Privacy Policy

The short version

• We don't train AI on your conversations. Ever. Not us, and not our vendors — we opt out of model training on every provider account, backed by our agreements with them and our privacy policy with you.
• We don't keep your audio for long. Recordings upload so we can transcribe them, then the original audio bytes auto-delete from our servers within 7 days, including recordings whose transcription failed. Audio never syncs through iCloud. Local copies stay on your own devices until you remove them. Your transcripts and notes stay in your account so you can use them — until you delete them, which you can do at any time.
• We collect the minimum to operate the app. Email, subscription identifier from Apple, crash reports, and a record of which features you use — never what was said. No ad trackers, no data brokers, no resale.
• Delete everything from the app. Settings → Danger Zone → Delete Account removes your account and everything in it. Want a copy of everything we hold? Email legal@bonfiyah.com from the address on your account and we'll send it.

1. What Bonfiyah collects, where it lives, and why

Account data. Your email address and the opaque identifier Apple gives us through Sign in with Apple — never your real Apple ID. Bonfiyah requires Sign in with Apple for your account — we rely on Apple's sign-in security rather than operating our own password system: we never receive or store a password, Apple may relay a Hide My Email address instead of your real one, and you can revoke Bonfiyah's access from your Apple ID settings at any time. We use this only to sign you in and link your subscription. Stored on our backend so you can pick up where you left off on any of your devices. Deleted within 30 days of account deletion (usually within 24 hours); encrypted backups can hold a copy for up to 12 months (see 4a).

Subscription data. Your tier (Free / Pro / Pro AI), subscription status, renewal date — sourced from Apple's StoreKit. We never see your Apple Pay details or credit card.

Audio recordings. Captured on your iPhone and uploaded to our backend in short chunks so we can transcribe them and run the AI features you paid for. Raw audio is automatically deleted from our servers within seven days — once the transcript is back, the audio bytes are no longer needed. That includes recordings whose transcription failed. Encrypted in transit (HTTPS). Audio is never synced through iCloud. Your transcript persists in your account so you can return to it across devices. After the 7-day server window, we no longer hold your original audio — it is deleted from both our database and our object storage. Local copies remain on your own devices, under your Apple ID, until you delete them. If we receive a valid legal request, we produce only the minimum legally required from what we still hold (your transcripts and derived outputs); audio we have already deleted is no longer available to produce.

Transcripts, speaker labels, consent logs. The text version of your conversation, who said what, and the consent state for each speaker. Stored in your account on our backend so they're available on every device you use Bonfiyah on. Deleted with your account, or any individual story can be deleted on its own from the app.

Voice signatures (voiceprints). Bonfiyah recognizes returning voices across your conversations by comparing a short numerical signature of each voice to a library bound to your account. A signature cannot be reversed into audio. It exists so the same person reads as the same person across stories. Signatures are computed from your recordings on our servers, and the app can also compute them on your device. Matching a voice to the people you know runs on your device by default; our servers also compare voices when they process a recording, and where the device can't make a confident match, the match made on our servers stands.

Where voice signatures are stored. Voice signatures are stored on Bonfiyah's secure servers and, if you've trained or split a person's voice, in your private iCloud. Train Voice, Retrain Voices and Detect & Split Mixed Voices save a copy to your private iCloud database, and the app reads those copies to match voices on your device. The copy on our servers is what lets recognition work across all your devices. Your library is isolated from every other user's — there is no shared or global voice database.

How long we keep voice signatures. While your account is active, until you delete them: deleting a person deletes their voice signatures, Settings → Danger Zone → Delete all voice signatures deletes every one, and deleting your account deletes them with everything else. Starting with app version 4.4, these deletions also remove the copies in your private iCloud; earlier versions of the app delete only the copies on our servers. After you delete your voice signatures, Bonfiyah doesn't make new ones until you turn voice recognition back on (in app version 4.4 and later: Settings → Danger Zone → Turn voice recognition back on); new ones then come only from recordings made after that, and the deleted ones don't come back. Uninstalling the app doesn't delete them, because they're stored on our servers (and, for voices you've trained or split, in your iCloud).

AI-derived outputs. People Memory profiles, Promise Tracker entries, flags from the Contradictions scan, Story Mode recaps, Speaker Insights, Compatibility analyses — all generated from your own transcripts and stored in your account. They go with your account when you delete it.

Email you connect (Pro AI, optional). Bonfiyah can connect to Gmail; for now that option is open only to a small group of test users, and no other email provider can be connected. If you connect Gmail, Bonfiyah reads only messages to and from people you've added to People Memory, at addresses you've confirmed for them. It ignores the rest of your mailbox. From each of those messages it keeps the tone, commitments, open questions and topic labels, with the message's ID, date and direction. It does not keep message text or subjects; message text is deleted within 24 hours of processing. Anthropic (Claude) analyzes the message text under the same no-training terms as your transcripts. You can disconnect at any time in Settings → Connections, which stops all access at once, and delete everything learned from your email on the same screen. Settings → Danger Zone → Delete Account removes it with the rest of your account.

