Privacy Policy
Viavo is a voice assistant. To do what you ask, it has to hear you, understand you and reach the apps and data on your phone. This page says exactly what leaves your phone, where it goes, how long we keep it and how to delete it. We do not sell your data and we show no advertising inside the app. We do advertise Viavo elsewhere, and section 9 says how we measure that.
1. Who is responsible
Viavo is developed and operated by its developer (“we”). Contact us through the Support page.
2. Your account
You sign in with Apple or Google. We receive the identifier that provider gives us, your e-mail address (with Sign in with Apple it may be a private relay address) and, if provided, your name. The account keeps your settings and data together across your devices and lets us apply fair usage limits. Sign-in is handled by Supabase Auth. With Sign in with Apple we also keep the token needed to revoke the sign-in at Apple when you delete the account.
3. Your voice
Recording starts only when you tap the microphone button, on the phone or on the CarPlay screen, and stops after you finish speaking or after 30 seconds. There is no wake word and no listening in the background.
- Server recognition (default). The recording is streamed over an encrypted connection to ElevenLabs’ speech-to-text service with a short-lived token issued by our server, and the text comes back to the app. To recognise names right, the stream carries a short list of hints: the names of your contacts, the artists in your library and the streets and towns of your recent routes. For your first requests, for some languages, when the stream fails or when it is turned off on our side, the recording is uploaded to our server instead and transcribed by two services at once, OpenAI and ElevenLabs, so a word one of them mishears can be checked against the other. Both get the same list of hints, and OpenAI also gets the languages you are likely to speak (those of your earlier requests and of the app). We do not keep the audio after the transcript is produced.
- On-device recognition. In Settings you can switch to recognition on the phone. The app then downloads a speech model (from Hugging Face, about 500 MB) and your audio never leaves your phone; only the text does.
4. Understanding and answering
The text of your request is sent to our server and from there to Anthropic’s Claude model, which works out what you want and writes the answer. Before that, the request text alone also goes to TypeSafe AI’s decision model, which only says whether the request is about the weather, your calendar, a call or new chat messages, so that the answer can be looked up in one step; it writes nothing and gets no other data. For questions about current facts, the model may run a web search; your request text is what is searched for. When you ask for a place by its quality (a good restaurant, a well-rated salon, whether a shop is open now), the search text goes to Google Places together with the city you named or, for places around you, your coordinates. When you ask for a place on the way somewhere, the destination you named (or the coordinates of your saved home or work) and your coordinates also go to Google’s Routes API, which works out the drive so that places can be ranked by the detour they cost. The answer is turned into speech by Microsoft Azure Speech (or ElevenLabs or OpenAI when it is unavailable); only the answer text is sent to them.
To answer well, each request carries some context from your phone:
- your location (coordinates from the phone’s location service), time zone and app language, and the home and work addresses you saved in Settings, so the assistant can find places near you and route you home. Coordinates are used only to answer the request and are not stored; a bug report keeps only the city and country;
- which navigator and music app you chose, which apps are installed and which permissions are off, so the assistant can say what it can and cannot do;
- what is playing now, when you ask about music;
- your upcoming calendar events and reminders, when the request concerns them.
Messengers. If you connect Telegram or Slack in Settings and ask about your messages (“what did Anna write?”, “tell the team I’m late”), our server reads or sends, on your behalf and only at that moment, what you asked for, and passes the text of the fetched messages to the language model so it can answer. Voice messages are transcribed by OpenAI. The access to your account (the Telegram session, the Slack token) is encrypted with a key kept only on the server and stored on your phone, never on the server; the fetched messages are not stored. The assistant’s spoken retelling is kept as part of the day’s conversation like any reply. You agree to this on the Messengers screen before connecting, and “Disconnect” ends it. The mechanics are described in detail in How Viavo handles your messages.
Claude routines. If you add one of your own Claude Code routines in Settings (a job you set up in your Claude account at claude.ai) and ask the assistant to run it (“run create task in Claude with this message”), our server starts that routine once with the task you gave: your dictated words, or the exact text of the message you asked about, with its sender and chat. The routine then runs in your Claude account, on your subscription and with the connectors you gave it there, and is covered by Anthropic’s terms for your account, not by this policy. When it finishes it sends a short report back to our server, and the assistant reads it to you once. The routine’s access token is encrypted with a key kept only on the server and stored on your phone, never on the server; “Remove” on the Claude routines screen ends it.
Memory. When Memory is on (it is by default; the switch is in Settings → Memory), the assistant keeps facts you tell it about yourself (“remember that I drive an electric car”: your car, people, places, tastes) and what it notices in conversation, and daily summaries of your conversations so it can answer “what did we talk about on Monday?”. Facts are shown and deleted one by one on the Memory screen or by saying “forget about…”. To search the summaries, each one is turned into a numeric embedding by OpenAI; only the summary text is sent for that.
