Sovereign Scribe — Privacy Policy

Notice at collection

California law asks us to tell you, at or before the moment we collect anything, what we collect and why. This is that notice. Everything in it is explained in longer form below.

Server logs are our host's, not ours. We operate no log store. The company that hosts every instance records ordinary connection logs — including your IP address — and keeps them for a limited period that it sets and we cannot shorten. We never copy them anywhere, and nothing in this product writes a server log of its own.

Location: none. There is no location permission in the app, no GPS, no IP geolocation, and nothing in this product ever infers where you are. You declare a jurisdiction; we never look one up.

We do not sell or share personal information as the California Consumer Privacy Act uses those words, and we never have. We do not use your content to train any AI model, ours or anyone else's, and we do not serve advertising.

Who we are

SVRGN Inc. ("Sovereign", "we") is a Delaware corporation operating from Austin, Texas. SVRGN Inc. makes, operates and publishes Sovereign Scribe: the App Store names SVRGN Inc. as the seller of the app, SVRGN Inc. decides what is done with the information this policy describes, and SVRGN Inc. is who this policy is about.

Write to hello@svrgninc.com with any question about this policy, or to exercise any right in it.

The one thing to understand first

There are two versions of this product, and they hold your information in different places.

The free app records and transcribes entirely on your phone. The audio is captured by your phone, transcribed by a model running on your phone, and stored on your phone. We do not receive it. If you never create an account, we hold nothing about you at all — unless you turn on Source Check for that recording, described below, in which case the text of that one recording is sent to our server for the duration of the check.

Scribe Private gives you your own server. When you subscribe, we provision an isolated instance — its own database, its own storage, not a shared table with a customer column. Your session text goes there so it can be turned into a debrief. That instance is operated by us, on infrastructure we rent, and this policy describes what we do with what is in it.

The claim we make about audio is exact, and it carries a qualifier that we will not drop: audio never leaves your phone by default. Two things can change that, and both require you to act. You can upload a recording deliberately (see Uploads). And the transcript — the text, not the audio — is sent to your room whenever you use Scribe Private, because that is what a debrief is made from. Anyone who tells you that a cloud-connected recorder keeps everything on your device is describing a wish. We are describing a boundary.

Checking one recording (Source Check)

The free app also lets you turn on, for one recording, a check called Source Check that reads the words you record and looks each factual statement up against public web sources while you record. Cards on your phone mark each statement Confirmed, Uncertain or Contradicted with the source that was checked, and when the recording ends a list of statements to get in writing follows. The purchase is a consumable in-app purchase handled by Apple; you pay per recording, you turn it on per recording, and nothing about a recording you did not turn Source Check on for is sent anywhere. Source Check works on any recording; what it can confirm depends on what public sources exist for the statements made, and a recording with no checkable public claims returns a result that says so. This section describes what that check does with what it reads.

What is sent. The text of what was said, as your phone finalises it, sentence by sentence while the recording runs. The audio recording stays on your phone; the transcript for any recording you did not turn Source Check on for stays on your phone as well, and neither is uploaded. The short search queries the server derives from the text are sent to public search engines through our own search service; the same "never the audio, never the transcript itself" boundary described in the Scribe Private section below applies.

When it is sent. Only after you turn Source Check on for that recording, bought it through Apple, and started recording. Turning Source Check on for a later recording is a separate purchase and a separate decision.

Where it goes. A server SVRGN Inc. runs on infrastructure we rent. The same subprocessors that operate Scribe Private operate this check: Anthropic for the models that read the sentences and compose the cards; Railway for the hosting that server runs on; Brave Software for the Brave Search API our search service falls back to; and Hostinger for the mailbox that sends you any receipt or account email that follows. Stripe is not involved in the check-lane purchase itself, because Apple handles the in-app purchase; Stripe processes only the Scribe Private subscription described elsewhere in this policy. Twilio SendGrid is not involved in delivering check-lane output; the cards and the list appear in the app on your phone.

What is kept and for how long. The words you recorded and the cards the server returned for that recording are kept on the server for 30 days from the end of the recording, and then deleted. The contentless record of the session — that you started it, that you completed the purchase, that a result was returned, that the content was deleted — stays after that as the same append-only tombstone described in Deleting your data — and what survives. It carries no words from your recording and no card text.

