Privacy Policy

Private beta document · last updated October 22, 2026. Plain language on purpose — if anything here is unclear, ask us before you rely on it.

At a glance

• Vearo does not upload your audio. Recording and transcription happen on your device. Temporary audio chunks are removed when processing finishes or stops; imported originals outside Vearo remain under your control.
• Content storage and AI analysis are separate opt-ins. Raw sync covers eligible transcripts, imported messages, and baseline/assessment data. AI-provider analysis is a separate account-level choice. Account data and automatic diagnostics are described below.
• We don't sell your data, show you ads, or train foundation models on your content.
• Insights cite their evidence. Every conclusion Vearo keeps is stored with pointers to the exact transcript moments it came from; those pointers are not yet shown to you, and there is no control yet to reject or correct an individual insight. You can revoke AI analysis or request deletion as described below.

What Vearo is

Vearo helps you understand who you are from how you actually live: it can record your day's conversations on your phone, turn them into private transcripts, and — with your consent — analyze those transcripts into an evidence-grounded portrait. This policy explains what data exists at each step, where it lives, and what control you have. Vearo is in private beta; this document will evolve, and material changes will be announced before they take effect.

What we collect, and where it lives

Capture content on your device (until you enable raw sync):

• Microphone audio is processed in short chunks. Vearo attempts and verifies deletion of temporary chunks on every processing outcome, with recovery cleanup after interruptions. A processing backlog can delay deletion; there is no one-minute guarantee.
• Transcripts, journal entries, speaker attributions, and voice-enrollment data are stored in the app's private storage. Automated speaker attribution can be wrong. Lines that fail speaker-identity or quality checks are not used as evidence about you; when the rest of a session is eligible for analysis, they may still be sent to AI providers, labeled as context rather than as evidence about you.
• A display name you choose. The current alpha requires a Vearo account; recording content stays local unless raw sync is enabled.

In your Vearo account:

• Account basics: email address, a salted password hash if you use a password, linked Google identity if you use Google sign-in, the display name saved on your account, device identifiers, web sign-in session records including the IP address and browser user agent, acceptance receipts for the Terms, recording responsibility, and age confirmation (document version, time, device, app build, and locale), and sync bookkeeping.
• Eligible transcripts, journal entries, speaker/ownership metadata, and per-line acoustic measurements, only after you enable account storage (raw sync).
• Imported message text, timestamps, conversation titles, and ownership metadata, after you enable raw sync and confirm that the connected account or SMS backup is yours. Message bodies and titles can contain real names even though stored provider, chat, message, and sender identifiers are pseudonymized.
• Synced questionnaire responses and imported baseline/assessment summaries, including self-reported Big Five, MBTI, or HEXACO results. These are not verified diagnoses or observed conversation evidence.
• Analysis results: insights, the portrait, and audit records of each analysis run. Evidence uses source pointers. Word-matching redaction targets runs of five or more source words in stored analysis prose; shorter phrases and identifying derived descriptions can remain. This is not a guarantee that records contain no source wording or personal data.

Consent, scoped and revocable

Account storage (raw_sync) covers eligible transcripts, message imports, questionnaire data, baseline results, and related metadata; it is not a transcript-only permission. AI-provider analysis (analysis_llm) is a separate account-level choice, not a separate prompt for each source or provider call. Non-LLM statistical analysis (analysis_local) and future matching have separate choices; a recorded consent does not make an unavailable feature live. Gmail has additional email-specific permissions described below. Choices are recorded with a timestamp and policy version. You can revoke them in Data permissions or the relevant Gmail controls. Analysis re-checks the current grant before each model call. Revocation applies at subsequent authorization checks and does not erase stored data. A request already past its last check may still be sent and complete after confirmed withdrawal; requests cannot be recalled.

How AI analysis works

With account AI-provider consent, eligible transcript excerpts and imported message text, including other participants' words as interaction context, are sent to large-language-model providers — currently Anthropic (Claude), OpenAI (GPT), and Google (Gemini) — under API terms that exclude your data from model training. Inputs can also include speaker labels, ownership and transcription-confidence metadata, per-line prosody measurements (signal level, pitch, pitch variation, voiced and pause ratios relative to session baselines), baseline/assessment results (including Big Five, MBTI, and HEXACO scores, instrument/version and completion metadata), and prior delivered insights as feedback. Raw audio and voiceprints are not sent to these providers. Other participants' text is transmitted as context, not used to build independent profiles of them. Several models analyze independently and cross-check one another; a claim reaches you only when it cites real moments from your transcript and survives that scrutiny. Findings without enough independent agreement are shown as open questions, not conclusions.

