Privacy Policy

Voice & speech

Your speech is transcribed by Apple's speech recognition. Where your device has an offline model for the language it stays on the phone; where it doesn't, Apple does the transcribing on its servers — Apple decides which languages have an offline model, and doesn't publish a list. Either way, outside AI Meeting, a recorded video meeting, a voice sample you choose to record for a soul, a recording you make or import in Voice Changer, a voice note you record in Chat, and an explicitly recorded Life Journal story or voice for your family, no recording is written to disk: transcripts are held in memory only as long as the moment needs them. These are described under Meeting recordings, Video calls and meetings, The voice, Chat, and Life Journal.

Meeting recordings

AI Meeting can keep an audio recording of a meeting. It is off until Reverbot has read a notice aloud to everyone present and someone other than you has agreed out loud (or every phone that joined has agreed), and you can switch it off entirely in the mode's settings. The recording is stored on your phone, encrypted, and is never uploaded: the report is written from the transcript's text, which goes to the AI the way a question does. Recordings stay until you delete the meeting or set a retention period in the mode's settings, and every one of them is deleted with your account.

When the report is emailed to the participants automatically, its text — with the transcript, if you choose — and their email addresses go to Reverbot’s server, which sends it to them from noreply@reverbot.ai. Messages and waves that people who joined a meeting from their own phones send each other go over the encrypted direct link between the phones, with no server in between, and are gone when the meeting ends.

Translation

The translation modes — vicinity, two-way, and translating with someone nearby — are the exception to the above, and we would rather say it plainly than bury it: they send audio, not text. A recogniser cannot identify a language it was never told to expect, so the recording of what was said goes, through a Reverbot server, to Google, which transcribes and translates it in one step — unless you choose Gemini or OpenAI for Translation in Settings → AI & API Keys, when it goes straight from your phone to that company on your own key, under that company's terms (a free Gemini key is on Google's unpaid terms, described under AI providers) and billed to your account. On a Both of you phone call it always goes through Reverbot. This is every utterance for as long as the session runs, not a sample. In vicinity and two-way it includes the voices of people near you who are not Reverbot users; in a nearby session each phone sends only its owner's voice. The same goes for Translate too, a switch that translates the room during an AI Meeting: while it is on, what is said in the meeting goes to Google to be translated in the same way, including other people's voices where one phone is hearing the whole room. Between paired phones what travels is text — each sentence as it was said and as it was translated — with the name you show there and, if you add them, your photo, company and job title, and your contact card when you tap Card, all over an encrypted direct link. Reverbot keeps none of any of it.

A live rehearsal is the other exception. For as long as one runs, your voice streams to the live voice model you chose — Google's, on Reverbot's connection or your own Gemini key, or OpenAI's on your OpenAI key — and the partner's voice streams back. Reverbot keeps none of it; the transcript is saved on your phone, as every rehearsal is.

AI providers

By default Reverbot answers using its own Google Gemini connection. The text of what you said — and, in Job mode, the relevant excerpts of documents you uploaded — is sent over an encrypted connection to a Reverbot server, which forwards it to Google and returns the answer. In Flirt, and in a Custom Conversation with Use my profile on, what you wrote in Settings → About you — your name, age, sex and the rest, never your sexuality — goes with it; in Flirt, so do what you're looking for, your dealbreakers, the situation and your notes on the person you are talking to. Under Google's paid terms, Google does not use it to train or improve their models, but Google does log prompts and responses for a limited period to detect abuse. Reverbot's own server does not write your questions or answers to a database.

If you supply your own API key (Google Gemini, Anthropic Claude, OpenAI, or xAI Grok), that request goes from your device straight to that provider and Reverbot's server is not involved. Note the limits of that: it applies to answering questions, and to translation only when you choose your Gemini or OpenAI key for it under AI for each feature. Otherwise translation and the default voice run on Reverbot's own connection, whatever key you have set. A Gemini key on Google's free tier is on Google's unpaid terms, under which Google may use what you send to improve its products and human reviewers may read it — except in the European Economic Area, Switzerland and the United Kingdom, where Google applies its paid terms to free use as well. Turning on billing for the key puts it on the paid terms everywhere.

Knowing when you've finished

To know when you've finished speaking, the text of what Reverbot is about to act on — a question it heard, a word or phrase in Dictionary, a voice command, what you say to a soul, the words of the turn just heard in a Custom Conversation, a Practice rehearsal or Flirt in person, the last lines of two souls getting to know each other, on a call with a soul that has Realism on its last line with yours, or in Two-way translation the English recogniser's words for each sentence — also goes over an encrypted connection to a Reverbot server, which passes it to TypeSafe. TypeSafe's model only makes yes-or-no judgements and writes no answer: whether you have finished (or, in a Custom Conversation or Flirt, whether the person speaking has; or whether two souls' conversation has wound down) and, talking to a soul, whether you're asking it for help with the app, whether a listener would say “mm-hm” there and whether what you said sounds sad, funny or surprising, which picks that sound; on a Realism soul's call, whether you were talking to it or to someone else in the room; in a group call with souls, which participant should speak next, using their names, short character descriptions and your latest line; when expressive soul speech is on, what tone fits the soul’s next sentence, using that sentence; and in Two-way translation, whether you spoke English. TypeSafe receives it under its own terms and privacy policy; Reverbot's own server does not write the text to a database. It is part of the agreement Reverbot asks for before anything you say leaves your phone, and it is never used on phone calls.

It does three things. A question that sounds finished can be sent to your AI a moment early; its answer is used only if the question you finish with is exactly the same, and is otherwise thrown away unheard — on Reverbot's own AI it then does not count against your allowance. And it tells Reverbot whether you have finished, so that it answers after exactly the Silence duration before answering you set, or one second later when you stopped mid-sentence. And in Two-way translation, when you spoke English, your sentence is translated for the other person at the same time as it is checked that it was yours, instead of after; that translation is used only if it was, and is otherwise thrown away unheard and does not count against your allowance.