Weather questions send your coordinates to Open-Meteo. Podcast searches send the search text to Apple’s iTunes Search API. When your music app is Spotify, YouTube Music or Deezer, a music request sends the search text (the artist, song, album or playlist you named, not your words) from our server to that service’s catalog API, so the app opens on the right track; Apple Music searches on your phone, and Yandex Music opens its own search screen. A request for a YouTube video sends the search text, or the channel name, to Google’s YouTube Data API. None of these searches is tied to your account with that service, and we do not store them. Places are looked up with Apple Maps on your phone under Apple’s own privacy terms.
5. Data we store for you
Everything below is stored under your account on our server, hosted by Supabase in the European Union (Ireland), protected by row-level access rules so only you and the assistant acting for you can read it.
| Data | Why | Kept |
|---|---|---|
| Conversation messages (your requests and the assistant’s replies) | So the assistant remembers what you said earlier today | 7 days |
| Daily conversation summaries | Same, in compact form; with Memory on, also so the assistant can recall an earlier day | 7 days; while Memory is on, until you turn it off or delete the account |
| Facts you asked the assistant to remember or that it noticed, with Memory on | To take them into account in every reply | Until you delete the fact, clear the memory or delete the account |
| Contact names and nicknames only, never phone numbers or e-mails | To recognise who you mean when you say “call Anna”. The number stays on your phone and the call is placed by the Phone app | Until you sign out, re-sync or delete the account |
| Artist names from your Apple Music library | To recognise what you ask to play | Until you re-sync or delete the account |
| Names of your HomeKit homes, rooms, accessories and scenes, only after you turn HomeKit on in Settings | To recognise “open the garage”. Commands run on your phone. HomeKit data is never used for marketing, advertising or data mining | Until you turn HomeKit off or delete the account |
| Notes you dictate | That is the feature | Until you delete the note |
| Preferences: navigator, music app, language, onboarding state | To keep them across devices | Until you delete the account |
| Bug reports and wishes you say to the assistant, with the transcript, the day’s recent messages and context | To fix the problem and answer you | Until handled, then archived |
| Nothing about connected messengers: the encrypted account access lives on your phone, and messages fetched from Telegram or Slack are used for the reply and discarded | See section 4 | Not stored |
| For each Claude routine you ran: the routine’s name, a link to the run in your Claude account and the report it sent back. The task itself and the token are not stored | To read the report to you and so you can find the run | Until you delete the account |
| Request counts per day, the week’s credit balance and credit purchases | Fair usage limits and billing | Counts 40 days; balance and purchases until you delete the account |
| Your plan (free credits or Viavo Plus), when and from which screen the subscription offer was shown and what was bought. Purchases themselves are processed by Apple and RevenueCat; we receive the subscription status and the product bought, never card details | Billing and to compare offers, prices and screens between groups of users (A/B tests) | Plan until you delete the account; the events 90 days |
| How you use the app: which screens you open, which buttons you tap, the settings you change (the setting and the option chosen) and how purchases and onboarding steps ended. Only names of screens, buttons and options, never what you say, type or read | To see what works and what confuses people, and to improve the app | 90 days |
| Technical events: type of request, how it went, a template of the request with the specifics removed (“call {contact}”), which tools ran, response time, error type | To find and fix failures. Never your words: a template that still contains a name, a number or a value from the request is discarded | 90 days |
| A request that went wrong and the assistant’s reply, with names, numbers, addresses and everything the tools returned removed, only while “Help improve Viavo” is on (it is by default; the switch is in onboarding and in Settings) | So the team can see what failed. Requests that worked are never kept as text | 30 days; turning the switch off deletes them at once |
The only third-party SDK in the app besides the store is Meta’s, used to measure our own advertising (section 9); there is no third-party analytics SDK. Model prompts and answers are not used to train any model by us.
6. Permissions on your phone
Viavo asks for each permission when you first need it and works without any of them except the microphone. Microphone: to hear you. Location: for routes, places and weather. Contacts: to call by name. Apple Music: to play from your library. Calendar and Reminders: to create and read events and reminders. HomeKit: to control accessories. Tracking (the “Allow Viavo to track your activity” dialog): only to measure our advertising, see section 9; Viavo works the same whichever way you answer. You can change any permission in Viavo Settings → Permissions or in the iPhone Settings app.
7. Apps Viavo opens
When you ask for a route, music or a video, Viavo opens the app you chose (Apple Maps, Google Maps, Waze, Yandex Maps or Navigator, Apple Music, Spotify, YouTube Music, Deezer, Yandex Music, Apple Podcasts, YouTube) and passes it the destination, the item found or the search text. From that point the other app’s privacy policy applies.
