Privacy

Who operates FamiliarVoice

FamiliarVoice Notifications is operated by ZENITH CAPITAL GROUP LLC, Tennessee, United States. It reads supported message notifications aloud using starter voices, your own enrolled voice, or a voice another user has shared with you.

Google sign-in and beta access

We use Google sign-in through Firebase Authentication. Google and Firebase process account information, such as your account identifier, email address and profile information, and authentication information needed to sign you in and keep your session. FamiliarVoice does not receive your Google password. Firebase also processes technical information, including IP addresses and user-agent information, for authentication security and abuse prevention.

The FamiliarVoice backend receives authentication tokens to verify requests. It stores an account identifier, the link to your isolated beta data, access status and related timestamps. The backend identifies your account using the verified sign-in identity rather than using your email address as the ownership key. Signing out does not delete these records.

Beta invitations and existing access codes help activate or migrate beta access. Invitation records include expiry and redemption status; the backend stores a hash of the invitation value rather than the raw value. Existing beta codes may remain in private app storage for the legacy access path. Google Play tester enrollment and in-app beta access are separate.

Message notifications and playback

After you accept the in-app disclosure and enable Android notification access, FamiliarVoice can process supported Google Messages and direct Google Voice notifications. It may send the sender name, a phone number when supplied by the notification, message text, source app identifier and playback preferences to our backend over HTTPS. The backend uses sender information to choose a voice and sends the text needed for speech generation and the selected voice identifier to ElevenLabs.

Automatic mode can request speech when an eligible notification arrives. In On demand mode, speech is requested only when you choose playback. For signed-in accounts, up to four pending messages and the sender information needed for playback are encrypted in private storage on this phone, excluded from app backup and device transfer. They have no timed expiry and may survive app or device restart. A fifth pending message replaces the oldest. Choosing playback removes the pending entry before the speech request; dismissal, leaving On demand, withdrawal of notification-processing consent, sign-out or account-access invalidation also removes pending entries. Recovery waits for the same account to be authorized; force-stopping requires reopening the app. Legacy access-code operation keeps pending messages only in memory. FamiliarVoice does not intentionally store ordinary notification message bodies or generated notification audio in its mapping database.

Generated message audio is temporarily cached on your phone and cleaned up during normal completion, failure, stopping or service shutdown. An unexpected app or device termination may leave cache files until later cleanup. Voice previews send a fixed sample sentence for speech generation, not the contents of an incoming message; preview audio is handled in app memory.

Contact assignments

FamiliarVoice does not request broad access to your address book. Android’s phone-number picker lets you deliberately choose an entry. Selecting an entry for an assignment may save it immediately; a separate confirmation is not always required. The selected name and number are sent to our backend and stored with the voice assignment and matching identifiers. Unassign removes that assignment; it does not delete the contact from your phone or delete the voice.

When Android makes a selected contact photo available, FamiliarVoice may retain a small encrypted thumbnail in private cache on your device to personalize the assigned-person display. Photos are not uploaded or included in app backup. Missing photo access uses initials. Cached thumbnails are removed when the assignment is removed or account access changes; they may also be evicted from the bounded cache. The guided assignment flow sends the chosen name and number when you select Save; some advanced shared-assignment controls save immediately after deliberate contact selection.

Recording and enrolling your voice

My voice is optional. If you choose it, the app requests microphone permission, records a sample for your review, and asks for explicit self-voice enrollment consent before upload. Your recording passes through our backend to ElevenLabs to create the voice used for speech generation. Do not submit someone else’s voice through self-enrollment.

We store the voice’s display name, ownership link, private provider voice reference, enrollment status and consent record, including consent version, method and time. The mapping database does not store the recording itself. Upload handling may use temporary server storage. On your phone, recordings use app-private temporary files; the app attempts cleanup after successful enrollment and when recordings are discarded or the recording flow is closed. Failed cleanup or an unexpected termination can leave temporary files for later cleanup.

ElevenLabs retains voice-cloning data needed to provide the enrolled voice. Instant voice cloning is not covered by its Zero Retention Mode. Removing the local sample or signing out does not delete the provider voice.

Sharing a voice

You can create an invitation and send it through an app you choose. That app processes the invitation under its own privacy practices. Keep invitations private: another signed-in user with eligible access who obtains an unused invitation may be able to redeem it. Voice invitations expire after 24 hours and are intended for one acceptance.

We store invitation status, expiry, voice display name, owner and recipient account references, and accepted sharing permissions. The recipient sees the shared voice’s display name and can use it for supported message playback and fixed previews. Sharing does not send the original enrollment recording or provider credentials to the recipient, and it does not give the owner access to the recipient’s messages or contact list.

Owners can revoke accepted access. New playback requests check authorization; revocation removes the shared route, and later requests may use the recipient’s default-voice preference instead. Revocation cannot undo audio already delivered or played. Deleting an enrolled voice also prevents future authorized use of that voice. Pending invitations currently have no in-app cancellation control and expire instead.

