Privacy Policy
Last updated: 2026-07-25
This policy covers the Iconic Voices website (iconicvoices.io), the web player at iconicvoices.io/app, and the Iconic Voices apps for iOS and Android. It describes what we collect today, in the present tense — nothing here is a plan or a placeholder.
1. Who we are (data controller)
Data controller: Alexander Lastochkin, an individual entrepreneur
(sole trader) based in Dnipro, Ukraine, publishing under the name Iconic Voices. He is
the controller for all processing described here.
Privacy contact: privacy@iconicvoices.io.
The full postal address is supplied on request to that address.
2. Data we collect
- Account data — your email address, a user ID, and a password hash. Authentication is handled by Supabase Auth, hosted in the EU (Ireland) region. We never see or store your plaintext password.
- Listening progress — the book, position, chapter, and completion flag for titles you play, so playback resumes across your devices.
- Bookmarks — the positions you save, plus an optional short note (up to 140 characters).
- Purchase and subscription records — which books and plans your account has access to, and the transaction records our payment processors report to us. Your card or PayPal details go to the payment processor directly; we never receive them. If you subscribe inside the iOS app, Apple is the seller: we receive from Apple a subscription record (product, status, renewal and expiry dates, and an opaque transaction identifier) linked to your Iconic Voices user ID, and we send Apple that user ID as the purchase's account token so the subscription can be matched to your account. We never receive your Apple Account details or your payment method.
- Waitlist and notify-me emails — the email address you submit in a notify-me form, together with which page you submitted it from.
- Feedback and support correspondence — what you send us via the feedback form or by email.
- Error reports — if a page breaks, our error monitor (Sentry) receives a technical report. Email addresses, IP addresses, tokens, and passwords are scrubbed in your browser before the report is sent.
- Aggregate analytics — cookieless, anonymous page-view counts via Plausible. Optional analytics and marketing tools run only with consent — see the Cookie Policy.
3. The iOS and Android apps
The apps collect your email address, user ID, listening progress and bookmarks — and, if you subscribe in the iOS app, the purchase record described in §2. In particular:
- Local listening statistics stay on your device. Figures the apps show you (such as minutes listened) are computed and stored on the device and are never transmitted to us.
- The apps contain no advertising, no advertising identifiers, no tracking, and no third-party analytics or crash-reporting SDKs.
- The one third party the iOS app talks to is Apple, and only to sell and renew the in-app subscription: the App Store shows you the price, takes the payment, and tells our server the subscription's status. To make that subscription land on the right account, the app passes your Iconic Voices user ID to Apple as the purchase's account token. Nothing else is sent to Apple by us, and nothing is sent for Apple's own advertising purposes. If you never subscribe, nothing at all goes to Apple from the app. The Android app sells nothing and talks to no third party.
- Apart from that, the apps share no data with third parties. Supabase and Cloudflare are our own processors (they host our backend); nothing is shared with anyone for their own purposes.
- The apps do not access your location, contacts, photos, microphone, or files.
This section is written to say exactly what the Apple "App Privacy" label and the Google Play "Data safety" declaration for the apps say — including the purchase record above, which the iOS label declares as Purchases, linked to your identity and used only to run the app. If you ever spot a mismatch, tell us at privacy@iconicvoices.io and we will fix it.