If you were recorded. The other person's words are personal data about that person as well as about you: what somebody said in your presence is information about them, and telling us to check it in a way that searches public sources by their statement is a use of it. If you believe you were recorded by a Scribe user and want to ask what was kept about you, or ask us to delete it, write to hello@svrgninc.com. We answer within 30 days and we never charge for it; the account holder is who can identify the recording, so a request that names the approximate date, the app the user was carrying, and the context helps us find it.

Apple handles the purchase and its refund. Because the check is a consumable in-app purchase, the transaction is between you and Apple: your payment method, your receipt, and your refund request all live in Apple's account, not in ours. To ask for a refund, use Report a Problem in your Apple purchase history rather than writing to us; we do not receive the payment and we cannot reverse it. What we can do is delete the recording's text and cards from our server on request, ahead of the 30-day expiry.

Nothing here is legal advice. The check is a search of public sources, not a verdict about a person or an offer. A Confirmed card means a source agreed; an Uncertain card means no source was found; a Contradicted card means a source disagreed. None of those is a statement that the other person is honest or that any decision you make in response is the right one. Get the list of statements in writing, and take the ordinary advice you would take about anything important.

What we collect, in detail

From the app, on your phone

Audio, and the transcript your phone makes from it, stay in the app's own storage under iOS file protection. There are no analytics SDKs, no crash reporters, no advertising libraries, and no third-party code of any kind that phones home. The privacy manifest shipped inside the app declares the data types Source Check can collect: the words spoken, as text; a device identifier used only to tie a purchase to this phone; and purchase history. A manifest describes a build, so those types are declared for the whole app whether or not you ever turn Source Check on. Nothing under them is collected until you turn Source Check on for a recording, and what is collected is deleted after 30 days. The manifest still declares no tracking domains, which is a statement we can make because it is true of the binary, not merely of our intentions.

From a session, to your room

When a session runs against Scribe Private we receive:

• the text of what was said, as your phone finalised it;
• the title you gave the recording, if you gave one — used only to name it in your room;
• session metadata: identifiers, timestamps, the jurisdiction you declared, the consent posture the room derived from it, which version of the attestation you agreed to, and whether the spoken announcement and chime were armed.

That last group exists because this product's promise is that a recording was disclosed. Metadata is the evidence of it.

Uploads

If you upload an existing recording, the audio file goes to your room, is transcribed by Sovereign's own transcription fleet running on our own infrastructure — no third-party speech-recognition service receives it at any point — and is then deleted as soon as transcription finishes, on success and on failure alike. The deletion is written to your room's ledger as a record of how many bytes, how long, which model, how many speakers. That the file is gone is auditable after it is gone.

Account and billing

An email address, and what Stripe tells us about your subscription. Card numbers go to Stripe directly; we never hold them.

What we never collect

• Your location, by any method.
• Your contacts, calendar, photos, or any other app's data.
• A voiceprint. Speaker separation, where it runs, labels voices "S1" and "S2" for the length of one job. It does not identify anybody and it does not persist a biometric template. We will not ship voiceprint identification without a dedicated legal review first.
• Anything from anyone under 13. See Children.

Who else processes this

Each provider processes data only to provide its service to us, and we stay responsible for what they do with it. This is the whole list.

• Anthropic — the AI models that compose your debrief and check claims. Prompts contain your transcript text. This content is not used to train models.
• Railway — hosting. Your isolated instance and its database run there. This is the most sensitive provider on this list.
• Twilio SendGrid — sending your debrief to your own email address.
• Hostinger — the mailbox that sends account email, such as your sign-in link.
• Stripe — subscription payments.
• Brave Software — the Brave Search API, called by your room as a fallback when the primary search engines return nothing for a claim. Brave receives the search query text and our server's address; it does not receive audio, the transcript, or anything that identifies you.

Three notes on this list, because a short list invites the question of what was left off it.

Transcription is not on it. Your phone does its own. The upload path uses our own fleet on our own infrastructure.

Claim-checking happens on every Private recording. While a session is being recorded, and again when the debrief is written, your room turns factual claims in the transcript into short search queries and sends them — never the audio, never the transcript itself — to public search engines through our own search service, and, when those return nothing, to the Brave Search API. Your room reads the public snippets that come back. Those services see the query text and our server's address; they do not see who you are, your phone number, or the rest of the conversation. If you would rather a given conversation's claims were not searched, record it on the free app, which is unpaired and, unless you turn on Source Check for that recording, contacts no server at all and issues no search on your behalf.