The voice

Every voice Reverbot speaks with — its own, and any you add with a key — is generated by AI, not a recording of a person. The default voice, Reverbot Voice, is generated by Google, not by your phone — so the text Reverbot is about to speak is sent to a Reverbot server and on to Google Text-to-Speech, one request per sentence. Picking one of the built-in iOS voices in Settings keeps speech entirely on the device — for every mode that uses the default voice; a mode or soul you've given a voice of its own keeps that voice.

Any mode, and any soul, can instead speak with a voice service you have added your own key for — Google, ElevenLabs, OpenAI, Gemini or xAI (Grok). The words it speaks then go from your phone straight to that company, under your key, and for OpenAI's and Gemini's voices so does a line on how the voice should sound: the style you picked, or for a soul the details listed under Souls. That company handles them under its own terms and privacy policy, and none of it passes through Reverbot.

Creating a voice for a soul. On a soul’s profile, AI & voice → Record a voice for this Soul lets you record and preview a sample of 10 to 120 seconds; one to two minutes is recommended. This needs your own ElevenLabs key and a plan that includes Instant Voice Cloning. Before you tap Create, you must confirm that you own the voice or have permission to clone it. Only then does the raw sample go directly from your phone to ElevenLabs, under your key, to create the voice. Any verification ElevenLabs requires must be completed there before the voice can be attached to the soul. ElevenLabs keeps the sample and voice model under its account terms until you manage or delete them there; closing this screen or removing a soul does not delete the provider’s voice. Reverbot deletes its local sample when you close, cancel, finish successfully or put the app in the background. If the app crashes, temporary samples older than 24 hours are removed the next time you open the recorder. The resulting voice identifier is kept with the soul and can be reused by other souls on your ElevenLabs account. Samples are not included when a soul is shared or moved; a voice identifier gives its recipient no access to your ElevenLabs account.

Voice Changer. Its effects, and its microphone studio, run on your phone. A recording you make or import there, and a converted one, stay on your phone unless you share or convert them. Converting is your choice, under your own key, after a confirmation that states the price: ElevenLabs receives the recording from your phone and sends the converted voice straight back; Respeecher keeps the recording and the result in a “Reverbot” project in your Respeecher account; for Resemble the recording goes to your own Cloudflare storage, Resemble reads it through a private link that lasts 10 minutes, and Reverbot deletes the file there once Resemble has answered. Each company handles it under its own terms and privacy policy. Live AI conversion, with an account its provider has set up for you, streams your microphone to that provider only while it runs.

Your account

Reverbot uses accounts provided by Google Firebase, and there are two kinds. The first time you open the app it creates an anonymous one for you — no email, no name, nothing you type. It exists so your free allowance belongs to somebody, and it holds your settings and the counters for how much of that allowance you have used.

If you subscribe, you create a real account with Google, Apple or an email address, and we then hold that email and sign-in identifier — and your name, if Apple or Google passes it on — so your subscription and settings follow you between devices. Upgrading keeps the same underlying account rather than starting a new one, so nothing you had is lost. Either kind can be deleted, with its stored data, from inside the app under Settings.

Besides choices like your mode, your voices and your wake phrases, the settings an account holds include what you wrote in Settings → About you — your name, age, birthday, sex, what you do and the rest of that page — Flirt's notes on the person you are talking to, the name, company and job title you show people nearby, and the names of your workspaces, so all of it follows you to another phone and to the web portal. Your sexuality, if you choose one there, is the exception: it stays on your phone and is used to choose the gender of a new Partner or Crush soul and your Flirt rehearsal partner. The fictional partner’s gender goes to its AI; your sexuality does not. So that Reverbot's own AI answers only the real app, your iPhone also vouches for it with Apple's App Attest, and Reverbot's server keeps, with your account, the public key your phone made for that.

Separately, Settings → Google account can sign you in to Google for Google’s own features, such as the free Gemini key. That sign-in is between your iPhone and Google: Reverbot keeps only the account’s email, on your iPhone, to open Google’s pages with it, and never sends it to a Reverbot server.

Your API keys

If you supply one, it is stored in the iOS Keychain on your device and sent only to the provider it belongs to, as authentication. Keys are never transmitted to or stored on a Reverbot server, and they are deliberately left out of the settings that sync to your account.

Support messages

If you write to us through the support and feedback forms in the app, or the contact form on reverbot.ai, we keep your message, your email address and the IP address it came from — and, from the app, its version, your iOS version and your iPhone's model — so we can reply and so we can spot abuse of the forms.

Payments

Purchases — the subscription, and deposits for phone calls — go through Apple's App Store, and Reverbot never sees your card or payment details. Reverbot's server checks Apple's signed record of each purchase, and Apple tells it when one is refunded or withdrawn. The server keeps which account each subscription belongs to, whether that subscription's free questions have been given, and any refund, so that what was paid for reaches the right account, once. Deposits and your balance are kept with your calling account, as described under Phone calls.

