Privacy Policy

1. Who operates Ada

Ada is operated under the Vairever brand. This policy explains how information is handled when you use Ada and related services.

2. Local-first processing

Ada uses Whisper on your device to turn speech into text. Optional cloud cleanup processes transcript text as described below. Audio is not sent for cloud cleanup. Dictation audio, transcripts, nearby text, personal vocabulary, and learned context are not sent to analytics providers.

3. Account and cloud data

If you create an Ada account, Ada Cloud may process account identifiers, email-verification and authentication records, registered-device metadata, entitlement state, encrypted sync objects, and operational records needed to provide the service. Personalisation sync is designed so the cloud stores encrypted material rather than plaintext personal context.

Optional cloud cleanup and rewrite previews

Cloud cleanup is off by default. If you turn it on, Ada sends the current English dictation transcript through Ada’s backend to Microsoft Azure for text cleanup using GPT-5.4 mini in Azure’s United States Data Zone. Only the current transcript is sent as dictation content. Cloud cleanup does not send audio, dictation history, nearby text or personalisation data. It does not upload earlier dictations or scan saved history.

If you have enabled cloud cleanup, you can separately request a Formal or Casual rewrite preview for the current English draft you are editing in Ada. Requesting the preview sends that draft through Ada to the same Microsoft Azure service for rewriting. Rewriting starts only when you request a preview. You choose whether to apply the result in Ada, and can undo that change. Rewrite previews do not scan your clipboard, saved history or text in other apps. The cloud-cleanup data handling and retention described here also apply to rewrite previews.

Cloud cleanup is separate from optional encrypted personalisation sync. Ada’s backend and Microsoft Azure process the transcript text for cleanup; the end-to-end encryption used for personalisation sync does not apply to this processing.

Personal learning in Ada is separate from shared model training. Ada does not pool dictation transcripts or cleanup responses to train a shared model. Microsoft states that prompts and responses are not used to train its generative AI foundation models without permission or instruction.

Microsoft may retain and review prompts and responses for abuse monitoring, including review by authorised personnel. Disabling model-response storage does not remove this separate abuse-monitoring process. See Microsoft’s data privacy documentation and abuse-monitoring documentation.

4. Product analytics

Product analytics is off by default. If you allow it, Ada sends a closed set of content-free usage events to PostHog. These describe app and screen activity, setup and permissions, feature operations, dictation stages and outcomes, coarse duration and capture-quality categories, and fixed failure labels. They include the platform and app version, random event identifiers, event times, and a random analytics identity. Audio, transcripts, nearby text, names, email addresses, account and device-security identifiers, raw errors, clipboard contents, and application titles are not included. Ada disables person-profile creation and geolocation enrichment for these events. There is no session replay, screen recording, or automatic capture of everything you click or type.

Optional measurement across devices

In Ada 0.1.17, “Connect usage across devices” is a separate choice that requires product analytics to already be on. If you allow it, Ada assigns a random analytics ID to your account and sends that ID to PostHog so opted-in usage across logins and devices can be measured together. The ID is not your account ID or a value derived from your name, email, or security device ID. This is pseudonymous measurement: Ada keeps the private link to your account while this consent remains valid. It does not retroactively join your earlier browser or installation identities.

With this additional choice, verified billing and entitlement events may also be measured using the same random analytics ID. These contain only the fixed billing-provider label, a verified payment/refund outcome, or the previous and new entitlement-status categories. They do not contain prices, amounts, payment methods, payment-provider customer or transaction IDs, or buyer details. A checkout button, a browser completion screen, or an active entitlement is not treated as proof that payment was captured.

Turning off account-linked measurement removes the account-to-analytics-ID link and pending account-linked events. Turning off the main product-analytics choice also withdraws this additional choice. A later opt-in creates a new ID and consent generation. Signing out clears the app’s local account identity; it does not withdraw an account-level choice that remains enabled on your other devices. Requests already sent cannot be recalled, and stopping collection does not itself erase events already received by PostHog.

Optional website measurement

A separate choice near the page footer controls website measurement. It stays off until you allow it, and the measurement runtime is not loaded beforehand. Basic website measurement sends fixed page and selected-link labels, the website version, random event identifiers and times, and a random browser-only ID. This ID is not joined to your Ada account or installed app.

