Privacy Policy

Last updated: 9 October 2026

What we collect

From the app: nothing. ADVCT has no account system, no user profile, no analytics SDK, and no crash reporting. Your recordings, transcripts, and summaries are created on your device and stay under your control. We do not receive them, and we could not read them if we wanted to. Apart from license activation and update checks on copies bought directly from us, the only thing the app sends us is what a Google Drive invite needs: random codes, its end date, one half of a one-time key, and notes sealed so only your phone can open them, described below. Nothing in them says who you are.

The only personal information connected to ADVCT is what you give our payment provider when you buy the app, described in Buying ADVCT below. We never receive your payment details.

Where your data lives

iPhone and iPad

Audio recordings are saved in the app's protected storage on the device that recorded them and never leave it, encrypted at rest with iOS Data Protection. Transcripts and summaries are stored on your device and — so you can read them across your own devices — sync through your own private iCloud (CloudKit), tied to your Apple Account, where only you can reach them. Transcription and summarization run on-device using Apple's built-in Speech and Foundation Models frameworks.

Mac

The same, with recordings encrypted using a key held in the Mac's Keychain, on top of FileVault.

Android

Transcripts, summaries, and to-dos are stored in the app's private storage in an encrypted database (SQLCipher), with the key held in the Android Keystore — hardware-backed (StrongBox) where the device supports it. The audio files themselves sit alongside it in the app's private storage, protected by Android's own file-based encryption, which is tied to your screen lock. They are excluded from both cloud backup and phone-to-phone transfer, so a recording never leaves the device that made it unless you share it yourself. You can also turn on an app lock in Settings, which asks for your fingerprint, face, or screen lock before ADVCT will open.

Speech recognition runs on-device. Android does not use iCloud; nothing syncs anywhere unless you share with family.

When you choose to share

Sharing is always something you start. On Apple devices, sharing a summary or transcript by Messages, Mail, or AirDrop travels through Apple's services under Apple's privacy policy and stays within your own account.

ADVCT's family sharing lets the people you invite read a record's visits — summaries, transcripts, and to-dos — and, if you allow it, help with the to-dos. Audio is never shared; it stays on the device that recorded it. How a share travels depends on the phones in it.

Family who all use Apple devices

When everyone you share with uses an iPhone, iPad, or Mac, family sharing goes through iCloud (CloudKit sharing), between your Apple Account and theirs, under Apple's privacy policy. This kind of sharing never contacts Google, and nobody in an all-Apple family is asked to sign in to Google.

Family with an Android phone

Where the files are. When a share includes someone with an Android phone, ADVCT uses Google Drive. (On Android, Google Drive is how every record is shared with family on other phones.) The person who shares the record connects their own Google account, and ADVCT creates a folder in their Google Drive, named ADVCT/Record- followed by a random ID. It holds the record's visits — each visit's summary, transcript, key points, and to-dos — and the sharer's own to-do updates. A family member who helps with to-dos connects their own Google account too, and ADVCT creates a folder in their Google Drive, named ADVCT/Helper- followed by a random ID, for their to-do updates. File and folder names are made of random IDs, not names or visit details. While an invite is open, ADVCT also makes a small invite folder; see Invites and links below.

End-to-end encrypted. Every one of those files is encrypted (AES-256-GCM) on the device that writes it, before it is uploaded, with a key that only the members of that share hold. Each member's copy of that key is locked to a key pair made on their own device, whose private half never leaves it. Neither Google nor we can read these files. When the person sharing removes someone, ADVCT changes the key, so nothing added afterwards can be read by the person removed.

The member list is not encrypted. Each record's folder also holds a membership file. It is not encrypted, because each member's app has to read it before it can unlock anything. It contains the name of the person the record is about; each member's name and role (for example, whether they can only read); technical details the apps need, such as each member's public keys and their locked copy of the record's key; and the IDs of helpers' folders. The person who shares the record signs it, so nobody else can add themselves or change anyone's role.

