Privacy and personal data

Controller and purposes

BOXLET s.r.o., Company ID 29753376, is the controller for data needed for AI service sign-in, confirmation records, usage limits and support. Contact details are published separately. These data support the requested feature, service security and handling requests; depending on the purpose, processing relies on contract performance, a legitimate security interest or a legal obligation. Confirming one transfer is a user choice, not blanket consent on behalf of everyone recorded.

Local content and recovery

Audio, titles, notes, transcripts, AI overviews and result history are stored on the iPhone. When syncing is enabled, they are transferred to a private CloudKit database in the user’s Apple Account; the BOXLET server does not handle this transfer. Recovery on another iPhone requires the same Apple Account and syncing enabled. Transfers may wait for a connection or available iCloud storage. Turning syncing off does not itself remove existing cloud copies.

Deleted recordings and notes remain in Recently Deleted for 30 days. After that period, when the app is next opened, or after permanent deletion is confirmed, content is removed locally and from iCloud on successful sync. Offline devices receive the change when they next sync. A minimal technical deletion record prevents an older device from restoring it again. Apple Watch keeps its own copies and uses WatchConnectivity for transfer to iPhone; Watch copies and exports are managed separately.

A password-protected backup is an encrypted file. We do not store the password; keep it safe. Sharing audio alone is a separate export without that encryption. You manage copies and any system backups outside saypouch through your chosen storage or operating system.

The app creates an Overview PDF locally from the title, date, duration, category, completed Overview sections and your note. This export excludes audio and the full transcript field and does not start new AI processing. The PDF is not protected by an app password and cannot restore a recording. You choose and manage recipients, destination storage and further copies; any protection of the chosen storage follows its own rules.

Custom categories are also saved and synced independently, including those without recordings. Deleting a category does not delete recording content.

You can create an event or reminder from text you select after reviewing its title, note and date. saypouch does not infer deadlines or assignees from the text. Events are saved only after confirmation in the system Calendar editor, without saypouch reading your calendar. For Reminders, iOS requires full permission; the app requests it only on an explicit save and uses it only to create the confirmed reminder in the default list. These are separate copies in the selected system account; its settings govern syncing and retention. Deleting a recording in saypouch does not remove those copies. Widgets, controls and Watch complications only open the existing recorder; they do not send content for AI processing themselves.

Import, system search and app lock

Import is an explicit local choice of one audio file. Supported MP3, M4A, AAC, WAV, AIFF and CAF files are limited to 23 MB and 47 minutes. The app validates and converts the audio to its own format without changing the original. After a separate confirmation, the share extension stores only a pending import in saypouch’s local shared folder. Saving it to Recordings requires opening the app, passing any app lock and confirming the import. The extension does not read the recording library or sign-in session. Import itself sends nothing to AI.

Optional Spotlight search is off by default and configured separately on each iPhone. Only titles and categories of local, non-deleted recordings and a technical identifier for opening the detail enter the system index, not audio, notes or transcripts. Results may appear outside the app. When search is disabled, a recording is deleted or App lock is enabled, saypouch asks iOS to remove the corresponding index entries. Settings shows removal status and any failure; completion also depends on the system.

Optional App lock uses system authentication through Face ID, Touch ID or the device passcode. saypouch does not receive biometric templates or the iPhone passcode. The lock controls interface access on this iPhone and hides the preview when the app enters the background. Ongoing recording and already confirmed AI processing may continue. It does not replace iOS or iCloud protection, change the protection of previously exported audio or PDFs, or provide an additional password for encrypted backups.

Sign-in and AI transfer

Optional AI uses Sign in with Apple. A user identifier and technical session data are processed. Only after confirmation for a specific recording does the app send audio through BOXLET’s Railway server to OpenAI; transcript text is also used for the summary. The server handles content during the request and does not store audio or text in application files or the database. Technical metadata for sign-in, confirmations and limits are stored separately.

Providers, retention and security

Apple provides sign-in and system features, Railway hosting, and OpenAI optional AI processing. These providers have their own processing rules and may process data outside the EEA. We promise neither zero retention nor exclusively European processing by all providers. AI details are on the dedicated page.

Device content remains until deleted; other copies need separate management. Specific periods for technical metadata and hosting logs, and a complete contractual overview of providers, must be completed before public release. HTTPS and controlled access are not a promise of absolute security or end-to-end encryption of the whole AI process.

Encrypted operational backups contain only server metadata for sign-in, consent and protective limits, not audio, transcripts, AI Overviews or private iCloud content. They are created hourly in private Cloudflare R2 storage under EU jurisdiction, and every successful backup is checked by a recovery test. Individual copies have a retention setting of 7 days; deletion happens asynchronously under Cloudflare’s rules. This period applies to backup copies, not to metadata retention in the running service. Recovery does not restore previous sign-in sessions or one-time consents.

Your rights

Depending on the circumstances, you have rights to information, access, correction, erasure, restriction, portability, objection and withdrawal of any consent. BOXLET handles requests through the published contacts; we verify identity proportionately, so do not automatically send an identity document copy. You may contact the Czech Office for Personal Data Protection or another competent supervisory authority. saypouch makes no automated decisions with legal or similarly significant effects.

AI account and subscription

AI account deletion is not available yet. Use Contact to request deletion.

Deleting your AI account does not erase your iPhone or private iCloud library or turn off App lock. Review your subscription separately with Manage subscription; account deletion alone does not stop payments.