Voxpression privacy notice

1. Who is responsible

Voxpression is made by Voxpression B.V., a private limited company (besloten vennootschap) registered in the Netherlands, Chamber of Commerce (KvK) number [KvK number], Vissersdijk Beneden 70, 3319 GW Dordrecht, the Netherlands. Voxpression B.V. is responsible for your personal data under this notice (the "controller").

Contact: [privacy@voxpression.com]. We answer within one month.

[Until the KvK number is known, the app shows instead: "Voxpression B.V. i.o. (in oprichting), Chamber of Commerce (KvK) registration pending" and the rest of section 1 unchanged. Replace with the number in the first update after registration; this change alone does not need a new notice version.]

2. What happens on your device

Almost everything Voxpression does happens on your own device and never reaches us:

• Your voice. Speech is turned into text on your device, only while you hold your push-to-talk button. Voxpression does not save or send audio. While WoW is running, Voxpression keeps the last half second of microphone sound in memory, so your first word isn't cut off. It is overwritten all the time and never saved, sent or turned into text unless you press your push-to-talk button. You can switch this off with "Catch the start of speech" in Settings > Push-to-talk, and it is always off for Bluetooth headset microphones.
• WoW's chat log. Only if you choose "Learn names from WoW's chat log" (on the first screen or in Settings), Voxpression switches on World of Warcraft's own chat log and reads it on your device to learn the character names of players you whisper, invite and befriend, and of players who talk near you or in your party, raid or guild. It notes only names and how often and when they talk, never what they say. Trade, General and other numbered channels are skipped. The chat log is not sent to us. If you pair the Voxpression PC app with your Steam Deck, the PC passes new chat log lines to your Deck over your home network, encrypted, so the Deck can learn the names; the Deck deletes them as soon as it has read them. If you switch the option off, Voxpression stops reading the chat log and stops switching it on, and switches WoW's chat log off again if it was Voxpression that switched it on. The names it has already learned stay until you delete them (see Names and corrections). The log file itself belongs to WoW and stays in WoW's Logs folder until you delete it.
• Names and corrections. The character names, rankings and word corrections Voxpression learns are stored on your own devices only. If you pair your Steam Deck with the PC app, the two share your settings, including your chat log choice and the players you ticked under Choose players, over your home network, encrypted. You can delete what Voxpression has learned at any time with Delete my data in Settings → Privacy, or when you uninstall it. This does not delete bug reports you already sent; see section 3 for those.
• Hardware checks. Voxpression looks at your device's hardware (such as graphics memory) to decide which local model fits and whether to suggest the hosted option or a donation. That check happens on your device and nothing about your hardware is sent.
• Controller and keyboard. Voxpression reads your controller only to see when you hold your push-to-talk buttons, and types into the game with a virtual keyboard. If you installed Voxpression through Decky Loader, it runs with the system rights Decky Loader gives every plugin (root) and uses them only for this; the Steam Deck app installed with our own installer runs as the normal Deck user. [Drop the Decky Loader sentence if that version is no longer offered on 4 November.]

We have no access to any of this. We only receive data when you send a bug report.

3. Bug reports

You can speak a report under Settings → Report an issue. Before anything is sent you see the exact text and can redo it or add to it. Reports are sent to reports.voxpression.com when your device is online; until then they wait on your device. Anyone can send a report, also without ticking "I've read the privacy notice" and also under 16; nothing is sent until you press Send.

Every report contains:

• the text of your report as you confirmed it, with every character name your device knows replaced by a placeholder such as Player1;
• the app version, your settings (without any names), and your environment: operating system version (and Decky Loader version, if you use it), whether WoW was running, and whether you use the Deck, the PC app or streaming;
• the newest three technical logs, with message text, names, file paths, IP addresses, computer name and user name removed, and clock times turned into seconds since start;
• whether you chose to add your Voxpression data, and if not, why not.