Bonfiyah's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use email data for advertising or to train AI models, and no one at Bonfiyah reads it unless you ask us to look at specific messages, for security, or where the law requires.

Your private iCloud. Bonfiyah keeps some data in your own private iCloud so it's on all your devices: conversation details such as titles, times, place, calendar event titles and attendee emails, and project names (on Pro and Pro AI, while iCloud sync is on in Settings); the people in your library (name, consent status, phone number); consent records; app settings; project photos and files; and the voice signatures described above. Audio never syncs through iCloud. Transcripts and AI summaries reach your other devices through your account on our servers, and reach iCloud only if you turn on iCloud Drive Export (below). Our servers can't read your private iCloud data. Starting with app version 4.4, Delete Account also deletes Bonfiyah's data and exported files in your iCloud.

iCloud Drive Export (optional, off by default). Settings → Sync & Devices → iCloud Drive Export is a switch on each device, off until you turn it on, and it applies only to the device you turn it on for. When it's on, Bonfiyah writes copies of your conversations — the conversation's details, its full transcript and its AI summary — as Markdown files to your own iCloud Drive, in a Bonfiyah folder, where they count toward your iCloud storage. Audio isn't exported. Exported transcripts are complete: they include everything everyone said, including people who haven't given consent, and anyone you share the files with can read all of it. Privileged and Internal Use Only conversations are marked as such in every exported file. Turning the switch off stops new copies; files already exported stay in your iCloud Drive until you delete them. Files you attach to a project are kept in the same Bonfiyah folder whether or not export is on.

Crash and error reports. When the app opens, it starts Sentry, a crash-reporting service, so we can find and fix bugs. There's no setting to turn this off. If the app crashes or hits an error, Sentry receives what went wrong in the app's code, the app version, your device model and system version, and an identifier for your iCloud account or device (not your name or email). We've set it not to attach screenshots or anything shown on screen, and these reports don't contain your audio or transcripts.

Separately, when Apple tells the app it crashed or froze last time, Bonfiyah asks whether to send that report to us. Nothing is sent unless you tap Send. Reports you haven't decided on wait in Settings under Pending crash reports. A report you send includes the crash details, app and device versions, counts of your stories and speakers, and recent app log lines, but not your audio or transcripts.

Usage data. The app tells our backend when you use parts of it: for example, that you started a recording, opened a screen, ran a search or saw an upgrade prompt. These events are tied to your account, or to your device before you sign in, so we can see which features people use and where they get stuck. They never include audio, transcript text or what you searched for (for a search, only how long the query was). They stay on our backend, aren't shared with advertisers or analytics companies, and are deleted when you delete your account. There's no setting to turn them off.

Notifications. Proactive Notifications (overdue promises, contradictions and the like) are worked out on our backend from your own data, sent to the app as a list, and scheduled by iOS as local notifications on your device; they don't go through Apple's push service. Bonfiyah does use Apple Push Notification service (APNs) for a few notifications: telling you a conversation has been transcribed, a reminder if you haven't opened the app in a while, and announcements if you've turned on promotional notifications. For that, our backend stores your device's push token. A push carries a title, a short message (for a finished transcription, that can include the conversation's title) and a link to the screen it opens; it doesn't contain transcript text or audio.

Visits to this website. Where visits to bonfiyah.com come from: the site or app that sent each visit (a search engine or a social app, for example) and the kind of page it opened, counted without who visited. We keep only a count for each day. Counting a visit sets no cookie and stores nothing on your device, and no IP address, account or device identifier is kept. When a search engine's or an AI assistant's crawler reads our sitemap or llms.txt, that read is counted the same way.

Bonfiyah in ChatGPT and Claude. Bonfiyah's connector for AI assistants (https://bonfiyah.com/mcp) answers questions about recording-consent law, recording tips and Bonfiyah's plans and features from this website's own content. It needs no sign-in and never reads anything from your Bonfiyah account. We don't keep the questions it is asked or the answers it gives; Cloudflare, which hosts this website, processes each request to deliver it. When you tap Get Bonfiyah in an answer, we count that tap the same way as a website visit (above) before sending you to the App Store. The assistant you use handles your conversation under its own privacy policy.

Ads. When you reach bonfiyah.com from one of our ads and tap Download, the page copies a short code that names the ad (for example, bonfiyah:meta-who-said-what) to your clipboard. If you paste it when the app asks, or answer the app's question about where you heard of Bonfiyah, we keep only that ad's name or your answer with your account, to count which ads lead to people using Bonfiyah. The code holds nothing about you.