Contacts

Reverbot reads your address book on your phone, for three things in its ordinary contact features. Optional Life Journal contact snapshots are a separate permission-based choice described under Life Journal. First, a soul you have allowed to text, email or call someone can do it by name: Reverbot looks that name up in your contacts, on your phone, once you have allowed Contacts access, and puts the number or address into the message, email or call it opens for you to confirm. The number or address stays on your phone; the soul's AI only has the name you said. Otherwise, if you dictate a text or an email it opens the standard iOS message or mail sheet with the words already written and the recipient left blank — you choose who it goes to, in Apple's own interface, and Apple does not tell us who you picked. On a Reverbot-to-Reverbot call, or in a conversation with people nearby, you can choose one contact card to send: Reverbot reads that one card only when you pick it, sends it over the encrypted phone-to-phone link, and adds a card to your contacts only when you save one that was sent to you. No card passes through, or is kept by, a Reverbot server. And in Chat, Find people from your contacts — only if you choose it, and after iOS asks — reads the names and numbers of the contacts you share with Reverbot (all of them, or only some) on your phone, and sends each number to Reverbot’s server as a hash, 200 at a time, only to check which belong to people on Reverbot who switched on “Let people who have your number find you”. The hashes are compared in memory and never stored or logged, and the contacts aren’t saved on your phone either. A hash of a phone number can be worked back to the number by trying every number, so we don’t call it anonymous: what we promise is that it is never kept. Nobody is told you looked, and nobody is invited for you: an invitation goes only if you tap Invite and send the text yourself, from Apple’s Messages. If you switch on Let people who have your number find you (it is off until you do), people who have that number in their contacts see your username when they look — and your name only if they are your friend and you allow it; it uses the number you verified for phone calls, and switching it off takes you out of the lookup at once.

Phone calls

Calls to phone numbers are off until you turn them on. The number you call goes to Reverbot's server as soon as you enter it, to be priced, and again when you place the call: our phone carrier asks the server whether to connect it, then connects it. Your own number goes to Reverbot's server when you verify it — our phone carrier then rings it and asks for the code the app shows you — and again with every call and every time the app loads your calling account, so the server can check that the number your calls show is really yours. Before a call is placed, the app also checks which state and country you are calling from, using your phone's location at about a kilometre's accuracy, to apply the rules for that place: turning the location into a state uses Apple's geocoding service, and the location is not stored or sent to Reverbot.

Just you. Reverbot listens only to you: the other person's voice is played to you and handed to nothing else — not to the AI, not to a recording — and nothing is played or said to them. What you say is handled exactly like any other Reverbot question or translation.

Both of you. When the other person answers, our phone carrier plays them a short notice — on a translation call in their language as well as English — that an AI is helping you on the call (or translating it, or recording and summarising it), and asks them to press 1 to allow it. Reverbot hears them only after they press 1; if they don't, the call goes on as an ordinary call and Reverbot stays off. What they chose — 1, another key, or no key — is kept against the carrier's ID for the call, without their number, for about 13 months on Reverbot's server and on your phone, as the record that they were asked. Once they agree, what they say is transcribed by your phone's speech recognition and sent to Reverbot's AI service to help you, as your own questions are — on a translation call, the sound of what they say, to be translated. A tone plays every 15 seconds while Reverbot is listening. If they say “stop listening”, Reverbot stops for the rest of the call, plays them a tone to say so, and won't listen on calls to that number again; your phone keeps a scrambled form of the number for that, not the number. Nothing of the call is recorded or kept, except with AI Meeting, which tells them it records the call: its recording and summary stay on your phone, like any meeting's.

Your calling account lives on Reverbot's server: whether calls are on, your balance, each deposit's App Store transaction, the number you verified, and each call's time, length, cost and the last four digits of the number — a billing record, not a call log. Deleting your account deletes it too, along with any money left on it.

Calls between Reverbot users

A Reverbot-to-Reverbot call goes between the two phones over an encrypted connection (WebRTC) — directly when their networks allow it, otherwise through a relay server run by our phone carrier, which sees the two phones’ network addresses and passes the encrypted audio on without being able to decrypt it. The audio does not pass through a Reverbot server, and nothing is recorded. To connect the call, a Reverbot server briefly holds the set-up — who is calling whom, and the network addresses the two phones exchange to reach each other. The addresses are deleted the moment the call ends, and the rest as soon as both phones have heard how it ended. If a phone never checks in again (it lost power mid-call, say), what is left of that call is deleted an hour after it was last active, the next time Reverbot's call server is used. Finding a path also sends your network address to a public STUN server (Google's). Anyone with a Reverbot username can call you, and you can decline. Your photo and your contact card reach the other person only if you tick them on the call screen, and travel over that same encrypted phone-to-phone link, never through a Reverbot server. Your name works slightly differently: if you are friends and you have switched “Friends see my name” on, the call's set-up carries it, so it passes through the server the way the usernames do. Your list of recent calls is kept on your phone only, outside iCloud and computer backups, and you can delete any call in it, or all of them. Reverbot’s calls stay out of the iPhone’s own Recents list unless you switch that on in Settings: iOS keeps that list itself, syncs it to your other Apple devices through iCloud, and no app can delete from it.