If you are 16 or older, have read this notice, and answer Yes to "Add your Voxpression data?", the report also contains:

• the decisions Voxpression made in your last three sessions: scores, thresholds, which rule applied and whether it passed, plus timings, channel type and word counts per message. Never the message itself; only the one word that was matched or corrected, with its sound code;
• the character names involved in those decisions, the 20 names Voxpression ranks highest, and your own characters, each with how the speech recognition heard it, its rank, and how many days ago it was used;
• the corrections you tick and those the decisions mention, as the heard word and the meant word;
• the character you last whispered.

Before sending, "Your report includes" lists every name with a tick, and you can remove any. A removed name is replaced by a placeholder; only its scores stay.

A report never contains audio, the text of your chat messages, other players' messages, your IP address, or your Battle.net or Windows account name. Please don't mention real names or contact details in your report. If you do include your own name or email address so we can reply, we use it only to follow up on that report, and it is deleted with the report.

Why we process this (legal basis): handling the report you chose to send, including its technical details, is our legitimate interest (GDPR art. 6(1)(f)), and these details are sent for every report. Including your Voxpression data happens only with your consent (art. 6(1)(a)), which you give per report by answering Yes, only if you are 16 or older and have read this notice, and can withdraw at any time by asking us to delete the report. Withdrawing does not affect what we did with it before.

How long: 90 days after upload, then deleted automatically. Once a report is sent, you cannot delete it from the app. To have it deleted sooner, email privacy@voxpression.com with the report ID the app shows after sending (you can also find it later under Settings, in the list of sent reports), and we delete it within one month, usually much sooner.

4. Other players' names

A bug report with your Voxpression data can include character names of other players you have interacted with. We use them only to understand why name recognition failed, we never publish them, and they are deleted with the report. We cannot inform those players individually, which is why this notice is public. If you believe your character name is in a report and want it removed, contact us.

5. Who else sees the data

We use two companies to process bug reports on our behalf, under data processing agreements with EU Standard Contractual Clauses:

• Cloudflare receives and stores reports. Reports are stored in the European Union. Cloudflare counts IP addresses to limit abuse but we do not store them. The app also checks voxpression.com for updates; that check carries your IP address to Cloudflare and nothing else, and it can tell the app that a version is no longer supported. When the app downloads a speech model, your device fetches it from voxpression.com (through Cloudflare), which sees your IP address and nothing else.
• Anthropic may provide the Claude model we use to help analyse reports. We only use it under Anthropic's commercial terms, through an account held by Voxpression B.V.; those terms prohibit training on our data, and Anthropic deletes inputs within 30 days. Until that account exists, no report is analysed with Claude.

We do not sell data, and we do not share it with anyone else unless the law requires it.

6. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to access the personal data we hold about you, and to have it corrected or deleted. You also have the right to restrict our use of it, to object to processing based on our legitimate interest, to receive your data in a portable form where that applies, and to withdraw consent at any time. To use any of these rights, email privacy@voxpression.com. Please include your report ID if you have it, so we can find the data. We answer within one month.

You have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the data protection authority in the EU country where you live. We would appreciate the chance to resolve your concern first, but you do not have to contact us before filing a complaint.

7. Age

Everyone can use Voxpression on their own device. Adding your Voxpression data to a bug report, and future online features, are only for players aged 16 and over who have read this notice. Players under 16 can still send a bug report with its text and technical details, but without names. If you believe we hold Voxpression data from someone under 16, contact us and we will delete it.

8. The website

voxpression.com is hosted through Cloudflare, which sees your IP address when you visit and keeps short-lived server logs to protect the site. The site sets no tracking cookies, uses no analytics and has no accounts or payments. If you email us, we keep your message as long as needed to answer it and delete it within [12 months]. [Website project to confirm hosting, cookies, analytics and the retention period before this goes live.]

9. Changes

If this notice changes in a way that matters, the app shows it again before you continue. Earlier versions are available on request.