What iHertz keeps, and who hears it.
iHertz is a public band of strangers’ voices. It is built so that nobody on it knows who you are, and so that we keep as little about you as a voice service can. This page says exactly what that is: what is kept, where, for how long, who can hear what, and what happens when you leave.
iHertz is run by Vu Tran, in Vietnam (“we”), who is responsible for the data described here. Questions about anything here go to hello@ihertz.app.
The short version
- We never keep your name, email address, photo or phone number. Signing in with Google or Apple leaves us one thing: an identifier that tells your account apart from everybody else’s.
- You get a handle you did not choose and cannot change.
- What you record for the band is meant to be heard by strangers. An answer or a reply is heard only by the one other person in that conversation.
- No advertising, no analytics or tracking in the app, and nothing sold. We do not collect your location or your contacts.
- Deleting your account currently hides it rather than erasing it. The detail is below, and you can ask us to erase what you recorded.
What we keep
Your account
- Which sign-in provider you used — Google or Apple — and the identifier it gives your account. The provider sends us a signed token; we check it, keep that identifier, and keep nothing else that is in it.
- Your handle, drawn at random the first time you sign in, and when the account was made.
- Which policies you accepted — the terms, this policy and the voice-data notice — which version of each, and when.
- Whether the account is active: when you left, if you did, and whether a moderator has deactivated it.
What you record
- The audio of every signal you publish and every answer or reply you send.
- For a signal: the title you give it, its length, its waveform (a small outline of how loud it is from moment to moment, which is what the dial draws), its frequency (worked out from the audio itself — nobody chooses it), its size, when you published it, whether it is on the band, and that it is yours.
- For a conversation: which signal it answered and who the two people in it are; for each turn, its audio, length, waveform, size, when it was sent, and when the other person heard it; and how many turns the conversation has left.
That a recording is yours is kept on our servers, where it is needed to count your storage and to carry replies back to you. It is never sent to anybody listening: nothing on the band says who made a signal.
While you listen
- The signals you have muted or reported, so you do not come across them again — and your own, so the dial does not offer you to yourself.
- When you are signed in, the stretch of band you are on, held for about ten minutes so it is still there when you come back to it. Nothing like this is kept for anybody who is not signed in.
Reports and moderation
- When you report a signal: that you reported it, the reason you gave, and when. Moderators see the reasons and how many reports there are; they are not shown who made them.
- Every moderator action — including every time a moderator listens to a reported recording — is logged: who did it, what, to which signal or account, and when. That log is never edited or deleted.
Your phone
- On the phone itself: a session token, kept in the iOS Keychain or Android’s encrypted storage, which keeps you signed in for up to 30 days; and a note that you accepted the policies, so the app does not ask twice.
- If you allow notifications, the push token your phone issues for iHertz and which platform it is, so we can tell you when somebody answers your signal or it is your turn. A notification says only that — never what was said, its title, or who said it. Signing out or deleting your account removes the token.
Your connection
- Your IP address is used to limit how often requests can be made, so nobody can flood the band. When you are not signed in, the count is kept against that address; when you are, against your account instead. A count lasts as long as the window it counts — a minute to an hour — and is then swept away.
- Like any website, our servers see the requests they answer — the address a request came from, when, and what it asked for — and our hosting provider keeps logs of them for up to seven days, which we use to find and fix faults.
Money
iHertz sells nothing today, and collects no card, bank or payment details.
What we do not collect
Your name, email address, photo, phone number, location, contacts, photos or advertising identifier. The app carries no advertising and no analytics or tracking code. The microphone is used only while you are holding the record control.
Your voice
A voice is personal data even with no name on it: it can be recognised, and a recording can carry names, places and anything else the microphone picks up. iHertz records only while you hold the record control, and only what you then choose to publish or send leaves your phone. Check what is around you before you record, and do not record anybody who has not agreed to it.
Who can hear what
- A signal on the band can be found and played by anybody using iHertz, signed in or not, for as long as it is on the band. It carries its title, length and waveform, and nothing that says who made it.
- A signal’s link on ihertz.app shows its title and waveform to anybody who opens it, and whoever holds the link can reach the recording while the signal is on the band.