Video calls and meetings

Voice calls, video calls and video meetings in Chat, and sharing your screen in them, run on the Cloudflare account of whoever starts the call — yours, when you start one. Connecting your account takes a Cloudflare API token you create; it is kept in your phone’s Keychain and used only on your own account: to set up and run your calls and recordings, and — if you use Souls — to keep souls’ photos, videos and scenes in your Cloudflare storage (see Souls). A call’s set-up — who is invited, and what the phones need to connect — travels inside Chat’s end-to-end encryption, through Reverbot’s server like any message. The sound, video and shared screens go through Cloudflare’s servers (Cloudflare Realtime, and its relay when a network needs one), encrypted on the phones in the call with a key only they have, so Cloudflare passes them on without being able to hear or see them; Cloudflare does see the phones’ network addresses and how much data they send, and bills the account the call runs on, under its own terms and privacy policy. Nothing of a call’s sound, video or shared screens passes through a Reverbot server. Sharing your screen shares all of it, through iOS’s own screen broadcast, until you stop — anything that appears on it included, notifications too. Recording. A meeting is recorded only if its host turns recording on. Everyone is told before joining and joins only by agreeing; if recording is turned on during a call, everyone is asked again, and whoever doesn’t agree is left out — their camera and voice aren’t in the recording. The recording is made on the host’s phone and kept there, in protected storage outside iCloud and computer backups, until the host deletes it. For everyone else who was in it, it is encrypted on the host’s phone with a key made for that recording and stored in the host’s own Cloudflare storage (R2), which deletes it after 30 days, or the period the host chose; Cloudflare can’t watch it. The link to it and its key go to each of them inside Chat’s encryption, unless they switched off Receive meeting recordings; the link works for 7 days. A downloaded recording is kept on that person’s phone, in the same protected storage, until they delete it — or, in a chat with disappearing messages, until its message disappears. AI notes. In a video meeting that takes AI notes — everyone is told before joining, and joins only by agreeing — what each person says is transcribed on their own phone by Apple’s speech recognition and sent, inside Chat’s encryption, to the host’s phone, which keeps it as an AI Meeting. From there it is analysed and can be emailed like any AI Meeting (see Meeting recordings); the email says where the recording is, and never carries the recording, its link or its key.

Chat

Chat is end-to-end encrypted with the Signal protocol (X3DH, the Double Ratchet and Sender Keys): a message is encrypted on your phone and can be decrypted only on the phones of the people in the chat. The keys that decrypt messages are made on your phone and never leave it, and each message’s key is used once and deleted, so a copy of an old message can’t be opened later — by Reverbot or anyone else. Reverbot’s server keeps: your phone’s public keys, so others can start a chat with you; each sealed message until the phone it is for collects it, when it is deleted at once — one that is never collected is deleted after 30 days; who each sealed message is from and for, and when it arrived, for that same time, to deliver it; how often your phone sends, for about a day, to stop abuse; which chats you muted, as scrambled codes (hashes) of the other person or the group, only so it sends no notification for them, until you unmute them; and your phone’s notification token, to say “New message”, or “Incoming call” when someone calls you in Chat — the notification carries nothing else, not who and not what. Photos, voice notes and files you send in Chat are encrypted on your phone first, each with a key of its own that travels only inside the encrypted message; the server keeps that sealed copy, which it can’t open, with its size, a checksum and whose storage allowance it counts against — never its name, type or caption — and deletes it 30 days after it was sent, or at once when you delete it for everyone. Photos are sent without their location or other details. Your chats are kept on your phone, in protected storage that is left out of iCloud and computer backups: it can’t be opened while your phone is locked, and once Reverbot has opened it — which it does whenever you use the app — it stays readable, locked or not, until Reverbot is closed, so that messages and calls keep working. The app switcher shows a lock instead of them. Disappearing messages: anyone in a chat can set a timer, which applies to everyone in it, and a message is deleted from every phone in the chat when its timer runs out — counted from when it was sent on the sender’s phone, and from when it was first seen on the others’. Delete for everyone removes a message — its words, or its photo, voice note or file — from every phone in the chat, within a day of sending it. Whatever is deleted, or disappears, is also wiped from Chat’s storage on the phone, not just hidden. No app can stop someone in a chat from taking a screenshot, or copying a message, before it disappears. Our host may keep routine backups of the server for a short time; for messages these hold only sealed envelopes nobody can open. Deleting your account deletes your keys, anything waiting for you, your notification token, the photos, voice notes and files you sent, and every chat on your phone.

Usernames & friends

Every account has a username, stored on a Reverbot server so people can find you — and to anyone who is not your friend, the username is all there is: not your name, not your photo. Friends see your name and your photo only if you switch each on in Settings → Profile; both are off until you do. The name you go by is kept on that server either way, so it is ready when you do; your photo goes up only while friends may see it, and comes down when they may not. The voice display you choose for your profile is kept there too, and only friends see it. Your friends list — who you added and who added you — and anyone you have blocked are stored there too. Deleting your account removes all of it.

Calendar & Reminders

If you enable calendar/reminders sync (off by default), Reverbot creates events and reminders in the system calendars and lists you select, with your permission. Any syncing beyond your device is handled by the accounts you've set up in iOS Settings (iCloud, Google, Outlook/Exchange).

Job documents

Where a document lives depends on how you added it. Added on your iPhone, it stays on your iPhone, encrypted at rest. Uploaded through the web portal, it goes into Google Cloud Storage under your account and stays in that bucket until you remove the upload in the portal or delete your account. Either way the extracted text is held on your device, and the relevant excerpts go to your chosen AI provider only when you ask something that needs them.

Life Journal

Life Journal is off by default and is opened from Settings. Its optional wake phrase, Hey Life Journal Listener, works only after you enable the feature and its wake switch. A chosen soul can conduct a private interview: the session does not read its earlier conversations (a soul switched into listener mode in the middle of a talk is given only the last few lines of that talk) or add to its ordinary logs or canonical profile memory by default. Only if you turn on Retain in Soul and explicitly save the interview is conversational continuity retained for that soul; canonical profile facts still require explicit profile entry, edit, import or recording. Cancelled interviews are not saved. You can also explicitly record a story; saved audio and journal entries are encrypted on your phone until you delete them. This is not ambient recording. Saved audio has an explicit Transcribe on this phone action: it asks Apple Speech permission when tapped and uses supported on-device file recognition, without microphone access or a server fallback. A local draft may be partial and needs review; this transcription action does not send audio to an AI provider.

