Privacy Policy

Tóvox is run by NUBLK LLC, a Wyoming limited liability company (“we”, “us”). NUBLK LLC also publishes the Tóvox app for iPhone, and will publish the Android app. Tóvox is designed by Claymore & Colt Agency.

This policy covers the Tóvox website (tovox.io), the Tóvox web app (chat.tovox.io), Tóvox Mail and the Tóvox apps. It explains what we collect, what we can and cannot read, who else is involved and what you can ask us to do.

Questions and requests: [email protected]. By post: NUBLK LLC. Registered office: 30 N Gould St, Ste N, Sheridan, WY 82801.

• Messages in your chats with people, including photos, files and voice messages, are end-to-end encrypted. We store them only in a form we cannot read.
• Some things are not end-to-end encrypted: business chats with an organisation’s staff, meetings, Tóvox Mail, chats with Skye and other bots, and anything you send to our servers to be translated or turned into text. Section 4 lists them all.
• Translation, speech to text, meeting summaries and Skye run on your device or on servers we operate ourselves, which do not store your audio. The one exception, an outside speech service that Translate can use only if you agree, is explained in section 4.
• We store your data on our own hardware in the United States. Some outside services keep their own copies of what they handle; for example, Resend keeps a copy of each email for 30 days (section 9).
• We do not sell your data, we do not show ads and we do not use advertising or analytics cookies.

End-to-end encrypted means a message is locked on your device before it is sent, and only the devices of the people in the chat hold the keys to open it. Our servers carry and store it, but cannot read it.

• One-to-one and shared chats: the text of every message, photos, files, voice messages, locations you share and replies. Each device you sign in on has its own keys, and each message has its own key. Messages sent since 21 October 2026 are also signed by the sending device, so a message cannot be made up in your name on our servers; older unsigned messages are marked as not verified.
• Meeting chat, files, captions and summaries: the words and files are stored locked with a key for that meeting, which only the devices of the meeting’s members hold. Who spoke or wrote, their name, and when, stay readable to our servers. One exception: a summary written by the meeting assistant for our own team is stored in readable form (section 4). Section 4 also explains what happens when captions or a summary are made.

A few things around your messages stay readable to our servers so the service can work: who is in which chat, who sent a message and when, which of your names you used, the size of files, shared chat names, and the “missed call” and call-length notes that appear in a chat after a call. Your name, @handle and profile photo are visible to people who use Tóvox.

Your personal link (chat.tovox.io/u/your-handle) shows only your @handle, unless you switch on Public profile in Settings: then anyone who opens your link, and link previews in other apps, also see your name and profile photo. It is off unless you switch it on, and you can switch it off at any time; apps that already showed your link may keep the old preview for a while.