2. What Bonfiyah does NOT collect or do

• We do not train AI models on your audio or transcripts, and we opt out of model training on every provider account that offers a training program; where a provider offers no-training terms, our agreement with them prohibits it.
• We do not retain raw audio long-term. The original audio is deleted from our servers within seven days — from both our database and our object storage — including recordings whose transcription failed. Local copies remain only on your own devices; audio never syncs through iCloud.
• We do not maintain a global voice database. Your voice signatures stay in your account (and, for voices you've trained or split, in your private iCloud) and are never searched against any other user's library.
• We do not sell, rent, or trade your data to anyone, for any purpose, ever.
• We do not use third-party advertising trackers. Bonfiyah is paid for by subscriptions, not ads.
• Our servers can't read the data Bonfiyah keeps in your private iCloud or the files it exports to your iCloud Drive.

3. Third parties

Bonfiyah uses these services to operate. Each has its own privacy policy. Our servers (Railway and Fly.io) and our database (Neon) are in the eastern United States.

• Apple — App Store, StoreKit, Sign in with Apple, push notifications, iCloud (your private iCloud database and, if you turn on export, iCloud Drive), Speech framework, MetricKit, and AdServices (install attribution for Apple Search Ads, with no advertising identifier). apple.com/legal/privacy
• Railway — hosts our backend: the app's servers and background workers, which process your requests and recordings. Railway doesn't hold our database. railway.com/legal/privacy
• Fly.io — standby backend hosting that takes over if Railway is unavailable; it runs the same servers. fly.io/legal/privacy-policy
• Neon — our database (PostgreSQL), which holds your account data, transcripts, people, consent records, voice signatures and AI outputs. Encrypted at rest. neon.com/privacy-policy
• Cloudflare — stores uploaded audio until it's deleted (within 7 days), runs the network in front of our servers, and hosts this website. Encrypted at rest. cloudflare.com/privacypolicy
• Backblaze B2 — off-site backups of our database. We encrypt each backup before it's uploaded, so Backblaze holds only encrypted files. backblaze.com/company/privacy
• Resend — sends Bonfiyah's emails, such as verification emails, consent requests and data-rights notices. resend.com/legal/privacy-policy
• SendGrid (Twilio) — receives email sent to Bonfiyah addresses. twilio.com/legal/privacy
• AssemblyAI — speech-to-text transcription and speaker separation. We opt out of AssemblyAI's model-training program, and each transcript is deleted from AssemblyAI immediately after processing; their retention floor is a 1-hour TTL on anything not already deleted, and only minimal billing metadata persists. assemblyai.com/legal/privacy-policy
• Anthropic (Claude) — the AI model behind Bonfiyah's AI features on the Pro and Pro AI tiers: meeting summaries (included with Pro and Pro AI), action items, People Memory, Compatibility analyses, Speaker Insights. Transcripts are sent for processing and never used for training under Anthropic's commercial API agreement; Anthropic retains API inputs and outputs only briefly for abuse-monitoring and deletes them within 30 days. anthropic.com/legal/privacy
• Google (Gmail) — only if you connect a Gmail account (Pro AI, optional; currently open only to test users): Bonfiyah reads messages with the people you've confirmed through Google's Gmail API, with read-only access you grant on Google's own sign-in page and can revoke at any time. policies.google.com/privacy
• RevenueCat — subscription status and subscription analytics. revenuecat.com/privacy
• Sentry — crash and error reports. sentry.io/privacy
• ConvertKit — newsletter, if you sign up for the email list. convertkit.com/privacy

4. Your rights

Wherever you live, you have the right to (a) export the data we have about you, (b) delete the data we have about you, (c) correct anything inaccurate, (d) ask us what we do with your data and why. The delete flow is in the app at Settings → Danger Zone → Delete Account. For a copy of your data, email legal@bonfiyah.com.

If you're in the EU/UK (GDPR/UK GDPR), California (CCPA/CPRA), Colorado, Connecticut, Utah, Virginia, or any other jurisdiction with specific data protection rights, those rights apply to you, and the in-app delete flow and email requests to us satisfy them. If you'd rather email us, write to legal@bonfiyah.com and we'll respond within 30 days (faster, usually).

4a. How to delete your account

Two paths, both cascade-delete the same way through our backend:

• Self-serve (in-app): Open Bonfiyah → Settings → Danger Zone → Delete Account, and confirm. This deletes your account on our backend with every recording, transcript, person, voice signature, and Pro AI output, and clears your conversations and settings from that device. Starting with app version 4.4, it also deletes Bonfiyah's data and exported files in your iCloud. It runs right away.
• By email: Write to legal@bonfiyah.com from the address on the account, ask to delete, and we'll process the same cascade and email you when it's complete.