4. Legal bases (GDPR)
| Processing | Legal basis |
|---|---|
| Account, sign-in, playback, progress and bookmark sync | Contract — Art. 6(1)(b) |
| Purchases, entitlements, receipts | Contract — Art. 6(1)(b) |
| Tax and accounting records | Legal obligation — Art. 6(1)(c) |
| Waitlist / launch emails, marketing cookies | Consent — Art. 6(1)(a) |
| Security, fraud prevention, error monitoring (Sentry) | Legitimate interest — Art. 6(1)(f) |
| Cookieless aggregate analytics (Plausible) | Legitimate interest — Art. 6(1)(f) |
5. How long we keep it
| Data | Retention |
|---|---|
| Account (email, user ID) | Until you delete the account, plus a 7-day recovery window; residual copies leave backups within 30 days |
| Listening progress & bookmarks | Deleted together with the account |
| Transaction records | Up to 7 years (tax-audit requirements) |
| Waitlist / notify-me emails | Until you unsubscribe or ask us to delete them |
| Support and feedback correspondence | Up to 24 months |
| Error reports (Sentry) | 90 days |
6. Processors we use
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, authentication, application APIs | EU (Ireland) |
| Cloudflare | Website hosting and CDN, audio storage (R2), bot protection (Turnstile) | Global network; EU-US Data Privacy Framework certified |
| Apple | App Store In-App Purchase — Apple is the seller of record for the iOS subscription: it takes the payment and reports the subscription's status to us, keyed to your user ID | US / Ireland; EU-US Data Privacy Framework and Standard Contractual Clauses |
| PayPal | Billing for legacy subscriptions | US; EU-US DPF |
| Paddle / Stripe | Checkout, when new purchases resume — the processor is named at checkout and on your receipt | EU / US |
| Resend | Transactional email (receipts, account email) | US |
| Sentry | Error monitoring (IP addresses and emails scrubbed in the browser before sending) | US; EU-US DPF |
| Plausible | Cookieless, anonymous aggregate analytics | EU |
About Apple: for the iOS in-app subscription Apple does not act on our instructions — it sells to you in its own right, as merchant of record, and is an independent controller for the payment. It is listed above because it is a recipient of your user ID and because we receive your subscription record back from it. Apple's own privacy policy governs what Apple does with your Apple Account data: apple.com/legal/privacy.
Consent-gated and currently disabled: Google Analytics 4, Microsoft Clarity, Meta Pixel, and TikTok Pixel are configured in our consent system but load only if you explicitly grant the matching consent category. See the Cookie Policy for the full inventory.
We do not sell your personal data.
7. Your rights and how to exercise them
- Access & export: download everything we hold about you as JSON, self-service, at Settings → Privacy (sign-in required) — or email privacy@iconicvoices.io.
- Rectification: correct your email in Settings → Account, or email us.
- Erasure: delete your account in the apps (Settings → Delete account), on the web at Settings → Privacy, or via the public page /delete-account.
- Portability, restriction, objection, withdrawal of consent: email privacy@iconicvoices.io. We respond within 30 days (usually much faster).
- Complain: you have the right to lodge a complaint with your local data protection supervisory authority (GDPR Art. 77).
California (CCPA/CPRA): the categories we collect are identifiers (email, user ID), commercial information (purchase records), and internet activity limited to your use of our own service (listening progress, bookmarks). We do not sell personal information and do not share it for cross-context behavioural advertising. You have the rights to know, delete, and correct, and we will not discriminate against you for exercising them — use the same channels listed above.
8. Deleting your account
Cancel an App Store subscription before you delete. Deleting your Iconic Voices account does not cancel a subscription bought in the iOS app — Apple holds that billing arrangement, not us, and it will keep charging your Apple Account. Cancel it first at apps.apple.com/account/subscriptions.
Four equivalent paths — full details on the deletion page:
- In the apps: Settings → Delete account (iOS and Android).
- On the web: Settings → Privacy (sign-in required).
- Public page: iconicvoices.io/delete-account — works without the app installed.
- Email: support@iconicvoices.io, subject "Delete my account", sent from your account email.
9. Children
Iconic Voices is not directed at children under 13, and we do not knowingly collect data from them. Our Terms require users to be at least 13 (16 in the EEA) with parental consent, or 18 to purchase. If you believe a child has created an account, email privacy@iconicvoices.io and we will remove it.
10. International transfers
Your account data lives in the EU (Ireland). Where a recipient is US-based (Cloudflare, Apple, PayPal, Sentry, Resend), transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. We do not rely on the deprecated Privacy Shield.
11. Changes to this policy
If we make material changes we will email account holders and subscribers at least 14 days before they take effect and update the "Last updated" date above. The current version is always at iconicvoices.io/privacy.
12. Contact
Privacy questions and data requests: privacy@iconicvoices.io. General support: support@iconicvoices.io (or the Support page). Legal, takedowns, disputes: legal@iconicvoices.io.