emails scrubbed in the browser before sending) | US; EU-US DPF |
| Plausible | Cookieless, anonymous aggregate analytics | EU |
Consent-gated and currently disabled: Google Analytics 4, Microsoft Clarity, Meta Pixel, and TikTok Pixel are configured in our consent system but load only if you explicitly grant the matching consent category. See the Cookie Policy for the full inventory.
We do not sell your personal data.
7. Your rights and how to exercise them
- Access & export: download everything we hold about you as JSON, self-service, at Settings → Privacy (sign-in required) — or email [email protected].
- Rectification: correct your email in Settings → Account, or email us.
- Erasure: delete your account in the apps (Settings → Delete account), on the web at Settings → Privacy, or via the public page /delete-account.
- Portability, restriction, objection, withdrawal of consent: email [email protected]. We respond within 30 days (usually much faster).
- Complain: you have the right to lodge a complaint with your local data protection supervisory authority (GDPR Art. 77).
California (CCPA/CPRA): the categories we collect are identifiers (email, user ID), commercial information (purchase records), and internet activity limited to your use of our own service (listening progress, bookmarks). We do not sell personal information and do not share it for cross-context behavioural advertising. You have the rights to know, delete, and correct, and we will not discriminate against you for exercising them — use the same channels listed above.
8. Deleting your account
Four equivalent paths — full details on the deletion page:
- In the apps: Settings → Delete account (iOS and Android).
- On the web: Settings → Privacy (sign-in required).
- Public page: iconicvoices.io/delete-account — works without the app installed.
- Email: [email protected], subject "Delete my account", sent from your account email.
9. Children
Iconic Voices is not directed at children under 13, and we do not knowingly collect data from them. Our Terms require users to be at least 13 (16 in the EEA) with parental consent, or 18 to purchase. If you believe a child has created an account, email [email protected] and we will remove it.
10. International transfers
Your account data lives in the EU (Ireland). Where a processor is US-based (Cloudflare, PayPal, Sentry, Resend), transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. We do not rely on the deprecated Privacy Shield.
11. Changes to this policy
If we make material changes we will email account holders and subscribers at least 14 days before they take effect and update the "Last updated" date above. The current version is always at iconicvoices.io/privacy.
12. Contact
Privacy questions and data requests: [email protected]. General support: [email protected] (or the Support page). Legal, takedowns, disputes: [email protected].