Unspoken — Privacy Policy
Last updated 10 August 2026. This is the first published version.
Unspoken is a mental wellbeing app. What you write in it is some of the most personal information you have, and the law treats it as a special category. This page says exactly what happens to it — not in general terms, but named thing by named thing.
The short version. Most of what you write — every check-in, your plan and habits, your chat history, and anything you type inside a training exercise — is stored only on your phone and is never uploaded to us. What we do hold on a server is your account, your optional profile, and your subscription status. We run no analytics, we show no ads, we sell nothing to anybody, and nothing you write is used to train an AI model. Two things in here will surprise people and are worth reading in full: the Android backup and your profile picture.
1. Who is responsible
Unspoken is made and operated by WLF Tech, Hurghada, Red Sea Governorate, Egypt. For data-protection purposes WLF Tech is the controller of the information described here. You can reach us at info.wlftech@gmail.com, and that address is the one to use for every request in section 11.
2. What stays on your phone and is never uploaded
These live in the app's own storage on your device. We have no copy and no way to read them, and no feature of the app sends them anywhere:
- Your check-ins — mood, intensity, and any note you attach.
- Your plan, habits and habit history.
- Your chat history with the companion. The app keeps roughly your most recent 50 conversations on the device; there is no server-side copy of a conversation.
- Anything you write inside a training exercise. Several exercises invite you to write something and then throw it away; that promise is real, and the text is not saved even locally.
- Your date of birth, which the app asks for once to check your age, and your consent choices.
- Your app-lock PIN, stored as a one-way digest in the device's encrypted keystore. It cannot be read back, by us or by anyone.
If two people share a handset, each account's data is stored separately and neither can see the other's.
3. What we store on our servers
The app uses Google Firebase. The following is what exists there.
| What | Why |
|---|---|
| Your account — email address, a password that Google stores hashed and that we never see, whether your email is confirmed, when the account was created and last used. If you sign in with Google, the identifier Google gives us instead of a password. | To let you sign in, to keep your subscription attached to you, and to let you reset a password. |
| Your profile, if you fill any of it in — display name, country, phone number, a short bio, a profile picture, and a setting recording how Arabic should address you grammatically. | All of it is optional and you can leave every field empty. It exists so the app can address you correctly. None of it is shown to any other user, because Unspoken has no other users to show it to. |
| Your subscription status — whether you are on the free or Pro tier, when it expires, and what our payment provider reports about it. | So that Pro features work on every device you sign in on. |
| A daily count of conversations — a number, never any content. | To apply the free tier's daily limit. A count that the app could keep locally would be a count anyone could reset. |
| Your app language and the date you were last active. | To pick the right language and to keep the account record current. |
One thing to know about profile pictures
If you upload a profile picture it is stored in Google Cloud Storage and served from a long, unguessable web address. That address is not published anywhere and nothing in the app reveals it to anyone else — but anybody who obtains the link can open the picture without signing in. Treat it as you would a photo you had put on the open web. Removing the picture in the app deletes the file, and deleting your account deletes it too.
4. What is sent to the AI, and what never is
When you use a feature that generates text — the chat companion, habit ideas, coping strategies, writing prompts, or the weekly letter — the request goes to our own server, which passes it to Google's Gemini model through Google Cloud Vertex AI.
What is sent: the messages or text belonging to the feature you are using, your app language, your UTC offset, and the grammatical-address setting mentioned above. If you are a Pro subscriber and have the memory feature switched on, a short summary of earlier conversations is sent as well.
What is never sent: your name, your email address, your country, your phone number, your bio, your profile picture, or your date of birth. The model is not told who you are.
We use Vertex AI specifically because Google does not use data sent through it to train its models. We do not store your conversations on our server, and we do not read them. Google processes the request in order to answer it, under its own terms for that service.
5. Voice
Speaking instead of typing is optional, and by default the transcription happens on your device. No recording is created, nothing is uploaded by us, and the audio is gone the moment it becomes text.
Some phones cannot transcribe on-device. If yours cannot, the app tells you so and offers a setting that allows it to use your phone's ordinary network-based recogniser instead. That setting is off unless you turn it on, and while it is on your speech is sent to your device manufacturer's or Google's recognition service under their terms, not ours. We still never receive the audio.
Spoken replies are produced by the speech synthesiser already built into your phone. Nothing is generated on a server and nothing is uploaded.
6. Notifications
Reminders and affirmations are scheduled by the app on your device. They are composed locally, they are not sent from a server, and no notification content leaves your phone. We do not currently send push notifications and we do not store device push tokens.