• Voice and video calls: one-to-one calls are encrypted between the two devices and the call set-up is signed by both. When a direct connection is not possible, the call passes through our own relay server, which we run on a server rented from Vultr in the United States. The relay passes on the encrypted call without being able to listen to it or see it, so neither we nor Vultr can; it does see both devices’ IP addresses, when the call takes place and how much data it carries. To find a route, your device asks that same relay server what your network address is; no outside connection-check or relay service is used. We do not record calls. We keep a record of each call (who called whom, voice or video, when, how long, whether it connected directly or through the relay, and how it ended).
• Meetings: meetings run on our own meeting server, which we run with the LiveKit meeting software on the same server rented from Vultr in the United States (no outside video service is involved). Sound and video are encrypted on the way to and from it, but not end to end: our meeting server handles them in readable form to send them on to the other people in the meeting, so they are readable on that server while the meeting runs. It also sees the IP addresses of the people in the meeting. We do not record meetings. We keep the meeting’s name, host, members, times and settings.
• Meeting captions: if captions are on, your microphone’s sound is sent to our own speech server, turned into text and sent back. The audio is not stored. The text lines are then stored locked with the meeting key (section 3). In English meetings our speech server can also recognise who is speaking: when someone introduces themselves (for example “Hi, I’m Ana”), it saves a voice profile for that name, linked to the account of the person whose captions it was making, to label later lines. You can ask us to delete voice profiles.
• Meeting summaries: when a host ends a meeting that has captions, or a member asks for a summary, the caption text is sent to a language model on our own servers, which writes the summary. The caption text is not kept or logged there, and it is never sent to an outside company. The finished summary is stored locked with the meeting key. The host’s assistant may then send the notes to everyone who joined, in a chat with that assistant, which is not end-to-end encrypted. A member can also ask for an email with a link to the notes: the email holds no notes, and the link needs signing in.
• Meeting assistant for our own team: when a member of our own team who has it switched on joins a meeting, a note-taking assistant joins the meeting too. It hears the meeting and writes a summary, which is stored with the meeting in readable form (not locked with the meeting key) and sent to the people in the meeting who have their own Tóvox assistant.
• Business chats (not open to everyone yet): a chat with an organisation on Tóvox, or one of its departments, is not end-to-end encrypted: the organisation’s staff can read it, and the chat says so before you send anything. Its messages are stored on our servers in a form they can read. They are text only for now, and a word and link filter may hold a message for review by our team. Each staff reply shows the display name of the staff member who wrote it; the organisation’s owners and admins can see which staff member did what. Older chats with a business name that has since moved into an organisation stay end-to-end encrypted.
• Skye and other bots: chats with Skye, our assistant, and with any other bot are stored in readable form, because the bot has to read them. Skye answers with a language model on our own servers. A bot made by someone else is run by them, and they can read what you send it.
• Tóvox Mail: mail is stored on our own mail server, which can read it. Email you send to, or receive from, other email services travels and is stored the way email normally is, and is not end-to-end encrypted.
• Translation: translation runs on your device when it can (Chrome’s built-in translator in the web app, Apple’s on-device translation in the iPhone app), and the text then never leaves your device. Otherwise the text is sent to our own translation server, which reads it to translate it. It is not stored or logged there, and it is never sent to an outside company. Translations are kept only in the open browser tab. In chats, Auto-translate is on unless you switch it off in Settings. Before the text of an end-to-end encrypted message is first sent to our server to be translated, Tóvox asks you once; until you agree, only translation on your device runs. A translated message says whether it was translated on your device or on our server.
• Speech to text: in the web app, the microphone in chat, in Translate and in meeting captions sends your voice to our own speech server, which turns it into text and sends the text back. Nothing is stored there: no audio and no text. One exception: if our speech server is not available, Translate (open to testers only for now) can instead send your voice to Deepgram, an outside speech-to-text company. It asks first (once on each device), goes ahead only if you agree, and shows a note under the mic whenever your voice is going to Deepgram. In the iPhone app, speech is turned into text on the phone itself, using Apple’s on-device speech recognition. Only while a language is not ready on the phone yet, or getting it ready failed, can the iPhone app send your voice to our own speech server instead, and only after you agree (asked once for each account). It is never sent to an outside company, nothing is stored there, and without a connection nothing is sent.
• Alerts: an alert says only “Tóvox” and a few plain words: “New message”, “Incoming call”, “Missed call” or a short note about a scheduled call. Safety and account alerts (such as Vigía, camp alerts, a new device on your account or a request to remove your devices) say only “Open Tóvox for details”. An alert never shows who sent a message or is calling, a chat’s or business’s name, a camp alert’s words or the words of a message, and it carries no chat or person identifier that a push service can read (in a browser, alerts about the same chat share one code inside the encrypted alert, so the browser can show them together): when you tap it, Tóvox works out what it was about once you are signed in, then opens the chat of a message or call alert, or the journey of a Vigía alert in the web app; other safety and account alerts open Tóvox, where the details are (the iPhone app has no Vigía yet, so there a Vigía alert just opens Tóvox). Alerts reach your device through the push service of your browser or phone (section 9). The link in an alert holds a code made for that one alert.
• Email from Tóvox: meeting invitations, a link to meeting notes when you ask for one, sign-in codes to check an email address, and Vigía safety alerts are sent as ordinary email. Vigía emails and meeting notes emails carry no name, no place and no notes: they say only that a contact asked or needs you, or that notes are ready, with a link that needs signing in. The link in a Vigía email holds a code that shows no journey, place or name. Every email to one contact about the same journey carries the same code. When you invite people to a scheduled meeting by email, each invitation includes a calendar entry that lists the email addresses of everyone invited. We keep the invitees’ names with the meeting, not their email addresses.
• Screenshot notices: in chats where screenshot alerts are on, the web app records when it sees a screenshot key (such as Print Screen) or when you switch away from the chat’s tab or window (which can mean a screenshot), and tells the other people in the chat.
• Vigía and festival camps (not open to everyone yet): a Vigía journey shares your live location, route, check-ins and any clips you record with the contacts you choose, and these are stored on our servers so they can see them. Camp alerts in festival mode go to the whole camp and are not end-to-end encrypted.