Readable by anyone with the link. These folders are shared with Google Drive's "anyone with the link" setting and are unlisted: they can't be found by searching, and they open only for someone who has the folder's link (its ID). ADVCT does not put the record folder's ID in the invite link. It reaches each person inside a sealed file in their invite folder, which opens only with both halves of the invite's key (see Invites and links). (Invites made the older way, before this version, do carry it.) A helper's folder ID travels to you in a sealed note, or in a help request link if they ask to help later, and is listed in the membership file. Anyone who gets hold of a record folder's link can download the encrypted files, which they can't read, and can read the membership file. A forwarded invite link leads only to its own invite folder, not to the record. As with any file shared by link on Google Drive, they may also be able to see which Google account owns the folder.

Reading without signing in. Relatives' phones read these folders without signing in to Google. To do that, ADVCT sends Google an API key: a code that identifies the ADVCT app, not you. Google accepts ADVCT's keys only for Google Drive, and only in requests that identify themselves as the ADVCT app. A family member who only reads never signs in to Google and never gives ADVCT a Google account.

What Google can see. As the storage provider, Google handles these folders under its own terms and privacy policy, and can see: the encrypted files, but not what is in them, and the small signed files in invite folders, along with their size and when they were written; the membership file, including names and roles, in plain text; the Google accounts that own the folders (the person sharing, and each helper); and the IP address of every phone, tablet, or computer that reads or writes the folders, including relatives who never sign in.

What we can see. Requests made with ADVCT's API key count against ADVCT's account with Google, so Google shows us totals for them, such as how many requests were made and how many failed. It does not show us who made them, from where, or what they read. We never receive folder IDs, files, or membership files.

Google sign-in. The person sharing, and each helper, signs in on Google's own sign-in page, in a browser window ADVCT opens. ADVCT asks Google only for the drive.file permission: ADVCT can see and change only the files and folders it created in that Google Drive, and nothing else in it. ADVCT does not ask Google for your name, email address, or contacts. The sign-in tokens Google returns are kept only on that device (in the iPhone's or Mac's keychain, or encrypted with Android's keystore) and are never sent to us.

Disconnecting and stopping. Disconnect Google Drive, in Settings → Google Drive → Disconnect, deletes those sign-in tokens from that device. Until you connect again, the person sharing can't send new visits from that device, and a helper's to-do updates don't reach the family; family members who only read are unaffected. Disconnecting does not delete the folders, and does not remove ADVCT from your Google account's list of connected apps — you can do that at myaccount.google.com/connections. Stopping sharing a record deletes its folder from the sharer's Google Drive (if Google can't be reached, sharing doesn't stop, and the app says so). When a helper leaves a record, or keeps or removes their copy after sharing ends, ADVCT tries to delete that helper's own folder.

Invites and links

What a link carries. To invite someone through Google Drive, ADVCT makes a link that starts with https://advct.app/join. (Between Apple devices the link is an iCloud link, made by Apple.) Everything after the # is the invite itself; browsers never send that part to the website, so advct.app never receives it. The invite carries the name you give your family, the record's display name, whether you meant the person to help with to-dos or only read, when the invite ends, your public signing key, the address of the invite folder (below), a random invite ID, one half of a one-time key, and, for someone already on the record, a code that lets their phone see the invite is for them. It doesn't carry visits, phone numbers, email addresses, the list of who is on the record, or anything that opens the record by itself. The links pass through whichever messaging app you choose to send them, under that app's own privacy policy. Whoever taps Join first gets in. If you sent the link to the wrong number, or someone else opened it first, remove them in Who sees your visits: they stop getting new visits, but what they already saw stays on their phone. A link that starts with https://advct.app/reply is now used only when someone who reads your visits asks to help with to-dos.

The invite pages send nothing anywhere. If ADVCT is installed, a link usually opens it directly. Otherwise it opens the page at advct.app/join or advct.app/reply. Those pages read the part after the # only inside your browser, to build an "Open in ADVCT" button. They send nothing anywhere: no analytics, no third-party scripts, and no referrer. Opening a page is still an ordinary request to advct.app, so our host sees the IP address it came from, as described below, but never the part after the #.

