Aroa · privacy

Your privacy.

How Aroa handles on-device memories, cloud voice, connected services and your privacy choices.

Last updated 2 October 2026

This page is being prepared for launch. Operator and contact details must be completed before it can serve as Aroa’s official policy or App Store support page.

Who this policy covers

This policy describes the Aroa iPhone app and this website. The operator’s legal identification will be added before launch. For privacy questions or requests, contact our support page.

Aroa combines on-device features with optional online services. Using local voice does not make connected apps, web searches or websites offline.

Information on your iPhone

Conversation history, personal memories, profile details and documents you choose to import are stored on your device. These can include names, preferences, conversation text and document contents. Relevant context may be included in an online request when you use cloud voice or a connected service.

Local voice uses on-device speech recognition and compatible on-device models. Availability depends on your iPhone, language and system settings.

Cloud voice and connected services

When you use cloud voice, microphone audio and relevant conversation context are sent to OpenAI to generate responses. This can include information retrieved from your permitted tools, memories or documents. The service receives technical connection data such as your network address.

Our backend runs on Cloudflare. It processes installation identifiers, voice allowances, usage totals, session times and connection diagnostics to operate the service, enforce limits and investigate reliability problems. Its usage records do not store audio or conversation transcripts.

Composio handles connected-service authorization and tool requests. Connected providers receive the data needed for actions you request, such as a search query, an event update or a message. Web search can use Composio or Tavily through Composio. Websites opened in the browser receive ordinary web requests and may store their own cookies or session data.

These providers may process data outside your country. Their services and retention practices are described in their own policies: OpenAI, Cloudflare, Composio and Tavily.

Permissions and your choices

Aroa requests access to the microphone, speech recognition, calendar, reminders, contacts, notifications and location when a feature needs it. You control iPhone permissions in iOS Settings and feature access in Aroa’s settings.

You can disconnect external services in Aroa’s External apps settings or revoke access with the provider. Revoking access stops future permitted access; it does not automatically erase data or actions already stored by that provider.

Retention and deletion

Local conversations and imported documents remain until you delete them or remove the app’s local data. Memories are stored separately from conversations; deleting a conversation does not necessarily erase a memory extracted from it. Ask Aroa to forget a saved memory and review the confirmation.

Session-start records older than 24 hours are pruned when that installation starts another session. Usage totals, installation records and connection metrics do not currently have automatic expiry. Short-lived integration sessions and approval tokens expire separately. Contact us to request removal of server-held records associated with your installation.

Cloud providers, connected apps, websites and device backups have separate retention rules. Disconnecting a provider or uninstalling Aroa does not delete records already held by those services. We may need to retain records where law requires it or to resolve a dispute.

This website and support

This showcase does not request your microphone, location or access to your apps. Its stories use demonstration content. We have not added advertising trackers, analytics scripts or a marketing cookie banner. Our hosting provider still processes ordinary request information to deliver and protect the site.

If you email support, we receive your email address, message and any attachments you include, and use them to answer your request. Avoid sending passwords, access tokens or private conversation content that is not needed to explain the issue.

Privacy requests

Depending on your location, you may have rights to access, correct, erase, restrict or receive a copy of your personal information, to object to processing, or to withdraw consent. You can also raise a concern with your local data protection authority.

Contact our support page with the subject “Aroa privacy request”. We may ask for enough information to identify the relevant installation and verify your request. Withdrawing a permission does not affect processing already carried out.

This page will be updated as Aroa changes. The date above identifies the latest revision.