You can set a chat’s messages to disappear after 5 minutes, 1 hour, 1 day or 1 week. When the timer runs out the message is hidden at once and then deleted from our servers with its files, normally within minutes. Anyone in the chat can still copy, forward or photograph a message before it disappears.

When you delete a message for everyone, its contents and files are removed from our servers and only a note that a message was deleted remains.

• Your encryption keys are made on your device and stay there, apart from the locked backup described below. Each phone or browser is a separate device with its own keys.
• When you sign in on a new device, your other devices that have alerts on are told, and Devices & Sessions lists every device on your account so you can remove one you do not recognise. Where device approval is switched on for your account, a new device must also be approved from one of your existing devices, or with your recovery phrase, before it can read your messages.
• Key backup: if you set up a backup, your keys (and the keys of messages you have already opened, so your history can be read on a new device) are locked on your device with your recovery phrase before they are uploaded. We store only the locked copy and cannot open it. Tóvox can suggest 12 random words as your recovery phrase. If you lose your recovery phrase and all your devices, we cannot recover your messages.
• To open chats quickly, the app keeps copies on your device: files you have opened stay there still encrypted, and the iPhone app keeps your chats on the phone, locked with a key held only in the phone’s keychain, which is not included in phone backups and is erased when you sign out.

• Sign-in: you sign in with Google, Microsoft or Apple. We receive your name, email address and, if there is one, your profile photo from them. We never get or hold a password for you.
• Profile: your display name, @handle, photo, language, any business names you add (with their photos, and the email address or web domain you verify for them), and when you were last online (you choose whether others can see it).
• Sign-up: when you join, we record the country you joined from (a two-letter country code worked out by Cloudflare, not your IP address) and how you joined (open sign-up, or the admin who invited you). We send you one welcome email, and our administrators get a notification that someone joined, with the time and how (open sign-up or by invitation) but without your name, @handle or country, which they see on the admin page.
• Your contacts and settings: the people you save as contacts or trust, people you block, your broadcast lists, chats you pin or mute, and your other settings.
• Devices: for each device: its public keys, a label such as “Chrome on macOS”, the web address it was set up on, when it was added, last used, approved (where device approval is on) or removed, and its alert address if you turn alerts on.
• Messages and calls: the encrypted messages and files described in section 3, and the call and meeting records described in section 4.
• Location: only when you share a location in a chat (inside the encrypted message) or start a Vigía journey. We do not track your location in the background.
• Technical: your IP address, which our servers and Cloudflare (section 9) see on every visit. We use it to limit abuse; the counters we keep for limits are held in memory and cleared when our servers restart. Our servers also keep ordinary technical logs, such as errors, to find and fix problems. The website also uses the country Cloudflare works out from your IP address to choose the language its pages are shown in; that country is not stored for this.
• When you write to us: what you send and our reply.

• To run Tóvox: deliver messages, calls, meetings, mail, alerts and translation.
• To keep it secure: check devices, stop abuse, enforce our Terms and protect people.
• To answer you when you contact us.
• To meet our legal duties.

We do not sell your data, use it for advertising or build profiles of you to sell things.

We run Tóvox on our own servers, and our call relay and meeting server on a server we rent. These outside services are involved, each only for the job listed:

• Cloudflare: our network provider. Visits to Tóvox pass through Cloudflare on their way to our servers. Encrypted messages stay encrypted.
• Google, Microsoft and Apple: sign-in, when you choose them.
• Vultr: rents us the server in the United States on which we run our call relay and meeting server (section 4). One-to-one calls that pass through it stay end-to-end encrypted; the sound and video of meetings are handled there in readable form while a meeting runs. It stores no messages and no recordings.
• Push services: alerts go through the push service of your browser (for example Google’s in Chrome, Apple’s in Safari or Mozilla’s in Firefox) or through Apple’s push service for the iPhone app. Our Android app, when it is released, will use Google’s Firebase Cloud Messaging. Browser alerts are encrypted so the browser’s push service cannot read them. The iPhone app’s alerts are not, so Apple can see the alert’s text, which is only the generic wording above (so whether it is a message, a call, a scheduled call or “Open Tóvox for details”), how urgent it is and how long it may wait to be delivered, a code made for that one alert, which means nothing without signing in to Tóvox, and that an alert went to your phone and when.
• Resend: sends Tóvox’s email: meeting invitations, links to meeting notes, email check codes, Vigía alerts, welcome emails and administrators’ sign-up notifications. Resend keeps a copy of each email, including its text, for 30 days and then deletes it, apart from its own backups, which last 7 more days. Vigía alerts, meeting notes emails and administrators’ sign-up emails carry no names, places or notes; meeting invitations and welcome emails still name the people involved.
• Deepgram: speech to text for Translate, only while our own speech server is unavailable and only after you agree (section 4).
• OpenStreetMap: shows the map when a location is shared in a chat, so it receives the area being shown. Tapping the map opens it in Apple Maps, which then receives that location. Vigía also uses map, address, route and nearby-places services from OpenStreetMap, CARTO, the OSRM project and the Overpass service.

We also share data when the law requires it (for example a valid court order), to protect someone’s safety, or to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC). We cannot hand over the contents of end-to-end encrypted messages, because we cannot read them. If NUBLK LLC’s business is sold or reorganised, your data would pass to the new owner under this policy.

Your data is stored on servers we own and operate in the United States. Some outside services keep their own copies of what they handle; for example, Resend keeps a copy of each email for 30 days (section 9). Our call relay and meeting server runs on a server rented from Vultr, also in the United States; it stores no messages and no recordings. The outside services in section 9 may handle data in other countries. If you use Tóvox from outside the United States, your data is handled in the United States.

• Messages and files: until you or the sender delete them, a disappearing timer runs out, or the chat is deleted.
• Call records: until either person on the call deletes their account.
• Meeting records, captions and summaries: kept for the meeting’s members. If you delete your account, your name is taken off them.
• Your account and profile: until you ask us to delete your account.
• Audio for speech to text, and text sent for translation: not kept at all.
• A record of a block or removal and of what our administrators did, kept to protect the service.
• Child sexual abuse material that we report: preserved for one year, as US law requires, and then deleted.

• Change your name, handle, photo, language and settings in the app at any time.
• Delete your messages for everyone, leave shared chats, turn on disappearing messages, and remove devices you no longer use.
• Turn alerts off in Settings or in your browser or phone.
• Ask us for a copy of the account data we hold about you, to correct it, or to delete your account, by writing to [email protected] from the email address you sign in with. We may need to check it is you. We aim to reply within 30 days.

Deleting your account removes your profile, devices, keys, backups, contacts, alerts, voice profiles, bots and memberships, and your photos and files that nobody else still uses. Messages you sent to other people stay in their chats, still encrypted. Your name is taken off the speaker and author labels on meeting captions, meeting chat and notes, but a name that appears within the words of captions, notes or summaries stays. Your sign-in record sits on a sign-in service that other apps run by us and our related businesses also use; tell us if you want that removed too.

Depending on where you live, you may have further rights under your local law. Write to us and we will help.

You must be at least 13 years old to use Tóvox. We do not knowingly collect data from children under 13. If we learn that a child under 13 has an account, we will delete it. If you think this has happened, write to [email protected].

We use no advertising or analytics cookies. Tóvox stores only what it needs on your device:

• Four small cookies: your light or dark theme, which side the phone menu sits on, the website language you chose in the language menu, and a note that you have visited the website before (so an English link you open is not sent on to another language’s pages again).
• Your sign-in session, so you stay signed in. Tóvox Mail, which runs on its own server, keeps its own sign-in session.
• Your encryption keys and the encrypted copies described in section 6.
• Small preferences, such as whether you agreed to a notice.

Clearing your browser’s site data signs you out and removes this device’s keys. Without a key backup or another device, messages sent to this device can then no longer be opened.

Besides end-to-end encryption, we sign messages and call set-ups, alert you to each new device on your account, use encrypted connections throughout and limit who and what can reach our servers. No system is perfectly secure; if you find a problem, please read our security page.

When we change this policy we will update the date at the top. For important changes we will tell you in the app or by email before they take effect.

For privacy questions or requests about your data: [email protected], or by post to NUBLK LLC. Registered office: 30 N Gould St, Ste N, Sheridan, WY 82801.