The invite folder. When a share uses Google Drive, ADVCT makes one small invite folder in the sharing person's own Google Drive for each invite, named ADVCT/Invite- followed by a random ID. (An invite between Apple devices uses iCloud and has no invite folder.) Like the record's folder, it is shared with "anyone with the link" and is unlisted, so it can't be found by searching. It holds only small files that the sharing person's phone has signed, so the invited person's phone can check they are genuine, and one sealed file that opens only with both halves of the invite's key, which carries the way into the record. That file is deleted as soon as your phone has added the person, or when the invite ends. If you cancel the invite or remove the person, a small signed file says so. No visits, names, or phone numbers are in it in readable form. After someone joins, their phone reads this folder without signing in, each time ADVCT updates, until your phone has added them.

When it is deleted. ADVCT deletes the invite folder from the sharing person's Google Drive after the person has joined or the invite has ended: within a day after an invite ends, and within a week after your phone adds the person (sooner once they start using the record). If the phone is offline or Google Drive is disconnected at that time, it is deleted the next time ADVCT can reach it.

Google Drive invites end after 7 days. An invite nobody has used ends after 7 days. After that its link no longer works. An invitation sent through iCloud has no 7-day limit: it stays until the person accepts or you cancel it.

Your contacts. When you choose people to invite, ADVCT uses your phone's own contact picker, which hands ADVCT only the people you choose. The names, phone numbers, and emails you pick stay on your own devices (on iPhone and Mac, your family list syncs between your devices through your own private iCloud, like the rest of your record), with one exception: on iPhone and Mac, ADVCT asks iCloud whether each person has an iCloud account, using their phone number or email. That request goes to Apple, under Apple's privacy policy. It does not go to Google or to us. Otherwise ADVCT uses them only to address the message and to label the person in your own list. They are not put in the links or in the invite folder, and none of it is sent to us.

Other places to keep a share

Earlier versions of ADVCT also let you keep a share's encrypted files on the device itself, or in a folder you already share through the Files app (for example iCloud Drive or Dropbox), under that service's own terms. New shares no longer offer these choices, but shares you made that way keep working, with the same encryption and the same unencrypted membership file.

When ADVCT connects to the internet

ADVCT works offline. These are the only times it reaches the network, and what each one involves:

• Checking for updates (copies bought directly from us only) — the app asks updates.advct.app whether a newer version exists, at most once a day, and you can turn this off in Settings. It is a plain request for a public file: no account, no device identifier, and nothing about you is sent.
• Downloading an update — only after you tap to install one. The download is verified against a checksum before anything is installed.
• Activating a license (direct purchases only) — a one-time request to license.advct.app containing your license key and a randomly generated label for the device. It carries no name, no email, no device or advertising identifier. After activation, ADVCT validates your license entirely offline, forever — it never phones home again to check.
• Downloading the speech model (Android) — only after you tap to download it in Settings. ADVCT transcribes on the device itself, so the speech model (about 250 MB) has to be fetched once from downloads.advct.app. Each file is verified against a checksum before it is kept. Nothing about you is sent; it is an ordinary file download, and after it finishes transcription never touches the network again.
• Family sharing, if you use it — between Apple devices, ADVCT contacts iCloud. When a share includes an Android phone, it contacts Google Drive as described above: signed in, to write to your own folder; and without signing in, using ADVCT's API key, to read the share's folders. Sending an invite opens the messaging app you choose; the link passes through it. Opening an invite or help request link either opens ADVCT directly or loads a page from advct.app that sends nothing anywhere (see Invites and links). Shared records are brought up to date when you open the app, when you tap Refresh, and in the background, usually every few hours. If you have a push app installed to receive notifications, ADVCT sends a content-free "wake" ping so other members know to fetch; the ping contains no record data.
• Family invites through Google Drive — when you send one, ADVCT registers it with invite.advct.app: a few random codes, the date the invite ends, and one half of a key. The other half is in the link you send, which the service never sees, so the service can't open anything. When the invited person taps Join, their phone asks the service for its half; the service gives it out once, to the first phone that asks, so the link can't be used again, and forgets its half within a day. The service notes when the invite was made, used and closed, and when a help request arrived. It counts how many other phones tried the invite, so your phone can tell you, and how many help requests arrived. Their phone then leaves a sealed note there for your phone (their public keys, and later the address of their helper folder) that only your phone can open. Your phone collects it, and the service deletes it, at the latest 30 days after the person joined. An invite nobody used is deleted from the service when it ends. A used one is deleted completely 30 days after the later of its end date and the day its sealed notes are deleted. The service keeps no names, phone numbers, email addresses, visit content, or request logs. Cloudflare, which runs it, sees the IP address of each request, as for any website, so it could tell which address sent an invite and which address opened it; the service uses addresses only to slow down floods of requests and doesn't keep them. While an invite is open or recently used, your phone checks it with the service when you open ADVCT and when it updates in the background.

