voco
Privacy policy
Last updated: November 4, 2026
Voco is designed to know as little about you as possible. This page explains, in plain words, which data goes through our servers, why, and for how long it stays there.
In short
- Your voice messages are end-to-end encrypted: we can't listen to them.
- They are deleted once heard, and at the latest 24 hours after being sent.
- Your nickname, photo and channel names never reach us.
- Your phone number is only kept as a fingerprint (it can't be read back).
- No ads, no analytics, no trackers, neither in the app nor on this website.
Who is responsible for your data?
Muesli, [legal form], SIRET 901 438 101 00015, registered office at [adresse du siège], France ("we"). For any question: app@muesli.io.
Data we process
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Phone number | Signing you in with a code sent by text message. The number is passed to our SMS provider to send it; we only keep a fingerprint (HMAC-SHA256 with a secret key). | Performance of the service | Fingerprint: until the account is deleted. Code: 5 minutes. |
| IP address and number fingerprint when a code is requested | Preventing abuse (mass SMS sending). | Legitimate interest | 24 hours |
| Public keys and device type (iPhone or Android), session token | Running your account and verifying where messages come from. | Performance of the service | Until the account is deleted or the device replaced |
| Notification token (Apple or Google) | Letting you know a message is waiting. | Performance of the service | Until the account is deleted or notifications are turned off |
| Channel membership (technical identifiers, status, signatures) | Delivering messages to the channel's members only. | Performance of the service | Until the channel is closed |
| Encrypted voice messages and their metadata (sending device, time, number of chunks) | Delivering your messages. | Performance of the service | Deleted shortly after every recipient has heard them, at the latest about 24 hours after sending |
| Server logs (IP address, requests, errors) | Security and troubleshooting. | Legitimate interest | [log retention period] |
What we don't collect
The audio of your messages in readable form, your nicknames, profile photos, channel names and colours, your contacts and your location. On Android 10 and 11, the system requires the location permission to use Bluetooth: Voco doesn't use it to locate you.
What stays on your phone
Your encryption keys (in the phone's secure storage), your nickname and photo, your channels' member lists, names and photos, and the history of messages heard in the last 24 hours (without the audio). This data isn't included in iCloud or Google backups. Uninstalling the app erases it.
Who we share data with
- Scaleway (France) hosts our servers and the encrypted message storage, in Paris.
- OVHcloud (France) sends sign-in text messages and receives your number and the code for that purpose.
- Apple (iPhone notifications) and Google (Firebase Cloud Messaging, Android notifications) receive your notification token and the technical identifier of the channel concerned, never its name or the message content. These companies may process this data outside the European Union, with appropriate safeguards (standard contractual clauses or the EU–US Data Privacy Framework).
We don't sell or rent any data.
Security
Messages are encrypted on your phone before they are sent (libsodium: XChaCha20-Poly1305, X25519, Ed25519) and signed by the sending device. Channels are paired in person, over Bluetooth, with a 6-digit code. All connections to the server use HTTPS.
Your rights
You can ask to access, correct or erase your data, to restrict or object to its processing, and for data portability, by writing to app@muesli.io. Since we only keep a fingerprint of your number, include it in your request: we'll send you a code by text message to confirm it's you. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
Deleting your account
Write to app@muesli.io with your phone number. After verification by text message, within 30 days we delete your number's fingerprint, your devices, your tokens, your channel memberships and any messages waiting for you. Messages you already sent to other members are deleted once heard, or at the latest 24 hours after sending.
Minimum age
Voco is intended for people aged [15] and over.
Changes
If this policy changes, the new version is published on this page with its update date.