Both paths run the same deletion on our backend. It's idempotent and keeps an audit record of each deletion, so we can prove it happened if you ever need that record.

Encrypted backups. We back up our database every day and every week so we can recover from a failure. Each backup is encrypted by us before it's stored with Backblaze. Deleting your account doesn't change backups that already exist; they expire on their own schedule. Daily backups are kept for 14 days. Weekly backups are kept for up to 12 months (the four most recent, plus one a month for 12 months). So a copy of a deleted account's data can remain in an encrypted backup for up to 12 months, and then it expires.

4b. Devices that never sign in

Before you sign in with Apple, the app can send us a few things tied only to your device: the record of your acceptance of our terms (time, device, IP address), basic device details such as model and iOS version, and app-usage events such as installs and app opens. If you used Bonfiyah before sign-in became required in July 2026, it can also include settings, and recordings with their transcripts. None of this belongs to an account yet, so the in-app export and delete flows can't reach it. If you sign in on that device, it joins your account, and Delete Account then removes it with everything else. If no account ever claims it, we delete it automatically once there has been no activity from the app on that device for 3 months, using the same cascade as an account deletion, audit row included.

5. Children (COPPA)

Bonfiyah is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. The App Store rating reflects this, and our marketing is built around use cases — legal intake, medical visits, business conversations — that are inherently adult.

If you are a parent or guardian and you discover that your child under 13 has created a Bonfiyah account or uploaded recordings:

1. Email legal@bonfiyah.com with the account's email address or the child's name. We do not require proof of guardianship for an initial deletion request — when a deletion request comes in for a minor, our default is to act on it immediately.
2. We will pause the account within 24 hours (so no new data flows in) and permanently delete the account and every associated audio file, transcript, voice signature, and metadata row within 30 days. In practice this completes within 24–72 hours for almost every COPPA request.
3. We will send written confirmation when the deletion completes, including the timestamp and the count of records removed.
4. We retain an audit trail of every COPPA-driven deletion for two years (legal requirement). The audit trail records the request, the deletion action, and the timestamp — it does not retain the child's content.

If the account is on a paid tier and was charged, refunds for COPPA-driven deletions are handled by Apple via the standard refund flow; we will not contest those refund requests.

6. Security

There are no Bonfiyah passwords: you sign in with Apple, and the app keeps its session token in the iOS Keychain. Backend traffic is HTTPS-only. Our database (Neon) and audio storage (Cloudflare) are encrypted at rest, and database backups are encrypted by us before they leave our systems. iCloud sync uses Apple's encryption. The local app database is protected by iOS file protection (NSFileProtectionComplete when locked, NSFileProtectionCompleteUntilFirstUserAuthentication when in use). Audio files use the same protection class.

If we ever discover a security incident affecting your data, we'll notify you within 72 hours of confirming the scope, in writing, with what happened and what you should do.

7. HIPAA posture

Bonfiyah is not a HIPAA-compliant service and we are not a HIPAA Business Associate. We do not currently offer Business Associate Agreements (BAAs). We build to HIPAA-aligned data-handling principles — minimum-necessary data collection, encryption in transit, audit logging on consent changes, no AI training on your content, user-controlled deletion — but those design choices do not amount to HIPAA certification.

If you are a healthcare provider, payer, or business associate already operating under a BAA, do not use Bonfiyah to capture, transmit, or store Protected Health Information (PHI) without first conducting your own compliance review. Read more on our HIPAA posture page.

8. Changes to this policy

If we change anything material about how we handle your data, we'll notify you through the app and email at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

9. Contact

Privacy questions: legal@bonfiyah.com.
General support: support@bonfiyah.com.

9a. California residents — Business & Professions Code § 1789.3

For California residents under Cal. Bus. & Prof. Code § 1789.3: Bonfiyah is operated by Bonfiyah, Inc., a Delaware corporation. You can reach us for complaints, questions, or to request information about complaint resolution at legal@bonfiyah.com or by mail at our Delaware registered agent address, available on request. There is no charge for use of Bonfiyah's services beyond the subscription pricing disclosed at bonfiyah.com/pricing. The Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs may be contacted in writing at 1625 N. Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210 or (916) 445-1254 (TDD: (800) 326-2297).

9b. EU/UK residents — non-waivable consumer rights

Nothing in this Privacy Policy or our Terms of Service limits any non-waivable rights you have as a consumer under the law of your country of residence in the European Economic Area, Switzerland, or the United Kingdom, including rights under the EU Consumer Rights Directive (2011/83/EU), the Digital Content Directive ((EU) 2019/770), and the GDPR/UK GDPR. EU residents may also use the EU's online dispute resolution platform at ec.europa.eu/consumers/odr.