A recording marked as a pitch is also researched by company name, when your room has that feature enabled. After a randomised delay, your room issues public-source lookups about the company named in the conversation, so the debrief carries background you would otherwise have gathered yourself.

How long we keep things

The room states its retention policy in code, and every surface — this policy, the app screen, the App Store data-safety answers — reads that one statement so they cannot drift:

life-of-account; deleted within 30 days of account deletion. Uploaded audio is deleted as soon as it has been transcribed.

(Policy version retention/v2, served at GET /api/v1/scribe/settings/retention.)

Nothing in your account expires on a timer. Your material lives as long as your account does, because a record you did not ask us to destroy is a record you may still need. You can delete any single session's content at any time, and deleting your account cascades across all of it. Source Check is the one exception, and it is a bounded one: the text and cards for a single recording you turned Source Check on for are deleted 30 days after that recording ends, on that recording's own timer, and the contentless tombstone described below is what remains after that.

"Content" means: uploaded audio until transcription completes, transcripts, debrief artifacts and their index rows, claims and evidence extracted from a transcript, and queued or sent email bodies containing a debrief.

Deleting your data — and what survives

You can delete your account from inside the app. Doing so purges the content above from your room, and we complete that within 30 days of the request. The purge is immediate in practice; 30 days is the outer bound we commit to, not a delay we insert.

What survives is a tombstone, and it is worth explaining precisely, because this is where most privacy policies become vague.

Your room keeps an append-only, hash-chained ledger: a record that things happened. It records that a session was opened, that consent was attested, which posture applied, that a debrief was composed, that it was sent, and that it was deleted. It has been audited field by field and it contains no conversation content and nothing derived from conversation content — no excerpts, no summaries, no transcript hashes. (The audit is published as docs/ledger-content-audit.md in the room's source, which you can read.)

When a debrief is deleted, the chain gains a tombstone: the fact of the deletion, its timestamps, the jurisdiction, the attestation version, the disclosure method. The tombstone carries a reference to the deleted document that is computed over a random per-session key — and that key is deleted with the content. After a purge, the reference cannot be linked back to any document by anyone, including us. That is the property that lets an un-rewritable chain coexist with a real deletion promise, and it is why the chain surviving is not a loophole in this section.

We keep the tombstones and the session metadata because they are the only proof that a recording was disclosed and consented to — the evidence you would want if the recording were ever questioned. If you would rather we did not hold that evidence, the answer is to close the account, at which point the content is gone and what remains cannot be read back into a conversation.

Your rights

Wherever you live, you can ask us what we hold about you, ask us to correct it, ask us to delete it, and ask for a copy. Write to hello@svrgninc.com. We answer within 30 days and we never charge for it. We will not treat you differently for asking.

If you are in California, those are your rights to know, delete, correct, and to opt out of sale or sharing — and there is nothing to opt out of, because we do not sell or share. You may use an authorised agent. If we ever cannot delete something you asked us to delete, we will tell you which item and why, rather than declining in general terms.

Transcripts of a conversation may include information California treats as sensitive. We use it for one purpose — producing the debrief you asked for — and for no secondary purpose, which is narrower than the law's limit. Because that use is limited to performing the service you asked for — one of the purposes the CCPA regulations permit without an opt-out — there is no "Limit the Use of My Sensitive Personal Information" link on this site, and nothing you would need one for.

Residents of other states with comparable laws have comparable rights, and we apply the same process to everyone rather than running a different one per state.

Security

Your instance is isolated: its own database, its own storage. Authorisation is deny-by-default — a route is unreachable unless it has been explicitly opened. On your phone, stored sessions sit under iOS file protection.

We do not claim a security certification we do not hold. Sovereign is not SOC 2 audited and no auditor is engaged. We will never describe this product as "end-to-end encrypted", because it is not, and we will not describe it as "HIPAA compliant", because we are not a covered entity — see the separate HIPAA note.

Children

Sovereign Scribe is not directed to children. We do not knowingly collect personal information from anyone under 13, and if we learn we have, we delete it. The service itself is offered only to adults: the Terms require you to be 18 or older.

Changes

When we change this policy we change the version and the date at the top. If a change materially affects what we do with your material, we will tell you directly rather than rely on you noticing.

Contact

SVRGN Inc., Austin, Texas · hello@svrgninc.com