Privacy Policy

Effective Date: October 1, 2026

Voxfire (voxfire.co.uk) is designed around a fundamental principle: your thoughts, your personal reflections, and the sound of your voice belong entirely to you. We do not sell your data, we do not run advertisements, and we do not track you across the web.

1. Who We Are and How to Contact Us

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller responsible for your personal information is:

2. Information We Collect and Why We Collect It

A. Account & Identity Information

  • What: Your email address, encrypted authentication credentials, and chosen display name / first name.
  • Why: To create and authenticate your account, secure your sessions, provide password recovery, and address you personally within the app.

B. Onboarding Responses & Preferences

  • What: Your selected focus areas (e.g., quiet mind, confidence, sleep), affirmation experience level, emotional state indicators, daily practice duration targets, and optional personal reflections (“one thing you wish to let go of”).
  • Why: To tailor your autosuggestion library and calibrate your suggested daily routine.

C. Session Configurations

  • What: Session names, custom affirmation phrasing you create, background ambient selections, loop settings, and sequencing preferences.
  • Why: To assemble and playback your custom audio sessions whenever you open the app.

D. Voice Audio Recordings

  • What: Short voice recordings you create directly in the app to speak your chosen affirmations.
  • Why: To layer your own voice into your autosuggestion playback sessions. Your audio is recorded locally in your browser and stored in an isolated, encrypted storage container accessible exclusively by you.

E. Subscription & Billing Records

  • What: Stripe customer IDs, subscription status (trialing, active, cancelled), and renewal dates.
  • Why: To manage your free trial and access to Voxfire+. Note: Voxfire never receives, processes, or stores your credit card number, expiry date, or CVC. All card handling is performed directly by Stripe.

3. Our Legal Basis for Processing (UK GDPR)

Under the UK GDPR, we rely on the following lawful bases to process your information:

  • Performance of a Contract: Processing your email, account credentials, subscription status, and session configurations is necessary to provide the Voxfire service you have registered for under our Terms of Service.
  • Explicit Consent (Special Category Data): When you choose to record your voice or provide optional self-reflections regarding your emotional state or wellbeing, you provide your explicit consent for Voxfire to process this information solely to construct your private audio sessions. You may withdraw this consent at any time by deleting individual recordings or closing your account.
  • Legal Obligation: Retaining mandatory transaction and invoicing records through our payment processor for statutory accounting and tax compliance in the UK.
  • Legitimate Interests: Running essential diagnostic logging to prevent fraud, fix technical crashes, and ensure system uptime.

4. How We Protect Your Information

We apply rigorous technical safeguards to ensure your recordings and personal details remain confidential:

  • Row-Level Security (RLS): Every database entry and voice recording is partitioned at the database engine level with granular access policies. No user can read, query, or download another user’s audio or session files.
  • Private Storage Buckets: Your voice recordings are stored in private, access-restricted cloud storage. Temporary audio streaming links are generated via short-lived, cryptographically signed URLs only when you play a session.
  • Encryption: All data transmitted between your browser and our servers is encrypted in transit using Transport Layer Security (TLS 1.3). Data in our database and storage buckets is encrypted at rest.
  • Zero Advertising & No Data Profiling: We do not sell your personal data, rent subscriber lists, or monetise your listening habits with third-party advertisers.

5. Third-Party Service Providers (Data Processors)

We work with only three vetted service providers to deliver the Voxfire platform. Each handles your information solely on our written instructions under a data processing agreement, and never for its own advertising purposes. We do not use third-party analytics or tracking tools (such as Google Analytics, Mixpanel or Plausible), we run no advertising or social-media beacons, and we set no tracking cookies:

Lovable Cloud / Supabase

  • Purpose: Account authentication, database storage, encrypted hosting of your voice recordings, and delivery of the transactional emails listed in section 9.
  • Data Handled: Email, display name, onboarding inputs, session configs, voice audio files.
  • Location: European Union (Ireland). Your account details, recordings and session data are stored in this region.

