Privacy Policy

Who we are

Voca ("Voca", "we", "us") is a free augmentative and alternative communication (AAC) app available at vocaaac.com, built and operated by an independent developer. This policy explains what information Voca handles when you use the website, the app, and a Voca account, and the choices you have. For any privacy question or request, use the contact form on the homepage and it will reach the developer directly.

What Voca collects, and why

• Account details. When a parent, guardian, or professional creates an account we collect an email address and a password. Passwords are hashed by our authentication provider; we never see them. We also record the date you confirmed being an adult, and whether your email has been verified.
• Cloud backup content. If you use backup, the communication boards on your device are copied to your account: board layouts, button labels, categories, app settings (including a scrambled, unreadable version of your child-lock PIN), and any photos or images you added to buttons. This exists for one purpose: so a lost, broken, or wiped tablet never means starting over. You choose what goes on the boards.
• Messages you send us. The feedback form sends us your message and, only if you include it, your email address so we can reply.
• Donation details. Donations are processed entirely by Stripe. We receive the amount and a confirmation; we never see or store card numbers.
• Basic technical logs. Like nearly every website, our hosting providers record standard server logs (such as IP address and browser type) for security and reliability. We do not use them to profile anyone.

What Voca deliberately does not do

• No recording of communication. Sentences your child builds and speaks are processed on the device and are never transmitted, logged, or stored by us. Speech is generated by the device's own voice engine.
• No analytics or tracking. Voca contains no analytics SDKs, no advertising, no tracking pixels, and no third-party cookies. We do not know how often you open the app, and that is by design.
• Personal word prediction stays local. Voca learns your child's word patterns to improve suggestions. That learning lives only on the device, is excluded from cloud backup, and can be reset in Settings at any time.
• No selling or sharing of personal information. We do not sell, rent, trade, or share personal information with anyone for marketing, advertising, or any similar purpose. We have never done so and will not.

Children's privacy

Voca is used by children, so we hold ourselves to the standard of the U.S. Children's Online Privacy Protection Act (COPPA), including the strengthened rule in effect since 2025, and to similar laws elsewhere.

• Accounts can only be created by a parent, guardian, or professional aged 18 or over, who confirms this during sign-up and verifies their email address. Children never create accounts, and we do not knowingly collect personal information directly from children.
• Any information about a child that ends up in Voca (for example a photo of a family member placed on a button, or a board named after the child) is put there by the account-holding adult, is visible only to that account, and is used solely to provide the backup service.
• The account holder can review everything stored for the account (it is exactly what appears on the boards), replace it, or have it deleted at any time, as described below.
• We retain children's information only as long as reasonably necessary to provide the service: on the device until you remove it, and in the cloud backup until the account is deleted or the backup is replaced.
• We do not disclose children's personal information to third parties, other than the service providers listed below who store and transmit data on our behalf and are bound to safeguard it.

Where your data lives

Voca is offline-first. Boards and settings live in a database on your own device and stay there until you delete the app or clear its data. The copies below exist only to make the service work:

These providers process data on our behalf to run Voca and are not permitted to use it for their own purposes. If you use Voca outside the United States, your backup is transferred to and stored on servers in the United States.

How long we keep things

• On your device: until you delete the app, clear the browser's site data, or reset it yourself.
• Cloud backup: until you delete the account or overwrite the backup. Replaced backups stop being referenced and are cleaned up.
• Account details: for as long as the account exists.
• Feedback messages: for as long as needed to act on them.
• Donation records: kept by Stripe under its own retention rules; we keep only the confirmation.

Your rights and choices

Whoever you are and wherever you live, you can ask us to show you the personal information we hold about your account, correct it, export it, or delete it. If you are in the European Economic Area or the United Kingdom, these are your rights under the GDPR, along with the right to restrict or object to processing and to complain to your supervisory authority. If you are a California resident, the CCPA gives you similar rights to know and delete; note that we do not sell or share personal information as those terms are defined there, so there is nothing to opt out of.

• See or export your data: your boards are your data, and they are visible in the app itself. Ask us for a copy of everything stored for your account and we will provide it.
• Delete your data: in the app, open Settings, then Account, then Delete account. After confirming with your password, the account and its entire cloud backup are erased immediately. You can also send a deletion request through the contact form from the account's email address. Data on your own device is deleted by removing the app or clearing its site data.
• Stop backing up: simply sign out on the device. Voca keeps working offline with local data only.

Security

Everything travels over encrypted connections (HTTPS). Cloud backups are protected by security rules that allow access only to the signed-in, email-verified owner of the account. Passwords are hashed by Firebase Authentication and the child-lock PIN is stored only as a salted hash. Above all, we practice data minimization: the most effective way to protect information is to never collect it, and Voca collects as little as it possibly can.

Changes to this policy

If Voca ever changes in a way that affects your privacy, we will update this page, change the effective date at the top, and, for significant changes, tell account holders by email before the change takes effect. We will never weaken children's protections without clear notice and, where the law requires it, renewed consent.

Contact

For any privacy question, request, or concern, use the contact form on the homepage. Messages go straight to the developer's inbox and every one gets read.