8. Service providers
| Provider | What for | What they receive |
|---|---|---|
| Supabase | Hosting, sign-in, database (EU, Ireland) | Everything in section 5 |
| Anthropic | Language model, web search | Request text, context from section 4, recent conversation, and the text of messenger messages fetched to answer a request |
| OpenAI | Speech-to-text of uploaded recordings; embeddings for memory recall; backup text-to-speech | Your recording when it is uploaded rather than streamed (section 3), with the same recognition hints (contact and artist names, streets and towns of recent routes) and the languages you are likely to speak; voice messages from Telegram when you ask about them; daily summaries; answer text |
| Telegram, Slack | Reading and sending your messages, only when you ask and only after you connected the account | The same requests your own Telegram or Slack app makes, from your account |
| Anthropic (claude.ai, your own account) | Running a Claude routine you added, only when you ask | The task you gave: your words, or the text of the message you asked about with its sender and chat |
| ElevenLabs | Speech-to-text; text-to-speech | Your recording with recognition hints (contact and artist names, streets and towns of recent routes); answer text |
| Microsoft (Azure Speech) | Backup text-to-speech | Answer text |
| RevenueCat | Subscriptions and credit packs bought through the App Store; forwarding purchase events to Meta and Apple Ads (section 9) | Your account identifier and the purchase status from Apple; no payment details. For attribution: the device vendor identifier, the IP address, the Meta SDK’s anonymous install id, Apple’s attribution token and, only if you allowed tracking, the advertising identifier |
| Meta (Facebook, Instagram) | Measuring our ads (section 9) | That the app was installed and opened, an anonymous install id, device model and iOS version; the fact that a subscription or a credit pack was bought, through RevenueCat and the SDK; crash reports about the SDK’s own code, not tied to you; the advertising identifier only if you allowed tracking |
| Open-Meteo | Weather | Coordinates |
| TypeSafe AI | Deciding which lookup (weather, calendar, contact, chat inbox) a request needs before the answer | Request text |
| Google (Places API, Routes API) | Finding places with ratings, opening hours and reviews when you ask for a place by its quality, and places along your drive with the detour and the time to each | The search text of the request, the city you named or your coordinates, your country; for places on the way, also the destination you named or the coordinates of your saved home or work |
| Spotify | Finding the track to open, when Spotify is your music app | The search text of a music request and your country |
| Google (YouTube Data API) | Finding the video to open in YouTube, or the track when YouTube Music is your music app | The search text or channel name of a video or music request and your country |
| Deezer | Finding the track to open, when Deezer is your music app | The search text of a music request |
| Apple, Google | Sign-in; Apple Music, Maps, iTunes Search on the device | Per their own terms |
| Hugging Face | Download of the on-device speech model, only if you enable it | Nothing but the download request |
These providers process data on our instructions. Some of them are located in the United States; transfers rely on their standard contractual safeguards.
9. Measuring our advertising
We advertise Viavo on Meta’s platforms (Facebook, Instagram) and in Apple Search Ads. To know which ads bring drivers who stay and which do not, so that the money goes to the ads that work, three things happen.
- Meta’s SDK in the app tells Meta that the app was installed and opened, together with an anonymous install id, the device model and the iOS version, and, if the SDK itself crashes, a report about its own code that is not tied to you. Never your voice, your requests or anything you say, type or read.
- Purchases. When you start a subscription or buy a credit pack, RevenueCat (our purchase provider) and Meta’s SDK tell Meta that a purchase happened on that install, with the same anonymous id and the price, so Meta can tell which ad led to it. Your name, e-mail and account are not sent.
- The tracking dialog. iOS asks once whether Viavo may “track your activity across other companies’ apps and websites”. If you allow it, the phone’s advertising identifier (IDFA) is added to what Meta and RevenueCat receive above, which lets Meta match the install to the ad more precisely. If you do not allow it, nothing else changes: Apple still reports to Meta, in aggregate and with a delay, that an ad led to an install (SKAdNetwork / AdAttributionKit), without any identifier of you. You can change the answer at any time in iPhone Settings → Privacy & Security → Tracking.
For Apple Search Ads, the app reads an attribution token from Apple and passes it to RevenueCat, which asks Apple whether the install came from one of our campaigns. The token identifies the ad click, not you. Meta and Apple keep what they receive under their own privacy policies; our account with them holds campaign figures, never a list of people. We never buy audiences from, or share your data with, data brokers.
10. Deleting your data
Signing out removes the session from the phone. To delete your account and everything in section 5, use “Delete account” in Viavo Settings, or ask us via the Support page and we will do it within 30 days. Contact and music data is replaced on each sync and removed with the account.
11. Your rights
If you are in the EU, the UK or another place with data protection laws, you can ask for a copy of your data, its correction or deletion, and object to processing. Our legal bases are performing the service you asked for and, for phone permissions and for tracking, your consent, which you can withdraw at any time; and for measuring our advertising without an identifier, our legitimate interest in knowing which ads work. Write to us via the Support page.
12. Children
Viavo is for drivers and is not directed to children under 16. We do not knowingly collect data from children.
13. Changes
When this policy changes we update the date at the top. Significant changes are announced in the app.