Local settings and technical records

The app stores preferences such as consent, playback mode, unknown-sender behavior, speech speed and the chime setting locally. Authentication/session information is maintained by the sign-in components. Our backend stores account, access, assignment, consent and voice-lifecycle records needed to run the service. Operational records can include request timing, status and errors. Logs are designed to avoid message text, recordings, raw invitation values and authentication tokens; hosting providers may retain their own technical access records.

Service providers and data use

Google/Firebase provides sign-in and authentication; Render hosts the backend and persistent storage; ElevenLabs processes text for speech and recordings for voice enrollment. These services receive data needed for those functions. Their processing and retention also depend on their policies and applicable service settings.

FamiliarVoice uses this information to authenticate access, manage voices and permissions, match senders, generate requested speech and maintain the service. We do not sell user data or use message content, contact assignments or voice recordings for advertising. The Android app does not include advertising, analytics, attribution or third-party crash-reporting SDKs. We do not promise that service providers have no operational logs or that all provider data-use settings are zero-retention.

Speech allowance records

When speech allowance controls are enabled, FamiliarVoice records a coded account identifier, a request identifier, request time, character count, request category, speech-model category and processing status to manage speech usage. These allowance records do not contain message text, contact names, phone numbers or voice recordings. The coded account identifier is pseudonymous: it can still be associated with an account using information held by the service. This does not change the message processing described above.

After the configured billing cycle ends and a short processing window passes, the service is designed to remove account and request identifiers from the live allowance database while preserving combined cycle totals. Cleanup may be delayed during downtime or storage failures and is retried. Account deletion also covers identifiers in registered historical allowance databases; deleting those identifiers does not refund speech already used. This describes the allowance system, not deletion from provider backups or every system used to deliver speech.

Retention and deletion

Account links, access records, assignments, voice ownership and consent records remain in backend storage to support the service and its controls. Expired invitations and revoked grants may retain status records; expiry or revocation is not the same as deletion of every record. Render automatically creates daily snapshots of the backend’s persistent disk; Render says snapshots are available for at least seven days. A snapshot may retain data that has since been removed from the live database, and it cannot be edited one account at a time. The app also has a restricted pre-migration database copy on that same disk; it is not a separate disaster-recovery system. We have not verified a maximum snapshot-retention period. Our recovery procedure requires keeping the service offline until applicable deletion requests have been reapplied and speech-usage totals reconciled; a restored copy must not silently reactivate deleted accounts or reset an allowance. This procedure has not yet been rehearsed against a live backup. We therefore do not promise a fixed deadline for erasure from every backup, and backup cleanup is reported separately from deletion of live records.

For notification speech and fixed previews, the backend attempts to delete the corresponding ElevenLabs generation-history item after streaming ends. This is best-effort and may fail if the process stops or the provider cannot complete the request. This is not Zero Retention Mode. ElevenLabs states that generation deletion removes the corresponding text and audio from its database, but related debugging/moderation records may remain and deleted database items may remain in backups for up to 30 days. This is not a guarantee of erasure from every provider system.

Deleting your enrolled voice in My voice initiates provider deletion and removal of its live voice records. A provider cleanup failure can leave deletion pending and require a retry; we do not report that as completed provider deletion. Unassigning, revoking access, deleting a voice and deleting account data are different actions.

Your choices and deletion requests

You can change playback mode, skip unknown senders, stop the current readout, unassign contacts, revoke shared access, delete your enrolled voice, sign out, or withdraw notification-processing consent in the app. Android settings let you revoke notification access and microphone permission. Stop reading affects the current readout; queued messages may still play. Signing out or uninstalling does not delete your server-side account or voice records.

To request deletion of your FamiliarVoice account and associated data, use Settings > Privacy and data > Delete account and data, or follow the account deletion instructions without installing the app. The owner personally handles each request. Requests require ownership verification; opening an email draft does not submit a request or immediately delete data. We will send an initial response within seven days after receiving your request. This initial response is not a guarantee that deletion will be completed within seven days. This deletes the FamiliarVoice account, not your Google account. We will tell you when deletion is complete or explain any outstanding provider cleanup or justified retention.

Security

Release traffic containing user data uses HTTPS. The backend verifies access and separates account/tester data. No storage or transmission method is completely secure, so we cannot guarantee absolute security.

Children

FamiliarVoice Notifications is not directed to children under 13 and is not designed as a children’s service.

Organization website

The Zenith Capital Group website is an informational website hosted through GitHub Pages. It has no organization-operated accounts, advertising or analytics. Its hosting provider may process technical information associated with website requests.

Changes and contact

We update this policy as FamiliarVoice changes and reflect material data-handling changes in app disclosures and Google Play Data Safety information where required. Send privacy questions or deletion requests to zach@zenithcapitalgroup.dev.

Provider privacy information

• Firebase privacy and security
• ElevenLabs privacy policy and retention documentation
• Render privacy policy

See Render’s persistent-disk snapshot information for its backup availability details.