How we handle your data
Effective from October 22, 2026
Face, hand, and pose recognition, as well as trust index, stress level, and emotion calculations happen LOCALLY on your device in real time during recording — the video itself never leaves your device and is never transmitted to our servers. The final session report is generated on the device based on these local calculations.
After stopping the recording, the following is sent to our servers: a compressed audio track — for voice analysis (tone, speech rate, pauses) and speaker identification if multiple people participated; individual photos — if you use the identity verification feature; individual video frames — for face detection; aggregated text metrics of the session — for generating personalized recommendations and insights.
You confirm that you have the legal right to record the conversation participants whose voices are sent for analysis.
Audio from sessions with multiple participants is sent to AssemblyAI for speaker diarization (identifying who is speaking); the uploaded audio and its transcript are deleted from AssemblyAI's systems after processing. Video frames are transmitted to Google Cloud Vision for face detection and emotion estimation, and photos for identity verification. Face crops are transmitted to xAI for estimating age and gender. When you tap the 'second opinion' button, an individual video frame is sent to OpenAI (via our proxy Emergent) to cross-check the dominant emotion. Derived session metrics and context (for example the emotion timeline, duration, time of day, the location label and goals you enter) are sent to LLM providers (OpenAI, Anthropic, Google Gemini — via our proxy Emergent) to generate text descriptions and recommendations. Each provider has its own privacy policy. Push notifications are delivered through OneSignal.
We do not sell your personal data for money. With your explicit consent, we share advertising-measurement data with ad platforms: a device advertising identifier and standard events (app install, registration, purchase) are sent to Google Ads (via Firebase Analytics), Meta and TikTok, solely to measure the performance of our marketing campaigns. We do not send your name, email or phone number to advertising platforms. Usage analytics via Google Analytics for Firebase are collected only after your consent. With your consent to analytics, we also record a small set of pseudonymous product events on our own servers (such as viewing the subscription screen, starting or finishing an analysis) together with a device identifier, app language, region and app version, to understand how the app is used and to improve it. You can withdraw consent at any time in Settings → Privacy.
Your session reports, recording metadata, and photos are stored on our servers until you manually delete them, or until the auto-cleanup period you can configure in the Data Retention section (disabled by default). Audio is processed ephemerally and is not stored on our servers. Biometric face templates are created only when you use identity verification, are used solely to recognize you during verification, and are stored until you delete your account or request deletion. Your profile photo (avatar) is stored until you delete your account. Shared emotion cards expire after 30 days and become inaccessible when you delete your account. Video recordings are stored only on your device and managed by your device. You can export your session archive at any time.
At any time you can: view and export your recordings and reports; delete an individual recording or your entire account (Settings → Delete Account) — this removes your data from our servers; backups are overwritten within 12 months, third-party providers retain data according to their own policies, and shared cards become inaccessible; video recordings are stored only on your device and are deleted by you locally, like any other files in your phone gallery; contact us with questions about your data.
All requests to our servers are transmitted over a secure connection (HTTPS/TLS). Access to your recordings and reports is protected by authorization — no one can access them except you. Passwords are stored as irreversible hashes. We enforce rate limiting to protect against password guessing. We process device identifiers and IP addresses to protect the service from abuse and to enforce usage limits. Server access logs (IP, request path, status, time — without request content) are retained for 14 days for security and diagnostics.
The application is not intended for persons under 16 years of age. We do not knowingly collect data from children under this age.
If we significantly change how your data is processed, we will notify you within the application before the changes take effect.
For any questions about your data, write to us at support@neuroscanapp.io — we will respond.
Before your first recording we ask for your consent to process your voice, camera images and facial data to create your analysis report, as described in this policy. The app does not start recording without it. You can withdraw your consent in Settings → Privacy, by deleting your account, or by writing to support@neuroscanapp.io.