Diagnostics and telemetry

Vearo uses Sentry (Functional Software, Inc.) for automatic diagnostics; this is separate from content-storage and AI consent. These include crash/error reports, stack traces, browser/device metadata, and request information. Android currently enables default personal-data collection and performance tracing. Server reporting is temporarily suspended during security remediation. When enabled, server telemetry includes request traces, performance profiles, breadcrumbs, and structured logs at full sampling, except routine health-check traces and logs. The marketing site disables session replay, performance tracing, release-health session pings, and default personal-data collection. Error reports can still include page addresses and browser/device details, and Sentry receives the network address used to send a report. Content and credential filters reduce exposure but are not a guarantee that every diagnostic is content-free or anonymous. Audio is not uploaded for diagnostics.

Historical notice (October 17, 2026): during founder-only testing from July 23 through October 14, 2026, server diagnostics may have included synced transcript text, including other participants' words. No other account synced recordings during that period. The historical diagnostics are retained at the founder's request under Sentry's configured retention; deletion may be requested through the private-beta contact in your invitation.

What we never do

• Sell or rent your data, or share it with advertisers or data brokers.
• Train our own or anyone else's foundation models on your content.
• Analyze anything without your explicit, current consent.
• Make you discoverable to anyone unless you choose to be.

Message imports and other participants

Beeper's desktop adapter reads selected or non-excluded chats on your own computer and sends text archives to Vearo. Its messaging token stays on that computer. The Android SMS adapter reads XML backups from a folder you grant it; it does not request access to Android's SMS store. It currently supports plain SMS only, not MMS, RCS, attachments, or nested backup folders. Available history may be incomplete. You can stop the local importer; this prevents future uploads but does not erase content already imported. Raw sync and cloud analysis remain separate account-level choices.

Recordings and message threads include other people. Vearo's analysis is about you: other participants' words remain interaction context, not evidence of your traits or an independent personality profile of them. Pseudonymous identifiers do not make the message content anonymous. You are responsible for recording lawfully where you live (see the Terms of Use); many places require the consent of everyone recorded.

Optional Gmail workspace

Google sign-in verifies identity only. Connecting Gmail is a separate read-only authorization for the Google account you linked. Gmail connection is a server-wide setting, not something Vearo switches on for individual accounts; during private alpha, Google restricts authorization to its named test-user list. Vearo stores encrypted access and refresh credentials; it cannot send, modify, label, or delete messages in Gmail. Connecting alone does not read mail or enable analysis. The linked saved-email reader and email Q&A exist for any account that connects Gmail and grants the permissions below; they are not automatic mailbox analysis. Storage requires both account storage (raw_sync) and Gmail storage (gmail_import). Email analysis additionally requires both account AI-provider consent (analysis_llm) and Gmail analysis (gmail_analysis).

Explicit email refreshes read at most 50 messages matching your Gmail search. Email text and headers, and your email questions and answers, are encrypted in your Vearo account. Vearo makes no separate attachment requests and does not store or analyze attachments. Gmail responses may include inline attachment data, which is discarded. When the required analysis permissions are on, selected email excerpts and your question go to Anthropic, OpenAI, and Google for email summaries and questions, with cited evidence and model cross-review. These choices apply at account level; no new consent prompt is required for each question. This Gmail feature does not feed your personality portrait, traits, training, or compatibility matching.

Revocation takes effect at subsequent authorization checks. A request already past its last check may still be sent and complete after confirmed withdrawal; requests cannot be recalled. Disconnecting erases local credentials and invalidates pending work, but does not erase saved email or remotely revoke Google's grant. The Gmail workspace's separately confirmed Delete saved Gmail data action erases its stored email, questions, and answers, including prior connections' data. Account erasure on request removes this lane too; there is no self-service account-erasure control. Content-free submission timestamps are kept separately to enforce the account usage limit, including after Gmail-data deletion; account erasure removes them. You can separately revoke provider access in your Google account's third-party connections settings; Vearo does not change mail in your Google account when you erase its local copies.