Starting a listener interview sends its current conversation to the chosen listener AI to produce replies; the private default limits retained Soul history, not this necessary processing. You choose an AI before entry analysis. Only when you request entry analysis or writing — or, once you turn on Organize new imports with AI, once for each photo, video or document you import after that — are the selected text, images or a bounded set of video frames sent to that AI (a video as three still frames, never its sound): directly on your provider key, or through Reverbot to Google on Reverbot’s connection. Speech recognition follows Voice & speech, and the listener’s chosen speech provider receives its reply text as described under The voice. Source categories are off by default. An explicit source action asks for the relevant iOS permission: Calendar events (upcoming and recent, then earlier ones a batch at a time), Reminders, Contacts snapshots, authorized Photos details (when and where each was taken, and a few labels for what is in it, worked out on your phone by Apple's image classifier — the pictures themselves are not copied unless you choose them), a one-time foreground location (read only when you turn it on or tap Refresh, and replacing the one saved before), Places you visit (a history of where you spend time, which needs location permission set to Always: iOS goes on noticing visits while Reverbot is closed, and each waits on your phone, encrypted, until the journal adds it), Motion & fitness (steps, distance, floors and activity time your iPhone counted in the last seven days), or a folder you choose in Files, whose photos, videos, recordings and documents — and those in the folders inside it — are imported a few at a time. Place names for photos and visits are looked up with Apple Maps, which receives the location only. Where it is offered, Journaling Suggestions lets you pick a moment your iPhone noticed, in Apple's own window; only what you pick is added. Drive and Dropbox files must be selected through an installed file provider; Reverbot cannot crawl those accounts or other apps. Only previously enabled, still-authorized categories refresh — while Reverbot is open and, if Background App Refresh is on, now and then in the background while your phone is unlocked — without another permission prompt. Enabled categories save encrypted snapshots in Life Journal for your review, one entry for each source and day. Those daily entries are never sent to an AI by themselves. Motion & fitness data are never used for advertising, never put into a Soul and never stored in iCloud; they leave your phone only inside an encrypted backup or legacy package, or in an entry you approve and then use in a draft. You must approve entries before they are used in drafts or selected legacy packages. There is no SMS reading or full-device search.

Server backup is optional: it runs when you tap Back up, or by itself a minute after your journal changes once you turn on Back up automatically, and it never writes over a backup made on another phone unless you choose Replace. Journal entries and assets are encrypted on your phone before upload, under your account; the server holds ciphertext rather than readable stories, and sees only sizes, versions and when you back up. If you turn on Keep my Journal Soul up to date, each entry you approve is copied on your phone into your Journal Soul — written entries as documents; photos, videos and recordings as its own; never a day of Motion & fitness — and taken out again when you un-approve or delete it; the Soul then follows the Souls section for what reaches its AI. A face someone left you, if you import it, is also added to your face library on your phone. The offline recovery kit contains the actual backup key and is not sealed with a password: anyone with it can read its matching backup, so keep it private. Losing both the local key and recovery kit can make a backup unrecoverable. Local keys and recovery material are bound to the account identifier.

Leaving memories for family is a choice you make person by person. Each package holds only what you choose — selected entries and their media and, only if you include them, your Journal Soul (who it is and what it knows, without your conversations with it, your keys or your voice account), your recorded face and your recorded voice, each only when its recording permits sharing and use after your death — sealed on your phone for that person’s own key, never your whole journal or its key. A package you keep up to date is sealed again after a backup when what it gives changes, until a death is reported. Beside each locked package, Reverbot’s server keeps in readable form the name you chose to show them, your own name for them, their username and, if you give it, their email address, so a gentle notice can reach them — you can give it, or have them told now, only when your own sign-in email is verified, and that address is told when you set memories aside for them (if you asked), when they are released, and if you revoke a package they were told of — whatever notices they chose for themselves; and, while any package waits for someone, your own verified sign-in email, so you can be warned if your death is reported. Someone who turns on email notices for what is left for them has their verified sign-in email kept until they turn notices off. These emails never contain anything from a journal, and the name you chose goes into them without links or numbers. Only someone you chose can report your death, with their name and an official record or a link to one. The report and its record are kept outside the website and seen only by Reverbot’s reviewers — except that you are shown who reported it and how they knew you. The record is deleted when the report closes, or 30 days after the death is confirmed; the report’s other details — the reporter’s name, email and relationship, their words, the place and any link — 30 days after it is decided. You are told at once, by email and in the app, and can stop it; nothing is released until two independent reviewers confirm the death and the waiting period you chose, 7 to 365 days, has passed with no veto. Inactivity alone never releases anything. Account authentication, encryption and hash checks reduce risk; they are not a promise of unbreakable security or independent verification of a recipient’s identity. A recipient’s secret recovery file is bound to the relevant account identifiers. What someone leaves you is kept apart in your own encrypted journal. A Soul brought in from it is an AI that speaks as them from what they left, never the actual person, and Reverbot says it is an AI at the start of every talk. Their voice is recreated only if you choose it, by uploading their recording to ElevenLabs on your own account; a cloned-voice identifier never gives access to anyone’s ElevenLabs account.

Souls

Souls are AI personalities you create. Everything about a soul — its personality and story, its life events, the documents and facts you give it, its memories and journal, its photo and every conversation with it — is kept on your phone, and leaves it only in the ways below.

When you talk or chat with a soul, what you say goes to the AI chosen for that soul, with what it needs to answer: its personality, the parts of its story, memories and documents that fit, lines from your earlier conversations with it that fit, the recent conversation and — once you've let that soul read your bio — every soul starts out knowing nothing about you and asks first, and you can say no — your name and what you wrote in Settings → About you. A soul you make your assistant also sees your tasks, reminders, calendar, notes and lists, to help with them. With your own key for that AI (xAI Grok, OpenAI, Anthropic Claude or Google Gemini) the request goes from your phone straight to that company; on Reverbot's AI it goes through Reverbot's server to Google, as described under AI providers. Ordinary conversations are retained on your phone for continuity and may be sent to that AI once more to summarize the conversation and update mood, relationship and personality growth. They do not silently change canonical biography, profile facts, portraits or self-narrative, or create freeform biography journal entries. Canonical facts are added only through explicit profile entry, edit, import or recording in the profile. Documents you add — books, PDFs, Word, Excel, PowerPoint and text files, read into text on your phone — with anything you ask it to take from them, are sent to that AI, or to another AI you choose for them on the soul's Documents screen, to write the soul's profile, once each time you tap Study and after you're told what it uses; building a soul from your description, or generating one, sends your description or your choices.