- An answer or a reply is heard by one person: the other person in that conversation. Only the latest turn plays; once somebody speaks again, the turn before it stops playing. Whoever sent a turn can see whether it has been heard.
- Your handle is the only name iHertz attaches to you. The account you signed in with is never shown to anybody.
- Moderators — people we authorise to deal with reports — can listen to a recording only after somebody has reported it, and every listen is logged. They see a reported signal’s title and details and the handle of the account that posted it, so that they can act on that account.
- Cloudflare, our hosting provider, stores and serves all of it on our behalf. Google or Apple handle signing in under their own privacy policies, and so learn that you signed in to iHertz.
- Nobody else — unless the law requires us to disclose something, and then only what it requires.
Anybody who hears a recording can remember it, and could record it on another device. Nothing can prevent that, so do not say anything on iHertz you could not stand to have kept.
Where it is kept
Everything iHertz keeps is held by Cloudflare: account, conversation and moderation records in its database, recordings in its file storage, and short-lived state — such as the stretch of band you are on — in its cache. Cloudflare runs a global network, so your data may be stored or processed outside the country you live in. Everything travels between the app and our servers encrypted.
Notifications are delivered through Google's Firebase Cloud Messaging, and on an iPhone onward through Apple's push service. They carry your phone's push token and the words of the notification, and nothing you recorded.
When the app crashes, a report of what went wrong — the device model, the system version, and the part of the app that failed — goes to Google's Firebase Crashlytics, so it can be fixed. It carries no recording, no title, and nothing that names your account.
How long we keep it, and leaving
iHertz keeps what you make until one of these removes it:
- Taking a signal off the band (Take off, on your shelf) stops anybody finding it at once. The recording itself is kept: it stays on your shelf and still counts against your storage.
- Erasing a signal (Erase, on your shelf, once it is off the band) deletes it and its recording for good. One that somebody reported waits until a moderator has dealt with it.
- Deleting a conversation, which either person in it can do, erases the conversation and every recording in it, for both of you, at once.
- Earlier turns in a conversation stop playing as soon as somebody replies, and their recordings are deleted then. A turn that was reported is kept for the moderators instead.
- A signal a moderator removes has its recording erased. A record that it existed, with its title and waveform, is kept and marked as removed.
- Reports are kept, unless a moderator dismisses them, which erases them. The moderator log is kept for good.
- Rate-limit counts last a minute to an hour.
- Deleting your account (Delete account, on You) erases it at once: your signals and their recordings, every conversation you were in and every recording in it — for the other person too — your handle, and the sign-in identifier that linked your Google or Apple account to it. It cannot be undone; signing in again starts a new account. A signal or turn somebody had reported is kept for the moderators to deal with, and nothing else.
If you cannot get into the app to delete your account, write to hello@ihertz.app with your handle and the title of one of your signals, so we can tell the request is yours. We will delete it the same way within 30 days and tell you when it is done.
Why we keep it
To run iHertz — to put your signals on the band, carry your conversations and keep you signed in — and to keep it safe: limiting abuse, acting on reports, and keeping a record of what moderators do. We do not use any of it for advertising, we do not sell it, and we do not use your recordings to train anything.
If you are in the European Union or the United Kingdom, the law asks for the basis of each use. Running iHertz for you is necessary to provide what you signed up for (contract). Limiting abuse, acting on reports and keeping the moderators’ log are our legitimate interest in keeping iHertz safe for everybody on it.
Your choices and your rights
- You can listen without an account. One is asked for only when you record, answer, or open what has come back to you.
- You can mute or report any signal, take your own signals off the band, delete any conversation you are in, sign out, and leave.
- Depending on where you live, you may have the right to see the data we hold about you, to correct it, to have it erased, to object to how it is used, or to take a copy of it with you. Write to hello@ihertz.app to use any of them. You may also complain to your local data-protection authority.
Under 18
iHertz is for adults. You must be 18 or over to have an account, and we do not knowingly keep anything from anybody younger. If you believe somebody under 18 is on iHertz, report what they recorded or write to us, and we will deactivate the account and remove what it published.
Changes
When this policy changes, the date at the top changes with it. If a change affects what we keep or who can hear it, we will say so in the app before it applies.
Contact
hello@ihertz.app. If it is about your account, include your handle.