Your private space
deserves clear walls.

The short version

Sanctum is local-first. Recording, playback, search, editing, organization, sharing, and export work with files on your device and do not require an account. Content leaves your device only when you choose server-side analysis or opt into Private Backup.

This is a working draft, not yet the effective privacy policy. It records the current product boundary and the items that still need verification before release.

Information stored on your device

Sanctum stores enclaves, note folders, audio recordings, structured transcript JSON, markdown notes, tags, preferences, trash manifests, and analysis-cost metadata on your device. The files are visible through the Files app and remain under your control.

SwiftData keeps a rebuildable index of metadata and file pointers. The audio, transcript text, and markdown files on disk remain the source of truth.

Accounts and purchases

Supabase stores the email address, user id, authentication records, and identity-provider linkage needed for an account. Apple or Google processes the information involved when you choose its sign-in method. RevenueCat receives the user id as its app user id and stores purchase, entitlement, subscription, and device/app metadata needed to operate purchases. These services do not receive note content for those purposes.

An account gates server-side analysis and other paid or cloud services. It does not gate the local recorder or your ability to read, edit, delete, share, or export your files.

Private Backup

Private Backup is optional. When enabled, files are encrypted on your device before transfer. AWS holds account and backup-control metadata, while Backblaze B2 holds randomly named encrypted segments and manifests. Neither receives filenames, titles, note relationships, transcripts, note text, or audio in a form it can read.

Current encrypted backup data remains for the life of the backup or account. Replaced objects have a 30-day retirement floor, abandoned uploads expire after 24 hours, and explicit backup or account deletion schedules physical cleanup.

Transcription and synthesis

Before a cloud request, Sanctum shows the audio or text that will leave the device and the processor chain, and requires explicit consent. You can withdraw stored consent in Settings; future cloud requests then ask again. On-device transcription has no outside processor.

Cloud transcription uses AssemblyAI. Sanctum's production account is opted out of AssemblyAI's Model Improvement Program, so AssemblyAI says submitted files are not used to train its models. This is an account-level provider setting, not something the app can technically enforce. Sanctum deletes the temporary upload from its own AWS S3 bucket when the job settles, with a one-day lifecycle backstop, and its job record expires after 24 hours. AssemblyAI begins deleting uploaded audio after 24 hours, subject to processing lag. Sanctum keeps the provider transcript job resumable for 24 hours, then an hourly durable cleanup worker repeatedly requests deletion until AssemblyAI confirms it.

Release synthesis offers two routes. RedPill's confidential-compute endpoint is the default, with zero-data-retention requested; it may route to Phala, Chutes, NEAR AI, Tinfoil, or another provider identified by a request receipt. Sanctum does not yet verify those attestation receipts, so this draft does not claim that hardware enforcement has been independently checked.

AssemblyAI's LLM Gateway is also available. For Sanctum's configured Claude model, AssemblyAI documents that it normally uses Amazon Bedrock, which does not store or log prompts or completions, and may fall back directly to Anthropic with zero-day retention. AssemblyAI says it opts all Gateway model providers out of training. AssemblyAI's own input/output retention follows the TTL configured on Sanctum's account, which has not yet been live-verified; certain logging and billing metadata remains.

Diagnostics

Sentry receives operational crash and performance telemetry from the app and server. This can include error types, stack traces, app and device versions, route templates, timing, and other operational context. Sanctum configures the SDK not to send recording, transcript, note, credential, account-subject, screenshot, replay, or request-body content. AWS CloudWatch receives server operational logs; infrastructure now sets a 30-day log-retention policy.

Sentry retention and IP-handling still depend on the settings actually applied to Sanctum's Sentry project. Verifying those account settings remains a release requirement before this draft becomes effective.

Website data

This site is hosted by Vercel. Vercel may receive ordinary request data such as IP address, browser type, requested page, timestamp, and security metadata. The site has no working waitlist submission, analytics script, advertising tracker, contact form, or cookie-based preference system.

Retention and deletion

Local files remain until you delete them, clear eligible audio, remove the app under the rules of your device and backups, or permanently empty Sanctum's trash. Ordinary in-app deletion first moves recoverable content into a trash folder.

Account deletion removes optional backup state and feedback, every unused analysis-minute balance, the RevenueCat customer profile, stored Apple revocation material, and the Supabase user. It does not cancel an App Store subscription and does not delete the local notes you own. Existing content-free analysis job records expire on their 24-hour schedule.

Your choices, changes, and contact

You choose whether to use server analysis, whether to enable Private Backup, whether to grant or withdraw cloud-processing consent, and whether to move, copy, or delete local files. Sanctum is planned for United States availability at launch. Rights under applicable state law may include access, correction, deletion, or portability for personal information Sanctum holds.

Material changes will receive a new date and, when appropriate, an in-app notice. Questions or privacy concerns can be sent to support@speakwithsanctum.app.