Talking out loud, your words at each pause also go to the check for when you've finished (above). A soul's voice is made by the voice you chose for it: Apple's voice on your phone, Reverbot's voice, or a voice service you added a key for (ElevenLabs, OpenAI, Gemini, Google or xAI), which receives the words the soul says — and, for OpenAI's and Gemini's voices, a line on how the soul sounds: its name, age, gender, where it's from, its way of talking and, with Realism on, its mood.

Each soul is one of a kind, so moving one out takes it off your phone, and everything it has learned goes with it. Moving a soul to a file seals the whole soul — its personality, memories, journal, documents, the photos and videos you showed it, the scenes of its world and every conversation with it — with encryption into a .soul file, which you save or send yourself; anyone who has the file, and its password if you set one, can bring the soul into Reverbot. Sending a soul to a friend on Reverbot seals it the same way — with its photos, videos and scenes only when they're in your Cloudflare (below) — and with a key only your phone and your friend's can work out, from your two Chat identity keys, so Reverbot's server can't open it while it waits; then it uploads it to Reverbot's server, where it waits until your friend adds it; if they turn it down, or don't add it within 30 days, it comes back to you, and waits under Souls sent to you until you add it back or delete it. Whoever a soul moves to sees only their own conversations, memories, journal and photos with it in the app; what it learned with you stays inside the soul as its memories of you, and it can talk about you as someone it lived with before. A soul also keeps a record of everyone it has lived with: the name it knew each person by, when, where things stood between them, and a scrambled marker of each account and phone, so it knows someone again if it comes back to them; that record, with what it learned of each person, travels inside the soul. So that only one copy of a soul can ever be brought in, Reverbot's server keeps a record of each soul that has been moved: its identifier, which account moved it out and which brought it in, and when, and half of each file's key — never the soul itself or its password. The first import is given that half; every other copy of the file then can't be opened. A soul your friend reports is removed from their inbox and kept for review, with the key to open it sent by their phone, and Reverbot's support address is told who sent it and why. Deleting your account removes the souls waiting for you and the ones you sent that were never taken.

If you've connected your own Cloudflare account (see Video calls and meetings), the photos and videos you show a soul, the scenes of its world and the faces they're made with are also kept in your Cloudflare storage (R2), each encrypted on your phone with a key of its own first, so Cloudflare can't see them — and so are those someone it lived with before showed it, which it keeps but you aren't shown; they stay there until you delete them, or the soul. When such a soul moves, it takes the list of them and their keys instead of the pictures themselves, and whoever it moves to fetches them from your Cloudflare with links that work for 7 days. After that, for up to 60 days after the soul was taken, their phone can ask for fresh links: your phone leaves them on Reverbot's server the next time you open Reverbot, sealed so only their phone can read them, and Reverbot's server keeps only the move they're for, a fingerprint of a secret your phone keeps for that move, when they were asked for and sent, and the sealed links until everything has been fetched; a record nobody touches for 120 days is deleted. Your copies are deleted once they have everything, or 60 days after the soul was taken; a file nobody has opened keeps them, as it may be a backup, until you let them go in Souls settings › Files not opened yet. Without Cloudflare, a file carries as many photos, videos and scenes as fit, and a soul sent to a friend goes without them. Deleting your account also deletes, from your Cloudflare storage, the photos, videos and scenes of the souls on your phone and of souls you moved out — whoever has those now keeps what they've already fetched.

Souls: their look

A soul's character is drawn on your phone from artwork that comes with the app, so is an orb. A photo you choose for a soul is kept on your phone; if you make an AI scene with it, it goes to BytePlus with your agreement. A shared soul can carry its look, and connected Cloudflare storage holds encrypted copies of its media. Making a character with AI sends your description, or the soul's details (gender, age, where they're from, job, appearance and summary), to the soul's AI as described above, once each time you ask, and the app tells you what that request uses first.

An AI picture is made by Seedream, ByteDance's image AI, on your own BytePlus account: your description — and a photo, if you add one — goes from your phone straight to BytePlus (ByteDance's cloud), in the region your key belongs to — Asia Pacific or Europe — under your API key, and the picture it sends back is kept on your phone. BytePlus bills you for it and handles what it receives under its own terms and privacy policy; none of it passes through Reverbot. Your BytePlus key is kept in your phone's Keychain and sent only to BytePlus; signing out removes it.

Personal faces

A face you record — your own, or that of someone who gives their permission on camera — is kept on your phone, encrypted, with the permission recording, and leaves it only in the ways below. It talks for free: the mouth and jaw are found on the portrait by Apple’s face detection, on your phone, and moved there as the words are spoken. A realistic paid animation is a separate choice, on your own account with that company and under your own API key, which is kept in your phone’s Keychain and sent only to that company; the app shows the cost and the company’s terms before anything is uploaded. With Anam, for a live face, the portrait goes to Anam once, to make the face, and the voice of each sentence goes to it while the face is connected; Anam’s session recording is turned off, its terms let it use these only to provide the service to you and never to train AI models, and you can delete the face from Anam in the app, also when you remove the face. With Simli, for a clip of each sentence, the portrait goes to Simli to make the face, and the voice of each sentence it animates, under terms that give Simli broad, continuing rights to what is uploaded, including training; a Simli copy is managed in your Simli account. The permission recording and your Life Journal are never sent to either, none of it passes through Reverbot’s servers, and each company bills you for it and handles what it receives under its own terms and privacy policy. A face goes into a Life Journal legacy package only when its recorded permission allows sharing and memorial use and you include it; whoever receives it chooses whether to bring it in, and keys and paid animation never go with it. Removing a face deletes its record and recording from your phone, and deleting your account deletes them all, keys included.

