Privacy Policy
Effective Date: 11 February 2026
Last Updated: 17 October 2026
This Privacy Policy describes how Noffy ("we," "us," or "our") collects, uses, and protects information when you use noffy: AI Voice Keyboard, including the noffy keyboard and the noffy app (together, the "App"). By using noffy, you agree to the practices described in this policy.
Previous versions of this policy: 13 October 2026 · 10 March 2026 · 11 February 2026.
1. Overview
noffy is an AI voice keyboard for iPhone. Your privacy is important to us, and we have designed noffy with a privacy-first approach:
- Your content stays on your device. Your dictation history, My Words, Phrases, and writing styles are stored on your iPhone. We do not store your audio or the text you dictate on our servers.
- We do not train AI models on your content. When you use voice input or AI features, the content needed is sent to our service providers for processing and is not retained by us.
- We do not collect what you type. Typing on the noffy keyboard stays on your device.
- We do not sell your personal information, and we do not show ads.
- We do not track you. We do not use analytics SDKs, advertising trackers, or cross-app tracking.
2. Information We Collect
2.1 Content You Create (Stored on Your Device)
When you use noffy, the following is stored on your device:
- Dictation history (the text of your dictations, and refined versions)
- My Words, Phrases, and writing styles
- App settings and preferences
This content is stored only on your device. It is not included in iCloud or device backups, and we cannot access it.
2.2 Content Processed to Provide Features
When you use voice input or AI features, and only after you allow AI dictation in the App, the content needed for that request is sent to our service providers for processing. The App names these providers before you allow AI dictation:
- Voice input (sent to Soniox): your voice, together with hints that improve accuracy — your My Words, Phrases, writing styles, and the text just before the cursor
- AI features (sent through OpenRouter to OpenAI's or Anthropic's models): the text you choose to refine, your writing style, or the description you give for a writing style or an emoji
This content is processed to return the result to your device. It is not stored on our servers and is not used to train AI models. You can turn off AI dictation at any time in Settings; typing continues to work.
2.3 Account and Usage Data (Stored on Our Servers)
To manage your account and provide our services, we keep limited data on our servers:
- Account Identifier: A random identifier for your noffy account. You don't need to sign in to use noffy: the App creates an account for your device automatically, without any personal information. If you choose to sign in with Apple, for example to use your plan on your other devices, your account is linked to your Sign in with Apple account. We do not ask for your name or email address.
- Device Key: The App keeps a random key in your device's Keychain to reconnect to your account. We store only a one-way hash of it.
- Plan and Subscription Status: Your plan (Free, Pro, or Max) and whether your subscription is active.
- Usage: How much of your weekly allowance you have used. This does not include the content of your dictations.
2.4 Information We Do NOT Collect
- Your name or email address
- What you type on the keyboard
- Location data
- Contacts or address book
- Browsing or search history
- Device diagnostics or crash reports on our servers (Apple may share anonymized crash reports with us through App Store Connect if you have enabled "Share iPhone Analytics" in your device settings — this is managed by Apple, not by us)
2.5 Sensitive Information
Please be mindful when dictating or refining content that contains sensitive information such as passwords, financial account details, or government identification numbers, as voice input and AI features involve sending content to our service providers for processing.
3. Content Ownership
You retain full ownership of all content you create in noffy, including your dictations and any AI-generated content derived from them. By using voice input and AI features, you grant us a limited, non-exclusive license to process your content solely to provide the requested feature. We do not claim any ownership rights over your content.
4. AI Processing and Model Training
4.1 How Voice Input and AI Features Work
When you dictate or use an AI feature, the content needed is sent to our service providers, and the result is returned to your device and stored there. We do not use your content to train, fine-tune, or improve any AI models, and we do not enable any settings that would allow providers to do so.
4.2 Service Providers
We use the following service providers to power voice input and AI features. Each has its own privacy policy:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Soniox | Speech recognition | soniox.com/policies/privacy-policy |
| OpenRouter | Access to AI models for AI features | openrouter.ai/privacy |
| OpenAI | AI models for Refine, writing styles and emoji suggestions, reached through OpenRouter (which may run OpenAI's models on Microsoft Azure) | openai.com/policies/privacy-policy |
| Anthropic | AI models (Claude) for Refine, writing styles and emoji suggestions, reached through OpenRouter (which runs Anthropic's models on Google Cloud or Amazon Web Services) | anthropic.com/legal/privacy |
We select providers that do not retain your content or use it for model training. Each of them protects your content with the same or equal protection as this Privacy Policy: they process it only to return the result to you, never keep it, and never use it to train AI models.