7. Payments
Subscriptions are sold through Google Play. Google handles the payment and we never see your card details — not the number, not the last four digits, nothing.
To keep track of what you are entitled to, we use RevenueCat, a subscription-management service. RevenueCat receives your Play purchase receipt and your Unspoken account identifier — a random string, not your email or your name — and tells our server whether your subscription is active. It receives nothing you have written.
8. What we do not do
- No usage analytics. The app contains no analytics or tracking SDK of any kind. We cannot see which screens you open or how often you use the app. The onboarding screen offers an optional "anonymous usage data" toggle; today it records your preference and nothing is collected either way. If we ever add analytics, that toggle will be what governs it, and we will update this page before we do.
- No advertising, and no advertising identifiers.
- No selling or sharing of your data. We do not sell it, rent it, trade it, or hand it to data brokers.
- No training on what you write.
- No staff access to your content. The internal admin tool used to support accounts and issue subscriptions can see counts and account status; it has no ability to read a check-in, a conversation, or anything written in an exercise, and no such feature exists to be switched on.
9. Android's own backup — please read this one
Android has a feature called Auto Backup that copies an app's local data to your own Google Drive. Unspoken leaves it switched on, deliberately: your check-ins, plan and chat history exist only on your phone, so without it a lost or broken phone means losing all of it permanently.
The consequence is that a copy of your check-ins, plan and chat history is held in your personal Google Drive, under your Google account and Google's terms. It does not come to us and we cannot read it. It does not count against your Drive storage.
Your app-lock PIN is deliberately excluded from that backup. So is anything held in the app's encrypted storage.
You can turn this off for Unspoken in your phone's settings, usually under System → Backup or Google → Backup. If you do, understand the trade: nothing will restore your history if the phone is lost.
10. Where your data is, and how long we keep it
Everything we hold is stored on Google's infrastructure in the European Union. Account
records and profile data are in Google's Frankfurt region (europe-west3). Our
server functions and the AI processing run in Google's Belgium region
(europe-west1). Profile pictures are stored in a Google Cloud Storage bucket
belonging to the same project.
We keep your account data for as long as your account exists. When you delete your account we delete it — see the next section. We do not keep a shadow copy, and there is no retention period after deletion beyond the short window in which Google's own infrastructure purges deleted records.
11. Deleting your account, and your other rights
You can delete your account from inside the app, under Profile → Account → Delete my account. It removes your account, your profile, your picture and your subscription record from our servers, and wipes the app's data from the handset you did it on. It cannot be undone.
If you no longer have the app installed, you can ask us to delete the account instead: how to request deletion.
Because Unspoken handles health-related information, we rely on your explicit consent as the legal basis for processing it, which you give during onboarding and can withdraw at any time by deleting your account. Running your account and your subscription rests on our contract with you.
Wherever you live, and regardless of which law applies to you, we will honour a request to:
- See what we hold about you.
- Correct anything that is wrong. Most of it you can edit yourself in the app.
- Delete your account and its data.
- Take your data with you. The app already does this without asking us: Settings → Export my data copies your full history in a portable format, free, with no limit on how far back it goes.
- Withdraw consent, or object to what we are doing with your data.
Write to info.wlftech@gmail.com and we will respond within 30 days. If you are in the EU or the UK and you think we have got something wrong, you also have the right to complain to your national data protection authority.
12. Age
Unspoken is not for under-16s. The app asks your date of birth during onboarding and will not let an account through if you are under 16. We do not knowingly hold data about anyone younger; if you believe we have, write to us and we will delete it.
13. Security
Access to your account data is enforced on the server, not in the app: the database rules permit an account to read and write only its own records, and a signed-in stranger is refused exactly as an unauthenticated one is. Your subscription tier is writable only by our server, so it cannot be edited from a modified copy of the app. All traffic is encrypted in transit. The optional app lock adds a PIN or fingerprint over the whole app, which is what protects your writing from somebody holding your already-unlocked phone — it is free and always will be.
No system is perfect. If you find a security problem, please tell us at info.wlftech@gmail.com before telling anyone else, and we will work with you.
14. Unspoken is not emergency care, and it is not a doctor
The companion is a language model. It is not a therapist, it is not a clinician, and it does not diagnose or treat anything. Unspoken is not a medical device and gives no medical advice.
It is not an emergency service and nobody is monitoring what you write. If you are in danger or thinking about harming yourself, contact your local emergency number or a crisis line in your country. Please do not rely on this app to get help to you.
15. Changes to this policy
If we change how any of this works, we will update this page and change the date at the top. Where a change materially affects information you have already given us, we will ask you again inside the app rather than treat silence as agreement.