Souls: scenes from their world

When you tap Show me, what the soul said goes to the soul’s AI as described above, with its personality, its appearance and the people in its made-up life, once, to write the scene; the app tells you what that request uses first. The video is made by Seedance, ByteDance’s video AI, on your own BytePlus account: the scene’s words and the pictures of the faces in it go from your phone straight to BytePlus (ByteDance’s cloud), in its Asia Pacific region, under your API key — the soul’s face (its picture, once you’ve said it’s AI-made or an adult who agreed, or a face BytePlus’s Seedream makes once from the soul’s description, which is sent there to make it) and the faces of people in its world (each made once by Seedream from a description). The video comes back to your phone and is kept there, with the faces, until you delete it or the soul. Nothing of you is ever in a scene: not your face, and not your name. BytePlus bills you for it and handles what it receives under its own terms and privacy policy — it says anything its safety filters flag is kept for 180 days — and none of it passes through Reverbot. Your BytePlus key is kept in your phone’s Keychain and sent only to BytePlus; signing out removes it.

Souls: recordings, and each other

Recording about a soul. What you say into a soul's record button is transcribed by Apple's speech recognition, as above, and no audio is kept. The words are kept on your phone with that soul. When you tap Add, they go to the soul's AI as described above, to be sorted into facts and moments in its life — once, and the app tells you what that request uses first; the words also come back to the soul, like its documents, when they fit what you're talking about. A soul you move out — to a file or to a friend — takes its recordings with it. Photos for memories. A photo you show a soul is kept on your phone with it, shrunk to 1600 pixels, until you delete it. Once, when you add it — or when you ask it to look again — the photo and what you said about it go, with the soul's summary and story (and your name, once you've let it read your bio), to the AI that studies that soul's documents: straight to that company on your own key, or, on Reverbot's AI, through Reverbot's server — which doesn't store it — to Google, as described under AI providers. What the AI saw, and what the soul remembers of it, are kept on your phone. A soul you move out — to a file or to a friend — takes the photos with it through your Cloudflare, if you've connected it (see Souls); without Cloudflare, a file carries as many as fit, and a soul sent to a friend takes only what it remembers of them.

Videos for memories. A video you show a soul is kept on your phone with it, at 960 by 540 pixels, until you delete it. Once, when you add it — or when you ask it to watch again — the video and what you said about it go the same way to the AI chosen on the soul's Photos & videos screen. On your own Twelve Labs key, Twelve Labs (a video AI) watches it: the video goes from your phone straight to Twelve Labs, and a longer one is uploaded to your Twelve Labs account and deleted from it as soon as it has been watched. Twelve Labs bills you for it and handles what it receives under its own terms and privacy policy; none of it passes through Reverbot. Your Twelve Labs key is kept in your phone's Keychain and sent only to Twelve Labs; signing out removes it. On your own Gemini key, the video goes straight to Google. Any other AI is sent twelve frames of it in one picture, with what was said in it, transcribed on your phone — none of the sound leaves it. When a video is too big for that AI, a smaller copy made on your phone is sent instead. What the AI saw, and what the soul remembers of it, are kept on your phone. A soul you move out takes the videos with it the same way: through your Cloudflare if you've connected it; without it, a file carries those it has room for, and a soul sent to a friend takes only what it remembers of them.

Souls getting to know each other. When two souls talk, each line is written by the speaking soul's AI with what it needs: its own personality, what it remembers of the other soul, and the conversation so far — not what you told it about yourself, nor its memories of you. Afterwards the conversation goes to each soul's AI once more to update their relationship. Their conversation transcripts and bonds are kept on your phone; this does not add canonical biography facts or freeform profile journal entries. The last lines of their conversation also go to the check for when a conversation has wound down (Knowing when you've finished, above). Forget each other removes all of it from your phone, and what souls remember of each other never leaves it inside a soul you share. Realism. With Realism on for a soul, while you're away its AI is sent its personality, the life you've set for it, its usual week and what has happened in it lately, a summary of your last conversation and how it has been feeling, to make up what it did meanwhile; what comes back is kept on your phone as separate fictional life-event records and moods, not canonical biography memories or a newly generated profile routine, and none of it happened. Its feelings, how long each will last, and anything still unresolved between you come back with its reflections and stay on your phone; its mood of the day is chosen by chance on your phone and sent nowhere. On a call, once it has noticed you're talking to someone else in the room, what you say to them is not recorded and not sent to its AI — only to the check above.

Souls: AI notice & crisis protocol

A soul is always an AI, not a person. Reverbot says so — written in a chat, and on a call in a banner across the top of the screen that goes by itself — at the start of each day's first conversation with a soul and again after every three hours of talking, whatever the soul is set to believe about itself. Every soul's page says so too, at all times, and a soul says it is an AI whenever it is seriously asked.

Crisis protocol. If what you say to a soul suggests you may be thinking about suicide or hurting yourself, Reverbot — in its own words, not the soul's — points you to help: call or text 988 in the US and Canada, findahelpline.com for a free helpline anywhere else, and your local emergency number (911 in the US and Canada) if you are in immediate danger. The soul steps out of character to respond with care and point you to that help. This is recognised from your words on your phone. Reverbot counts on your phone how many times the crisis line has been shown — only the number, for the yearly reports California's companion-chatbot law asks for from 2027.

