Privacy Policy

1. Who we are

Vocii (“Vocii”, “we”, “us”, or “our”) is an Augmentative and Alternative Communication (AAC) application that helps non-verbal users communicate through customizable boards, symbols, and synthesized voices. Vocii is built with a strict offline-first philosophy: the app works fully without an internet connection, and any data we collect is stored on the user’s device first.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and the rights you have over your data.

2. Information we collect

We collect only the information necessary to provide the service:

• Account information — your email address, display name, and password (stored as a salted hash) when you create a Vocii account.
• Student profile data — the names, ages, preferences, communication boards, vocabulary, and usage events of the AAC users you create profiles for.
• Audio recordings — voice samples you optionally record to create custom synthesized voices.
• Custom images — photographs, drawings, and symbol images you upload to personalize communication boards.
• Device information — operating system, device model, app version, and language settings, used for compatibility and troubleshooting.
• IP address — collected only for security purposes such as detecting suspicious sign-in attempts and preventing abuse. IP addresses are not used for advertising or profiling.
• Billing information — subscription metadata (plan, status, renewal date). Payment card details are processed and stored exclusively by our merchant of record, LemonSqueezy. We never see or store full card numbers.

3. Why we collect it

We collect personal information to:

• Provide the Vocii AAC service to you and the users you support.
• Sync data securely across the devices you have explicitly linked to your account.
• Provide customer support and respond to your requests.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with our legal obligations, including those relating to children’s privacy and educational data.

4. How we use information

We use personal information solely to deliver and improve Vocii. Specifically:

• We never sell personal information to third parties.
• We never use personal information for advertising or to build advertising profiles.
• We never share personal information with third parties except as described in “Data sharing” below.
• We use de-identified, aggregated usage statistics (with no individual identifiers) to understand which features help users most.

5. Data sharing

Vocii data is shared only with care providers (parents, guardians, teachers, speech-language pathologists, and therapists) who have been explicitly authorized by the account owner or by the parent/guardian of an AAC user under the age of 13.

We use a small number of carefully chosen subprocessors to operate the service: Supabase (managed Postgres database and storage), Resend (transactional email), and LemonSqueezy (payments and tax). Each subprocessor is contractually bound to use Vocii data only to provide the specific service requested by Vocii.

We may disclose information when required by valid legal process. In such cases, we will give the affected user notice unless prohibited by law.

6. Children’s privacy (COPPA)

Vocii is intended to support AAC users of all ages, including children. We are committed to compliance with the U.S. Children’s Online Privacy Protection Act (COPPA).

Accounts may only be created by individuals aged 13 or older. For AAC users under the age of 13, a parent, legal guardian, or authorized educational representative must create the account and provide verifiable parental consent before any personal information about the child is collected.

Parents and guardians have the right to review the personal information collected about their child, request its deletion, and refuse to permit further collection or use of the child’s information. To exercise these rights, contact privacy@vocii.app.

7. Data retention

We retain personal information for as long as your account is active. When you delete your account, your data enters a 30-day grace period during which the deletion can be reversed. After 30 days, all personal information associated with the account is permanently and irreversibly deleted from our production systems.

Backups are retained for an additional limited period (typically up to 90 days) and are then permanently destroyed. Anonymized, aggregated statistics may be retained indefinitely.

8. Your rights

You have the following rights over your personal information:

• Access — request a copy of all personal information we hold about you, in a machine-readable format.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information (the “right to be forgotten”).
• Portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another service.
• Restriction and objection — ask us to restrict or object to certain processing activities.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@vocii.app. We will respond within 30 days.

9. International users

European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR): Vocii processes personal information based on the lawful bases of contract performance, legitimate interests, consent, and legal obligation. EU/EEA users have the right to lodge a complaint with their local supervisory authority.

United States (FERPA): When Vocii is provided to a school or district, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). We do not use student data for any purpose other than providing the service requested by the school.

Pakistan (PDPL): Vocii complies with the Personal Data Protection Law of Pakistan. Pakistani users may exercise the rights granted under the PDPL by contacting privacy@vocii.app.

Personal information may be transferred to and processed in countries other than the one in which you reside. Where required, such transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

10. Security

We use industry-standard technical and organizational measures to protect personal information, including TLS for data in transit, encryption at rest for sensitive fields, scoped row-level security policies, and regular security reviews. No system is perfectly secure; if you believe your account has been compromised, contact us immediately at security@vocii.app.

11. Cookies

Vocii’s web app uses only essential cookies required for authentication and session management. We do not use advertising or tracking cookies. See the cookie banner shown on your first visit for more information.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, for material changes, notify you by email or through the app before the changes take effect.

13. Contact us

For privacy questions or to exercise any of your rights, contact us at privacy@vocii.app.