Stripe Payments Europe Ltd

  • Purpose: Payment card tokenisation, trial management, and subscription billing.
  • Data Handled: Payment card details (handled directly by Stripe), billing email, country, billing address.
  • Location: United Kingdom / EU / USA (processed under Standard Contractual Clauses).

Cloudflare, Inc.

  • Purpose: Delivers the Voxfire website and app to your browser, and screens out abusive traffic, bots and denial-of-service attacks.
  • Data Handled: Standard request details — your IP address, the pages and files requested, and basic browser and device information. Voice recordings, session contents and account passwords do not pass through or are stored by Cloudflare.
  • Location: A global delivery network. Cloudflare processes these details as our processor under its Data Processing Addendum, relying on the EU–US Data Privacy Framework and Standard Contractual Clauses for any transfer outside the UK/EEA.

Typography note: All fonts (Cormorant Garamond and Inter) are bundled locally within the Voxfire web application. Your browser makes zero external connections to Google Fonts or third-party style repositories.

6. Your Rights Under UK GDPR

As a resident of the United Kingdom, you hold comprehensive rights over your personal data:

  • Right of Access: You can request a copy of the personal information we hold about you.
  • Right to Rectification: You may ask us to update or correct inaccurate information.
  • Right to Erasure (“Right to be Forgotten”): You have the absolute right to demand the permanent deletion of your account and all associated voice audio.
  • Right to Restrict or Object to Processing: You can ask us to pause or limit how we process your information under certain circumstances.
  • Right to Data Portability: You can request a machine-readable export of the text data you have provided to us.
  • Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without penalty.

To exercise any of these statutory rights, please email us at privacy@voxfire.co.uk. We respond to all verified requests within one calendar month.

7. Data Retention and How to Delete Your Data

We retain your account details, session configurations, and recorded audio for as long as your account is active so you can continue your autosuggestion practice.

Instant, Self-Service Data Deletion

You do not need to contact support to erase your data. At any time, you can navigate to Settings > Delete account and all data. Triggering this action will immediately and irreversibly:

  1. Permanently delete every voice recording file from our cloud storage.
  2. Wipe all session configurations and affirmation records.
  3. Remove your onboarding answers and personal reflections.
  4. Delete your user identity and email from our authentication systems.

Note: Active subscriptions will be halted, and minimum statutory billing records maintained by Stripe will be archived as required by UK financial record-keeping laws.

8. Local Storage and Cookies

Voxfire operates as a lightweight Progressive Web App (PWA). We do not use tracking cookies, marketing cookies, or third-party advertising beacons.

We utilise browser localStorage solely for strictly necessary operational features:

  • Authentication Session: To keep you securely signed in to your account between browser visits.
  • Onboarding Progress: To temporarily preserve your answers while you complete the welcome journey before creating an account.
  • Practice Reminder: To schedule on-device notifications at your chosen daily practice time (handled locally on your phone or laptop).

Because these items are strictly necessary to deliver the technical service you requested, they do not require consent banners under PECR / the Privacy and Electronic Communications Regulations.

9. Automated Email Communications

We do not send promotional marketing newsletters or automated spam. The only automated emails generated by Voxfire are strictly transactional:

  • Password reset and login verification emails initiated by you.
  • Essential subscription receipts, invoice confirmations, and billing alerts dispatched by Stripe.

Account emails are dispatched on our behalf by our platform provider (see section 5) from the voxfire.co.uk domain, and billing emails by Stripe. We do not use any third-party marketing or newsletter email platform.

10. Changes to This Privacy Policy

We may occasionally update this Privacy Policy to reflect improvements to our app, changes in technology, or evolving legal obligations. If we introduce material changes that affect your privacy rights, we will notify you through an in-app notice or by email prior to the changes taking effect. The “Last Updated” date at the top will always reflect the current version.

11. How to Contact Us or File a Complaint

If you have questions, feedback, or concerns regarding how your data is handled, please get in touch with our Data Privacy lead:

Elements Web Design (Trading as Voxfire)
Email: privacy@voxfire.co.uk

You also have the right to lodge a complaint at any time with the UK supervisory authority for data protection:

Information Commissioner’s Office (ICO)
Helpline: 0303 123 1113 | Website: ico.org.uk