Where expanded website measurement is available, a new explicit Allow is required for source/campaign categories and checkout-interface states. Existing basic website choices keep their original scope. Only exact approved source, medium and campaign labels are used; unknown values become an “unknown” category. After this consent, the current query and referring page are classified locally. Raw URLs, query strings, referrers, page text, provider payloads, account details and payment details are never sent to PostHog or saved as attribution data.

Only those fixed first-source/current-source categories, the existing consent generation, and bounded timing information are kept in this tab’s session storage. The journey is no longer used after 24 hours. An expired record is cleared or replaced on the next measured page visit, when you turn measurement off, or when the tab session ends; a tab left open without another visit can retain an expired record for longer. The current source is refreshed by a new campaign/referrer arrival or after 30 minutes without a page observation. Turning website measurement off removes its ID and attribution record, stops new events and invalidates old consent. Browser storage restrictions can prevent measurement or require you to clear the site’s storage. This website choice does not change the Ada app’s analytics preference.

Optional website measurement is available only with your explicit consent. Ada 0.1.17 supports optional content-free product analytics. Account-linked measurement and eligible backend product events require the separate “Connect usage across devices” choice as well as product analytics consent. Existing choices are not expanded automatically.

5. Crash diagnostics

Ada may send essential content-free crash signals to PostHog whether or not optional product analytics is enabled. Crash signals exclude transcripts, audio, screenshots, stack traces, exception text, breadcrumbs, account identity, and application content. Pending local crash markers are bounded and expire after 30 days.

6. Billing

Paid purchases are processed by Paddle, which acts as Merchant of Record. Paddle handles payment information, taxes, invoices, payment methods, and related buyer support under its own terms and privacy notices. Ada does not receive your full card details.

7. Email delivery

Ada may use Azure Communication Services to deliver account-verification and password-reset emails. The service receives the information needed to deliver those messages.

8. Retention

Account and operational data is retained only as needed to provide, secure, and administer Ada, meet legal obligations, resolve disputes, and enforce agreements. You may request account deletion through Ada when that functionality is available to your account.

For optional account-linked analytics, the current choice and its revision are retained until account deletion. The random identity and consent generation are removed on withdrawal. Pending server events are limited to 1,000 per account, become ineligible for delivery after seven days, and are removed during collection, delivery or daily maintenance. Delayed maintenance can delay physical removal. Content-free duplicate-prevention digests are limited to 10,000 per account for the current consent period, and are removed on withdrawal or account deletion. They remain after an event is sent so repeated billing notifications are not counted again. Optional analytics events are stored in PostHog’s EU Cloud. Our current plan provides one year of event history for analysis. This does not guarantee that older events are deleted at the end of that year. The local limits above do not describe deletion of events already received by PostHog.

For optional cloud cleanup and rewrite previews, Ada keeps these content-free records:

• Consent: your account, choice, disclosure version, revision and timestamps. The current record is kept until account deletion.
• Requests: your account, a random request identifier, consent revision, processing status, token allowance, reserved and settled cost, creation time and expiry. Records become eligible for deletion after 24 hours. New request admissions and a daily maintenance job remove eligible records. With no new requests, records may remain for about 48 hours if maintenance runs as scheduled.
• Daily costs: account and service-wide totals for the current and previous UTC day, until the next daily maintenance run. This can amount to about three days.
• Total service cost: a cumulative total kept to enforce Ada’s spending limit. It contains no transcript content or account association.

Account deletion removes account-linked consent, request and daily-cost records. The cleanup database does not store transcripts, cleanup responses, source-text hashes, provider response bodies, prompts or session tokens. Source-text hashes are used transiently to validate requests and responses. Microsoft’s separate abuse-monitoring practices are described in section 3.

9. Your choices

• Cloud cleanup requires a separate choice in Ada and can be turned off in Settings. Turning it off stops new cleanup requests. Requests already sent cannot be recalled, and turning it off does not delete records Microsoft may retain for abuse monitoring. Rewrite previews require a separate request after the rewriting disclosure is shown.
• Optional product analytics can be turned off in Ada. When website measurement is available, use the separate choice near the page footer to turn it off.
• You can manage account and security settings in Ada.
• You can contact Vairever for privacy or product-support questions at support@vairever.com.

10. Changes

This policy may be updated as Ada evolves. Material changes will be reflected on this page with a new effective date.