Privacy Policy

    Last updated: July 23, 2026

    This Privacy Policy explains what personal data Voyaudio collects, why, who we share it with, and the rights you have. Voyaudio is an audio travel-guide service operated by Unlocd, and this policy covers the Voyaudio app and website. We build to the stricter standard of the EU GDPR and apply the protections of Brazil's LGPD.

    1. Who controls your data

    Voyaudio is operated by Unlocd, which is the controller responsible for the personal data described here. For any privacy question, or to exercise your rights, contact us at privacy@voyaudio.com.

    2. What we collect

    We collect only what we need to run the service: • Account data — handled through our authentication provider, Clerk: your email address, the name and profile picture you sign in with, an account id, and basic sign-in activity such as when you last signed in. • Purchase data — when you buy a trip pass, payment is processed by Stripe. We do not receive or store your card number. On our side we keep only a record of what you bought and for how long (the pass type, duration and a Stripe reference), so we can give you access. • Usage data — what you listen to and your progress, which audios you unlocked, downloaded, favourited or rated, any trips you build, and destinations you request. This lets us deliver the service and remember where you left off. • Technical data — when you use the app, our servers briefly log your IP address, the request and your account id for security, abuse-prevention and debugging. This stays in short-lived server logs; it is not saved to a database or used to profile you. What we do NOT collect: we do not access your device's GPS or real-world location, and we do not ask for your phone number, postal address or date of birth.

    3. Why we use it, and our legal bases

    We use your data to: • provide the service and your account, and process your purchases — legal basis: performance of a contract; • keep the service secure and prevent abuse, and understand and improve how it is used — legal basis: our legitimate interests; • send the transactional email you ask for (see "Who we share it with") — contract / legitimate interest; • meet legal, tax and accounting obligations — legal basis: legal obligation; • where the law requires it, only with your consent (for example, non-essential analytics). We do not sell your personal data, and we do not use it to make automated decisions that produce legal effects about you. We use AI to generate guide content about destinations — not to profile you or to train models on your personal data.

    4. Who we share it with

    We share data only with the providers that make Voyaudio work (our "subprocessors"), each only with what it needs: • Clerk — sign-in and account management. • Stripe — payment processing; Stripe holds your payment details under its own policy. • Cloudflare (R2) — stores and delivers the audio and images (no personal data in the files). • Railway — hosts our servers and database. • Vercel — hosts the app and website. • Resend — sends the transactional email you request. • Himetrica and Simple Analytics — anonymous, aggregate usage analytics on our website (not inside the app). Simple Analytics is cookieless and honours Do-Not-Track. • Google Fonts and our icon CDN — loading these assets exposes your IP address to those providers, as with any website. We may also disclose data if required by law, or to protect our rights and our users. We never sell your data.

    5. International data transfers

    Voyaudio is operated from Brazil, but several of our providers (such as Clerk, Stripe, Railway and Vercel) process data on servers outside Brazil, including in the United States. When your data is transferred internationally we rely on the safeguards those providers offer (such as standard contractual clauses) and on the lawful-transfer bases available under the LGPD and GDPR.

    6. How long we keep it

    We keep your account and usage data for as long as your account exists. If your account is deleted, we delete your profile and the data linked to it — your progress, favourites, downloads, requests, access records and the like. Payment records held by Stripe are kept by Stripe under its own retention and legal obligations. Server logs containing IP addresses are short-lived and rotated by our hosting provider. If you joined a waitlist, we keep that email until you ask us to remove it.

    7. Your rights

    Depending on where you live, you have rights over your personal data. Under the GDPR and Brazil's LGPD these include: confirmation that we process your data and access to it; correction of inaccurate data; deletion or anonymisation; portability; restriction of, or objection to, certain processing; information about who we share it with; and, where processing is based on consent, the right to withdraw that consent at any time. You will not be treated differently for exercising these rights. You can delete your account and all associated data yourself, at any time, from the app (Profile → Delete account). To exercise any other right, email privacy@voyaudio.com. If you believe we have mishandled your data, you may complain to your local data-protection authority (in Brazil, the ANPD).

    8. Cookies and local storage

    We use only the cookies and device storage needed to run the service: your sign-in session (set by Clerk and stored on your device) and local storage the app uses to keep you signed in, remember your place, and hold your offline downloads. We do not use advertising cookies. On our website, one privacy-friendly analytics tool (Simple Analytics) is cookieless and honours Do-Not-Track, so it always runs; our other analytics (Himetrica) loads only if you accept optional analytics in the cookie banner, and you can decline. The app itself loads no analytics or advertising trackers.

    9. How we protect your data

    We protect your data with encryption in transit (HTTPS/TLS), access controls, and signed, time-limited links for audio and images. We never store your card details — those stay with Stripe. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the authorities where a breach requires it.

    10. Children

    Voyaudio is not directed to children. You must be able to enter into a binding contract to buy a pass; if you are a minor, use Voyaudio only with the involvement of a parent or guardian. We do not knowingly collect data from children under 13, and we will delete it if we learn that we have.

    11. Changes to this policy

    We may update this policy from time to time. When we do, we will change the "Last updated" date above, and material changes take effect when posted.

    12. Contact

    For privacy questions or to exercise your rights, contact us at privacy@voyaudio.com. For help with your account or a purchase, hello@voyaudio.com.