How Voca handles your data

Voca is in private beta. We collect the minimum data needed to make a personal podcast for you and to learn how to make the product better. We never sell your data, never share it with advertisers, and any third-party services we use are listed below.

• Account basics — email, name (if you give one) and authentication state via Clerk.
• Your interests — what you tell us during onboarding and what you make in Studio. We use this to choose what to recommend next and what to put in your morning briefing.
• Listening events — when you press play, save, skip or share. Aggregated to make the recommender better.
• Casts and briefings you generate — the script text and the audio file itself. We keep your saved casts so you can listen again, so the shared /e/[token] page can play back, and so the morning briefing is ready when you press play. Audio is stored on encrypted Supabase Storage; the public bucket URLs are unguessable per-user paths.
• Connected services (optional)— if you link Google Calendar or Gmail, we read today’s events and the last 24h of inbox subject lines to draft the morning briefing. We never write back to your calendar or inbox. Disconnect any time from Profile → Connections.
• Crash reports — when something goes wrong, Sentry receives the error stack and the URL you were on. No message bodies or personal content.

To suggest what you might want to hear next we compare your taste signature — the topics you’ve engaged with — against synthetic test “cohorts” we’ve defined internally. No real listener’s data is exposed to another listener through this process; the cohorts are simulated personas, not actual users. We do this so the “try something new” pick can reach beyond what you’ve already told us you like.

• We don’t sell or rent your data to anyone.
• We don’t serve third-party advertising trackers.
• We don’t use your data to train external AI models. Your briefings and casts are generated for you via Anthropic and Fish Audio, who process the prompt only to return the response.

• Clerk — auth (your email + sessions).
• Supabase — database for your profile, episodes and graph.
• Anthropic (Claude) — generates the scripts. We send your prompt + relevant context (interests, recent topics).
• Fish Audio — turns the script into audio. We send the script text only.
• Google — only if you choose to connect Calendar or Gmail. We use read-only scopes.
• Vercel — hosting and edge functions.
• Sentry — error monitoring.

• Delete your account from Profile → Danger Zone. This wipes everything Voca has stored for you — saved casts and their audio, taste graph, briefings, integrations and your sign-in record — and cannot be undone. The deletion runs immediately; there is no recovery window.
• Disconnect Google any time at Profile → Connections.
• Skip the briefing entirely — set a non-morning briefing time, or simply don’t open it.

Under UK GDPR and EU GDPR you have the right to access the personal data we hold about you, to have it corrected if it’s inaccurate, to have it erased (the in-app delete above is the fastest path), to receive a portable copy, to object to or restrict our processing, and to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local data protection authority. To exercise any right that isn’t already a one-tap action in the app, email us at the address in the Contact section and we’ll respond within 30 days.

We keep your account data — interests, casts, briefings, audio and integration tokens — for as long as your Voca account exists. When you delete your account from Profile → Danger Zone we wipe it immediately from our database and Storage. Aggregated, anonymised analytics (counts of casts generated, average listen duration, etc.) may persist in our internal reporting tables — these contain no user identifier and cannot be tied back to you.

Voca is intended for listeners aged 13 and over. We don’t knowingly collect personal data from children under 13. If you’re a parent or guardian and believe your child has created an account, email us and we’ll delete it.

For anything privacy-related, including data subject access requests, email christopherjbarrett@mac.com. The data controller is Christopher Barrett, operating Voca from London, United Kingdom.