As with any internet request, the servers involved necessarily see the IP address it came from. For the website advct.app that means our web host, A2 Hosting, which keeps standard server access logs (IP address, time, page and browser). For license.advct.app, updates.advct.app, downloads.advct.app and invite.advct.app it means Cloudflare. We do not use either's logs to identify anyone or build any profile of you. Your browser never sends the website the part of an invite link after "#". We do not log license keys, IP addresses, or request contents ourselves.

Buying ADVCT

If you buy ADVCT from the App Store or Google Play, that store handles the purchase under its own privacy policy, and we receive only anonymous sales totals.

If you buy directly from advct.app, the checkout is operated by Lemon Squeezy, which acts as the merchant of record and handles payment, tax, and receipts under its own privacy policy. They hold your email address, billing details, and purchase record; they send you your license key. We never see or store your payment details.

Our own activation service keeps only what licensing requires: a record that a license key has been activated on some device, and an opaque identifier for that activation so you can deactivate it later. It is not linked to your name, your email, or anything about your device.

Permissions we request

• Microphone — to record conversations.
• Speech recognition (Apple devices) — to turn recordings into text, on-device.
• Notifications — to show the recording indicator and, if you use family sharing, to tell you when something new arrives.
• Install updates (Android, direct purchases only) — so the app can install an update you have chosen to download.
• Reminders (optional, Apple devices) — only if you send a to-do to your own Reminders. ADVCT only ever adds reminders; it never reads your existing ones.
• Camera (optional, Android) — only to scan a QR code for the older way of adding someone to a share.
• Google Drive (optional) — only if you share a record with, or help on a record that includes, someone with an Android phone: the drive.file permission described above.

Children and recording responsibly

ADVCT records audio and is intended for adults. It is not directed at children under 13. We do not knowingly collect information from anyone — because we do not collect personal information at all.

Recording laws differ by place, and some require every person in the conversation to consent. Whatever your age or location, make sure everyone in the room knows they are being recorded, and follow the law where you are.

Your choices

• Delete any recording, transcript, or summary in the app at any time — open it and use Delete. Everything derived from it goes too.
• Delete everything at once: Settings → Your data → Delete all my data.
• Audio is deleted automatically 90 days after it was recorded, unless you change that in Settings → Your data, where you can choose 30 days, 90 days, a year, or to keep it. The transcript and summary are kept either way, so the record of what was said survives without the recording itself sitting on your phone forever.
• Uninstalling ADVCT removes its on-device data with it.
• Turn off automatic update checks in Settings (direct purchases).
• Deactivate a device's license in Settings to free it for another device.
• For purchase data held by Lemon Squeezy, use the link in your receipt, or contact us and we will help you reach them.

Changes to this policy

If this policy changes in a way that affects what leaves your device, we will update the date at the top and describe the change in the release notes for the version that introduces it.

Contact

Questions about privacy, or a request about purchase data held by our payment provider: use the contact form on advct.app.