5. How We Use Your Information
We use the information we collect to:
- Provide the Service: Turn your voice into text and process the AI features you use.
- Manage Your Plan: Track your weekly allowance and subscription status.
- Process Transactions: Verify purchases made through Apple's App Store.
- Prevent Abuse: Protect the service from automated or abusive use.
- Improve the Service: We may use aggregated usage statistics that cannot be linked to you or your content.
6. Data Storage and Security
6.1 Where Your Data Is Stored
| Data Type | Storage Location | Who Controls It |
|---|---|---|
| Dictation history, My Words, Phrases, styles | Your device | You |
| App settings | Your device | You |
| Account, plan, and weekly usage | Our servers | Us |
6.2 Security Measures
- Encryption in Transit: All data sent between your device, our servers, and our service providers is encrypted using TLS.
- No Passwords Stored: We do not have a username/password system. The App connects to your account with its device key; Sign in with Apple is optional.
6.3 Security Disclaimer
While we implement commercially reasonable security measures to protect your information, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.
7. Device Permissions
noffy may request the following permissions:
| Permission | Purpose |
|---|---|
| Microphone | Voice input while you dictate |
| Keyboard Full Access | Letting the noffy keyboard work with the noffy app for voice input and AI features |
| Live Activities | Showing dictation status on the Lock Screen and in the Dynamic Island |
Full Access does not allow us to collect what you type. You can manage these permissions at any time in your device's Settings app.
8. Subscriptions and Payments
Subscriptions are processed through Apple's App Store. We use RevenueCat (revenuecat.com/privacy) to manage subscription status. We never receive or store your payment details. Apple handles all payment processing.
We receive:
- Confirmation of your subscription status (active, expired, etc.)
- Anonymous transaction identifiers
9. Your Privacy Rights
9.1 All Users
Regardless of where you live, you can:
- Delete your dictation history at any time, or choose how long it is kept in Settings.
- Turn off AI dictation in Settings to stop sending content for processing.
- Delete your account in Settings > Account > Delete Account. This removes your account and server-side usage data.
- Manage permissions through your device's Settings app.
9.2 California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose.
- Delete your personal information.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of personal information. Note: we do not sell or share your personal information.
- Non-discrimination for exercising your privacy rights.
9.3 European Economic Area, UK, and Switzerland (GDPR)
If you are located in the EEA, UK, or Switzerland, you have the right to:
- Access your personal data.
- Rectify inaccurate personal data.
- Erase your personal data ("right to be forgotten").
- Restrict or object to processing of your personal data.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw your consent to cloud processing at any time.
- Lodge a complaint with your local data protection authority.
Our legal bases for processing are your consent (processing your content for voice input and AI features), the performance of our contract with you (providing the service and your plan), and our legitimate interest in preventing abuse and improving the service.
9.4 How to Exercise Your Rights
To exercise any of these rights, please contact us at hello@noffy.ai. We will respond to verified requests within 30 days (or without undue delay for GDPR requests). We may need to verify your identity before processing your request.
10. Data Retention and Deletion
| Data Type | Retention |
|---|---|
| Dictation history | On your device, for the period you choose in Settings, or until you delete it. |
| Unfinished recordings | On your device for up to 24 hours so you can retry them, then deleted. |
| My Words, Phrases, styles | On your device until you delete them. |
| Account and usage data | While your account is active. Deleted when you delete your account. |
| Purchase records | As required for financial record-keeping. |
If you cancel your subscription: Your content remains on your device, and you return to the Free plan.
If you delete your account: We delete your account and server-side usage data. Content on your device is not affected (you manage that yourself). Deleting your account does not cancel an App Store subscription.
11. Children's Privacy
noffy is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If we learn that we have inadvertently collected data from a child under the applicable age, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@noffy.ai.
12. International Data Transfers
Our servers and service providers may be located in countries other than your own, including the United States. We ensure that appropriate safeguards are in place for international transfers in compliance with applicable data protection laws.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy at noffy.ai/privacy and, where appropriate, through an in-app notification. If a change involves sending your content to a new provider or for a new purpose, we will ask for your permission in the App first. The "Last Updated" date at the top of this policy indicates when it was last revised.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Email: hello@noffy.ai
Website: noffy.ai
Terms of Service: noffy.ai/terms