Privacy and Security in Voice AI Journaling: What to Ask Before You Talk

A journal only helps when you feel safe enough to be honest. Claire turns a private conversation into an entry you can revisit, including its transcript and audio. That makes it our responsibility to explain plainly what we store, why we store it, who helps us process it, and how you can remove it.

Claire's Privacy Promise, in Plain Language

Here is the short version. The complete disclosure is in our privacy policy.

• We keep your entry, transcript, and recording for you. They remain available while your account is active so you can read or replay your own reflections.
• Your journal is not an advertising product. We do not sell journal content or provide it to advertisers or data brokers.
• Your journal does not train general-purpose AI models. We do not use it for that purpose, and we do not authorize our service providers to do so.
• Specialized providers help Claire work. Voice, telephony, transcription, AI, and cloud providers process the information needed to place calls, understand your words, create your entry, and store it securely.
• You stay in control. You can export your entries or delete your account. Deleted account data leaves active systems within 30 days, and encrypted backups roll off within 90 days.

Why Claire Stores Your Recording

A completed Claire entry includes a narrative summary, the full transcript, and the call recording. We keep all three because memory is imperfect: sometimes the useful part is the sentence you actually said, the pause before it, or the way a thought sounded in your own voice. Replay is part of the product, not an accidental copy left behind after processing.

Stored entries, transcripts, and recordings are encrypted at rest and in transit. Scheduled phone calls still travel through carrier and voice-provider networks, so the call itself is not end-to-end encrypted. We would rather explain that boundary than hide it behind a lock icon.

Five Questions to Ask Any Voice Journaling App

Voice adds a layer that text journaling apps never had to answer for. A recording of you talking about your marriage at 7 a.m. is a different kind of artifact than a typed note. These are the questions that matter most, in order.

• What happens to the audio? Is it kept so you can listen back, and if so, who else can access it? Is it used to train models? A vague “we may use your data to improve our services” is not an answer.
• Is my journal content ever used for advertising? Not your email, your transcripts and mood data. This is the exact line BetterHelp crossed.
• Can I export and delete, and how fast? A real deletion commitment has a number of days attached to it and mentions backups.
• Is data encrypted in transit and at rest? Both. One without the other is a half answer.
• Who inside the company can read it? Look for access controls and auditing, not just a promise that employees are nice.

How Claire Handles Your Information

Claire uses Vapi and Twilio for voice and telephony; OpenAI, Google, and Deepgram for AI or transcription paths; and Supabase for authentication, databases, and storage. The provider used can vary by feature or call path. Each receives the audio, text, context, or account information needed to perform its part of the service.

We do not authorize model training with your journal. Providers process journal content to run Claire's features, not to train general-purpose AI models or build advertising profiles. Claire may use your past journal context to personalize future conversations and insights for you; that is different from training a general model on customer journals.

Limited human access exists, and it has boundaries. Authorized Claire personnel may access journal content, transcripts, or recordings only when needed to answer a support request, investigate a security or abuse concern, diagnose a technical problem, or comply with law. Production access is restricted through authentication and role-based controls.

Advertising measurement never includes your journal. To measure whether our ads reached the right people, we may send Meta a SHA-256 hashed version of your email or user ID, the page URL, and standard browser and device information. Nothing from inside your journal is part of that. If you would rather not be included even in that, email privacy@clairecalls.com and we will opt you out.

Deletion has a number attached. You can export your journal entries and delete your account at any time. Deleted account data is removed within 30 days, and encrypted backups roll off within 90. Analytics data is anonymized after 12 months.

The full policy is the place to check us. It covers data collection, service providers, Text Claire, retention, children's privacy, and your controls. If anything is unclear, email privacy@clairecalls.com. A real person will answer.

What HIPAA Means Here

Claire is a consumer wellness service, not a health care provider, health plan, or health care clearinghouse. Ordinary use of Claire is therefore not generally governed by HIPAA. We do not treat that as a lower privacy bar. Our policy still needs to tell you what we collect, why we need it, who receives it, how it is protected, and how you can remove it.

Other protections can still apply. The FTC's Health Breach Notification Rule covers many health apps outside HIPAA and requires notice after certain breaches of identifiable health information. The FTC can also act when a company's privacy promises are deceptive.

A More Private Place to Talk

Claire is responsible for protecting the systems it operates. You can also choose a few things on your side: lock your device, avoid taking a call on speaker around other people, and never email us a password, verification code, or full journal entry. We will never ask for those.

Privacy is not a badge Claire earns once. It is a promise we have to keep making clearly—and keep matching in the product itself.