Privacy Policy

Effective date: 30 May 2026 · Last updated: 30 May 2026

This Privacy Policy explains how Vocca (“we”, “us”, “our”) collects, uses, stores, and shares information about you when you use the Vocca mobile application and related services (the “Service”). By using Vocca, you agree to this Policy.

The short version: Vocca records your practice answers, sends the audio to OpenAI to transcribe and coach, stores the transcript and feedback in your account, and shows it back to you. We do not sell your data, do not use your voice or transcripts to train AI models, and do not share your data with advertisers. You can delete any session or your entire account from inside the app at any time.

1. Who we are

Vocca is operated by the Vocca team. For privacy questions or to exercise any of the rights described below, contact us at hello@vocca.coach.

2. Information we collect

When you use Vocca, we collect:

Account information: your email address, name (optional), and a hashed password. We never see or store your plaintext password.
Profile data: your coaching goal (e.g. Interviews, Leadership), role, language, focus area, experience level, and current challenge — only what you choose to provide during onboarding or in settings.
Voice recordings: audio captured while you record a practice answer. Audio is sent to OpenAI for transcription and is not stored on our servers after the transcript is produced.
Transcripts: the text of your spoken answer, generated by OpenAI's Whisper service. Stored as part of your session.
Coaching feedback: AI-generated analysis, scores, and recommendations produced by OpenAI's GPT-4o model. Stored with your session.
Job description and resume text: if you paste a job description or resume to generate tailored practice questions, that text is stored on your profile.
Mock interview data: questions selected, your responses, and resulting scores.
Usage information: session history, completion timestamps, streaks, and progress trends — used to power the Progress tab.
Device and authentication metadata: IP address and user-agent string of the device that signed in. Used by our authentication library for session security; not used for marketing.
Subscription status: whether you are on the free tier or a paid plan. Handled by RevenueCat. We do not see your payment card details.

3. How we use your information

To transcribe your practice recordings and produce coaching feedback.
To show you your progress over time (scores, trends, weakest skill, recent sessions).
To maintain your account and keep you signed in.
To process your subscription (via RevenueCat) if you choose to upgrade.
To debug and improve the Service. Aggregate, non-identifying usage signals only — we do not read individual transcripts for product development.

4. Who we share your information with

We rely on a small number of trusted third-party service providers to operate Vocca. Each is contractually limited to processing your data on our behalf, for the purposes described here.

OpenAI (transcription via Whisper, coaching analysis via GPT-4o): your audio (transient) and your transcript + profile context (sent with each analysis request) are processed by OpenAI. Audio is not retained on our servers after transcription. OpenAI's privacy policy.
RevenueCat (subscription management): your account identifier and subscription state. RevenueCat's privacy policy.
Neon (database hosting): all of your stored data lives in our Neon-hosted PostgreSQL database. Encrypted at rest and in transit. Neon's privacy policy.
Fly.io (backend hosting): our application code runs on Fly.io. Fly.io's privacy policy.
Apple App Store (distribution and in-app purchases): standard platform handling per Apple's policies.

We do not sell your personal data, share it with advertisers, or use your voice recordings or transcripts to train AI models.

5. How long we keep your information

Account, profile, transcripts, coaching feedback, session history: retained until you delete the specific session or your entire account.
Voice recordings: transient — discarded immediately after transcription. Not retained on our servers.
Server logs (operational, non-identifying): retained up to 30 days for debugging and abuse prevention.

6. Your rights and choices

From inside the app you can, at any time:

View your data: open any past session to see its transcript, scores, and feedback.
Delete individual sessions: open the session and tap Delete. The session — including its transcript — is removed permanently.
Delete your account: Practice tab → Settings → Delete account. This permanently removes your profile, all sessions, all transcripts, and all coaching feedback. Account deletion completes within 24 hours.
Export your data: request a portable JSON copy by emailing hello@vocca.coach.
Change your coaching language: Practice tab → Settings → Coaching language.

If you are in the European Economic Area or the United Kingdom, you have additional rights under the GDPR and UK-GDPR, including the rights to access, correct, restrict, object to, and port your data, and to lodge a complaint with your local data protection authority. If you are in California, you have analogous rights under the CCPA/CPRA, including the right to know, the right to delete, and the right to opt out of the sale or sharing of personal information — though, as noted above, we do not sell or share your personal data.

7. Security

All network traffic between your device and our servers is encrypted using HTTPS / TLS.
Stored data is encrypted at rest by our database provider.
Passwords are hashed with an industry-standard algorithm before storage. We do not store or have access to your plaintext password.
API keys and other credentials are kept in our hosting provider's encrypted secret store, separated from application code.

No system is perfectly secure. If you have reason to believe your account has been compromised, contact us immediately at hello@vocca.coach.

8. Children's privacy

Vocca is not directed at children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. International data transfers

Vocca's servers and database are located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States. By using the Service you consent to this transfer.

10. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top of the page will reflect the latest version. If we make material changes that affect your rights, we will notify you in-app and, where required, by email before the change takes effect.

11. Contact us

For any privacy question or to exercise your rights, email hello@vocca.coach.