Privacy Policy for Lexy

Introduction

This Privacy Policy explains what information the Lexy voice notes app ("Lexy", "we", "us") collects, how it is used, who it is shared with, and the choices you have. Lexy is published by Sug&Pep Studios. We do not sell your personal information, and we never sell or share the content of your notes or recordings.

Information We Collect

1. Account information

• Your email address and, if you sign in with Google (or Apple on iOS), the name and email address that provider shares
• A user ID assigned by Firebase Authentication. Passwords are handled by Firebase Authentication and are never visible to us

2. Notes and recordings

• On your device: Notes, transcripts, categories and audio recordings are stored locally on your phone
• Cloud backup (Premium): If you use cloud backup, your notes and recordings are also stored in private, account-only locations in Google Firebase (Cloud Firestore and Cloud Storage) so you can restore them on another device
• Your notes are never public and are never shown to other users

3. Transcription

• Consent first: Before a recording is transcribed, Lexy explains the transfer and asks for your permission. Without it, recording still works and audio stays on your device
• How it works: The recording is uploaded to a private Firebase Storage location. Our server checks your account, the file type, size and length, and your monthly allowance, then sends the audio to OpenAI for speech-to-text. The transcript is returned to the app
• Control: You can turn off Allow AI transcription in Settings at any time

4. Usage and subscription information

• How many transcription minutes you used this month, so monthly limits can be applied
• For Premium: the subscription product, status and expiry date verified with Google Play, and a one-way hash of the purchase token. We never receive your card or payment details

5. Device, diagnostic and usage data

• Crash reports: Firebase Crashlytics collects crash logs and basic device details (model, OS version, app version)
• Analytics: Firebase Analytics collects app interaction events, such as screens opened and features used, to help us improve the app
• App integrity: Firebase App Check uses Google Play Integrity to confirm requests come from the genuine Lexy app
• We do not intentionally send recording audio or transcript text to analytics or crash reporting

6. Advertising ID

Free accounts on Android see ads from Google AdMob, which can use your device's resettable Advertising ID. See Advertising.

How We Use Your Information

• Save, transcribe, back up and restore your notes
• Sign you in and keep your account secure
• Apply monthly transcription limits and verify Premium subscriptions
• Show ads to free users
• Fix crashes, prevent abuse and improve the app
• Answer your support requests

Third-Party Services

Lexy works with these service providers. Each receives only what it needs for the purpose listed.

Google Firebase

Purpose: Sign-in (Authentication), cloud backup (Cloud Firestore and Cloud Storage), backend (Cloud Functions), App Check, Analytics and Crashlytics
Privacy: firebase.google.com/support/privacy

OpenAI

Purpose: Converting your recordings to text, only after you allow AI transcription
Privacy: openai.com/policies/privacy-policy

Google AdMob

Purpose: Showing ads to free users on Android
Privacy: policies.google.com/technologies/partner-sites

Google Play

Purpose: Processing Premium subscriptions
Privacy: policies.google.com/privacy

Google Sign-In and Sign in with Apple

Purpose: Optional ways to sign in. We receive only your name and email address

These providers may process data in countries other than your own, including the United States, under their own safeguards.

Advertising

• Who sees ads: Free accounts on Android see a banner on the notes screens and, at most after every second saved recording, a full-screen ad. Premium accounts see no ads
• What Google may process: Your Advertising ID, device and network information, approximate location derived from your IP address, and how you interact with ads
• Consent: Where required (for example in the EEA, the UK and Switzerland), Lexy asks for your consent through Google's consent form before personalized ads are shown. You can change your choice in Settings → Ad privacy choices
• Never shared: The text and audio of your notes are never shared with advertisers
• Control: You can reset or delete your Advertising ID in your device settings

Data Retention

• Notes and recordings on your device: Kept until you delete them, delete your account or uninstall the app
• Cloud backups: Kept until you delete the note or recording, or delete your account
• Transcription uploads: The copy of a recording uploaded for transcription is deleted automatically about 7 days after the request, so a failed transcription can be retried in the meantime
• Account, transcripts and usage records: Kept until you delete your account
• Purchase records: When you delete your account, we keep only a one-way hash of the purchase token, with no link to you, so a subscription cannot be moved to another account. Google Play keeps its own transaction records
• Crash reports: Kept by Firebase Crashlytics for up to 90 days
• Service providers: Providers such as OpenAI may keep request data for a limited time under their own policies, for example to prevent abuse. Backups held by our providers may take additional time to expire

Data Security

• All data is encrypted in transit (HTTPS/TLS) and stored encrypted at rest by Google Cloud
• Security rules limit each account to its own notes and recordings
• Subscriptions and transcription limits are verified on our servers, not on your device
• API keys for AI processing are kept only on our servers

No method of transmission or storage is completely secure, but we work to protect your information.

Your Rights

Depending on where you live (for example under the GDPR or CCPA), you have the right to:

• Access the personal data we hold about you and get a copy of it
• Correct inaccurate data
• Delete your account and data (see below)
• Withdraw consent for AI transcription or personalized ads at any time in Settings
• Object to or restrict certain processing
• Complain to your local data protection authority

To make a request, email ekincan@casim.net from the address on your account.

Deleting Your Account

You can delete your account at any time in the app: open Profile → Delete account and data. This permanently deletes your notes and recordings on the device and in the cloud, your usage records and your Lexy account. If you can't access the app, see how to request deletion.

Children's Privacy

Lexy is intended for users aged 13 and over and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

Permissions

RECORD_AUDIO

Used only while you record a note. Recordings are saved on your device; they leave it only for transcription you allowed, or for Premium cloud backup.

INTERNET

Used to sign in, transcribe, back up notes, verify subscriptions, load ads and send crash reports.

AD_ID

Lets Google AdMob read the Advertising ID for ad delivery, frequency capping, measurement and fraud prevention for free users.

Changes to This Privacy Policy

We may update this policy from time to time. We will post the new version on this page and update the "Last updated" date. For significant changes we will also tell you in the app.