Vearo's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Humans are not permitted to read Gmail data unless you expressly authorize viewing specific messages, or access is necessary for security or legal compliance. User authorization does not imply Google has approved Vearo or broader profiling features.

Automatic Gmail insights: availability and separate opt-in

Automatic communication insights require Vearo's global automatic-Gmail flag to be enabled and your separate personal opt-in to Gmail automatic analysis (gmail_automatic) with current account AI-provider consent (analysis_llm). The flag is global, not a per-account rollout switch; Vearo does not turn it on or off for individual accounts. The per-account prerequisites are Google's test-user list, an active Gmail connection, current account AI-provider consent, and your own opt-in. During private alpha, Gmail OAuth is in Google's External/Testing mode: authorization is restricted to Google's named test-user list. Being on that list does not grant Vearo consent to read or analyze mail. Linking Gmail or existing storage/Q&A grants do not activate it. No separate consent prompt is required for each message. Publishing this disclosure does not itself enable the feature or grant your account permission.

Turning off the global flag stops new automatic dispatch at redeploy cutover, after old workers are drained, not immediately when the setting is edited; already-dispatched requests cannot be recalled.

While enabled and opted in, this lane sends bounded excerpts of sent messages and relevant preceding replies to Anthropic, OpenAI, and Google. Your authored sent text is the evidence; other participants' words provide interaction context, not independent profiles of them. Alpha limits are thirty days of initial history, five sent messages per batch, and two analysis batches per rolling day, followed by incremental polling; coverage is not real-time or complete. Original bodies are transient in Vearo. We keep encrypted tentative insights, source pointers/hashes, checkpoints, and audit metadata, which remain personal data. Transient processing does not mean zero provider retention. This lane does not add embeddings, personality traits, matching, other people's profiles, or model training.

You can pause or revoke automatic analysis in Gmail settings; pause and resume controls appear only while the global flag is on, and revoking your permission is available whenever a grant exists. Saving a pause or revocation applies without a redeploy: pending work becomes invalid, and subsequent authorization checks reject it. These checks are not atomic with dispatch: a request already past its last check may still be sent and complete after withdrawal, including after the change is confirmed. Requests cannot be recalled. Source links refetch specific original messages only under fresh account and permission checks. Deleting saved Gmail data also erases retained automatic insights, including prior connections' outcomes, and pauses automatic work. Disconnecting removes local credentials, not Google's remote grant or retained insights. A separate account usage counter remains after Gmail-data deletion until account erasure, so deletion does not reset the two-batch limit.

Retention and deletion

• Imported messages: stopping the importer prevents future uploads but does not erase uploaded messages. During private alpha, request import or account deletion through the contact address in your invitation. Do not assume deleting a session prevents a later re-import; stop the importer as well.
• Audio: temporary chunks are removed on terminal processing outcomes, subject to backlog and recovery cleanup. Vearo does not delete audio originals you imported from other apps.
• Transcripts, baseline results, insights, and analysis audits are stored in your account. Session deletion removes source entries; it does not currently guarantee withdrawal of derived insights or their use as later analysis context. Revoke AI consent to block work at subsequent authorization checks and request deletion through your invitation contact. A request already past its last check may still be sent and complete after confirmed withdrawal; requests cannot be recalled.
• Account erasure is handled on request, not by a self-service button. Consent-event records remain with a hashed subject reference after account erasure. That reference can be linked back if the original account identifiers are known; it is not guaranteed anonymous.
• Vearo account erasure cannot recall data already sent to AI providers or remove copies in telemetry systems; those services have separate retention and deletion processes.

Your rights

During private alpha, request access, export, correction, or account deletion through the contact address in your invitation. Self-service account export and deletion are not available yet; the saved-Gmail-data deletion control is separate. You can withdraw consent in the existing permission controls without requesting account erasure. If you are in a jurisdiction with specific statutory rights (GDPR, UK GDPR, CCPA/CPRA and similar), those rights apply and we will honor them.

Security

Data in transit is encrypted (TLS). Sync uses per-device tokens stored only as digests. Gmail credentials and saved Gmail content are encrypted at rest. Source pointers, derived results, and pseudonymous identifiers remain personal data; removing a source does not itself prove that all derived descriptions or external copies are gone.

Age

Vearo is for adults. You must be at least 18 to use it.

Contact

During the private beta, reach us at the contact address in your invitation. A public contact channel will be listed here before general availability.