Souls are companions — not therapy, counseling or medical care, whatever title a soul is given. Companion chatbots may not be suitable for some minors: Souls is for adults 18 and over, and asks you to confirm your age before it opens. A soul under 18, or one based on a real person, never engages in adult talk.

Home control (Google Home)

Home control is off until you connect it, and connecting is something you do once, under Google Home & locations in Home Control’s settings. When you do, Google asks which home Reverbot may control and you grant it there; Reverbot never sees your Google password, and the access token Google returns is held in your iPhone’s Keychain. You can revoke it at any time, either with Disconnect Google Home in the app or from your Google account’s permissions page.

What Reverbot reads through Google’s Home APIs is the structure of the home you chose — its name, its rooms, the devices in them, their names and their current state (on or off, brightness, lock status, temperature, and so on) — together with the automations you have set up. It reads them for one purpose: so that when you say “turn off the kitchen lights” it knows which device you mean and what to send it. What it writes back is the command you asked for, and nothing else.

Matching what you said to a device normally happens on your phone: a parser on the device takes “turn off the kitchen lights” and resolves it against the list it already holds, and nothing leaves. When that parser cannot place a sentence — “it’s dark in here”, “make the bedroom cosy” — the sentence is sent to an AI to be turned into one action, and with it go your device names, what kind of device each one is, the rooms they are in, and the names of your automations. Their current state is not included. If you have supplied your own API key that request goes from your device straight to that provider; otherwise it goes over Reverbot’s own connection, exactly as described under AI providers above, and Reverbot’s server does not write it to a database.

Nothing Reverbot reads from your home is used to train any model, and none of it is sold or shared with anyone else. Reverbot does not keep a copy of your devices off your phone. Disconnecting removes the access token and the cached list of your devices from the phone. Signing out of Reverbot, deleting your account, or somebody else signing in to Reverbot on the phone disconnects it in the same way.

Notifications

Reminders you create, missed-call notices, and messages and waves from people in a meeting are local notifications on your device. Two things do go through a push server. So that a Reverbot-to-Reverbot call can ring your phone while the app is closed, the app registers a VoIP push token with Reverbot's server, which asks Apple's push service to wake the app when a call comes in. The push carries the call's ID and the caller's username, plus the name they show friends if you are friends and they allow it. And Chat registers an ordinary notification token, so that Reverbot's server can have Apple show “New message”, or “Incoming call” — nothing else (see Chat). Each token identifies your device to Apple, not you; it is kept only while your account exists and is deleted with it.

Analytics & tracking

Reverbot does not use advertising or attribution SDKs, an advertising identifier, or an advertising profile of you. The Twilio Voice SDK sends API-usage and WebRTC call-quality diagnostics to Twilio Voice Insights for post-call quality analysis and debugging. Its privacy manifest declares these diagnostics as not linked to your identity and not used for tracking. We do not sell your personal information or share it for advertising.

The website's front page counts how many times each of its links is clicked, and how many different people clicked each one that day. To tell that day's visitors apart, and to stop any one of them flooding the count, it uses a scrambled form of your network address, made with a random key of that day's own. When the next day's counting starts, the key and the day's scrambled addresses are deleted, and from then on they cannot be turned back into anyone's address; only the totals are kept. No cookie is set and nothing is stored in your browser.

The website and its API run on Google Cloud. To maintain private visitor statistics and distinguish automated traffic, the server records the network address, time, request method, page path, response status and size, and browser identifier. The statistics log excludes query strings, authentication headers, cookies, referring URLs and request bodies. Raw statistics logs are kept for about seven days; the private monthly statistics retain network addresses to distinguish visitors across months. These are website traffic records, not the contents of your questions, answers or recordings.

During the hosting transition, a visit may still pass through the previous GoDaddy host. GoDaddy may inject its own traffic-measurement script into pages served there; it is on the website only, never in the app, and is not included on the Google Cloud site. Some transactional emails continue to use the existing GoDaddy mail transport during the transition.

Voice characteristics & retention

When a mode needs to tell speakers apart, Reverbot works out whose turn it is to speak so it knows when to help. It does this from moment-to-moment acoustics — how loud the audio is and how its energy is distributed — held in a small fixed buffer that is overwritten continuously and cleared when the session ends.

This speaker-turn tracking does not create a voiceprint, enrol, model or store anyone’s voice, recognise a person by their voice, or tell whether two conversations involved the same person. Nothing derived from this tracking is written to disk, transmitted or used to identify anyone. Optional voice cloning sends a sample to ElevenLabs only when you choose to create a voice, and Voice Changer sends a recording to the provider you pick only when you choose to convert it, as described under The voice. Our retention schedule for speaker-turn tracking data is the session itself: it is destroyed when the session ends, and in all cases within 24 hours. We do not sell, lease, trade or otherwise profit from it.

Children

Reverbot is for adults 18 and over. It asks you to confirm you are 18 or older before its first answer — the AI services it runs on require it — and Souls, its AI companions, asks again before it opens. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.

Your control

You can remove your keys in Settings, revoke Microphone, Speech Recognition, Location, Contacts, Calendar, Reminders, Camera, Photos and Local Network access in iOS Settings at any time, delete your account and everything synced to it from Settings inside the app, delete any soul — and with it everything it knows and every conversation with it — from the Souls screen, and remove what the app keeps on your phone by deleting it — except what iOS holds in its Keychain, which outlives the app: your API keys and your sign-in, which is how a reinstall comes back to the same account. Signing out first, or deleting your account, removes those as well.

Changes & contact

This policy is provided by Reverbot LLC, which makes the Reverbot app and runs reverbot.ai. We may update this policy as the app evolves; material changes will be reflected here. Questions? Email support@reverbot.ai.