What leaves your phone
What you'll get. A plain account of what E:Voice keeps on the device, what it sends out, and what you had to switch on first.
This chapter avoids two easy lies. E:Voice is not “fully offline”, and nothing here will tell you your data never leaves the phone. What is true is more useful: your workspace lives on the device, and every route out is one you chose.
What stays on the phone
The app states this most plainly in, of all places, the account-deletion dialog: “Conversations, AERIS memory, E:Docs, and vault data stored on this device are preserved.” Those four categories are the workspace, and they are local.
So are your voice-training corrections — “Corrections stay on this device and are applied before Frank sees the transcript” — your profile pictures, and your desktop pairing token, which is stored encrypted and never displayed.
What leaves, and why
Storage is one thing; processing is another. When a feature needs a provider, content goes to that provider. The app's own data-safety record is blunt about it, including the part most apps fudge: traffic paid for with your own key is still declared as shared, because sharing means leaving the device, not who paid.
- Conversation content — to the AI provider answering you. Required for the feature to work at all.
- Voice recordings — to whichever speech route you selected. Choose the local recogniser and this stops. See chapter 03.
- Photos — when you attach one or generate one.
- Files and docs — when you send them to an agent.
- Account details, purchase history, push token, crash and diagnostic reports — to E:MERGENCE, for the account and the app itself. These are not shared onward.
Not collected at all: location, contacts, calendar, SMS, call logs, health data, card or bank details, browsing history, and the list of apps on your phone. There is no location permission in any build.
When you talk to an agent on your own computer, the traffic goes phone-to-machine over your private network. There is no E:MERGENCE relay in the path — the only thing this site does in that flow is hand out the setup code once. Chapter 07 has the detail.
The permissions, and what each is for
Settings has a Permissions card listing every approval the app asks for, with a plain reason under each one and its current state. The list is read from what your build actually declares, so it is honest per device.
- Microphone — voice mode and dictation. Without it E:Voice cannot hear you.
- Notifications — reminders and long-running task progress.
- Camera — photos you send into a chat, and the AERIS OS pairing QR scanner.
- Nearby Bluetooth devices — routing voice through a headset or car audio.
- Phone state — pausing voice when a call starts, so E:Voice never talks over your call. It does not read call logs, contacts, or the number.
- Background access — keeps downloads and reminders running with the screen off.
- Draw over other apps — the Frank bubble outside the app. The bubble never starts the microphone on its own.
- Alarms & reminders — fires a reminder at the exact minute you asked for.
Where the app genuinely can't determine a permission's state, the row says “Could not tell” rather than guessing “denied”.
Keys, and the vault
Provider keys sit in encrypted local storage behind your phone's own lock, tied to your account, on a screen that blocks screenshots while it's open. Android runs the unlock prompt and E:Voice only learns whether it succeeded. Chapter 04 walks through it.
Worth being precise: this is not a claim that everything in the app is encrypted at rest. Credentials and several continuity stores are. Your conversation database is local, not encrypted-at-rest by that mechanism.
Crash reports
Nothing is sent unless you press Send. The dialog lists the exact nine fields it will transmit — report ID, time, app version and build, exception family, summary, capture type, repeat count and your optional note — and adds: “Nothing is sent until you press Send.” Viewing a crash locally never sends it.
Deleting your account
In Settings → Account → E:Voice Account → Delete account. You re-enter your password, review a server deletion summary, and type a confirmation phrase exactly before the permanent button unlocks.
Read the scope carefully: it deletes the account and revokes its server credentials, and it keeps your conversations, AERIS memory, E:Docs and vault data on the phone. If you want the local copy gone too, that is Android's own clear-data or uninstall.
“Nothing reaches our servers.” Not true. Account services, managed voice and image routes, push and crash delivery all use E:MERGENCE endpoints.
“E:Voice is fully offline.” Not true. Local speech and local voice are real, but providers, paired machines, account functions and sync all need a network.
“Everything is encrypted at rest.” Not established. Credential storage is; a blanket claim over every database, cache and attachment is not.
“Unpairing deletes the desktop's copy.” No. It stops sync. See chapter 08.
“A local model does the thinking.” No. On-device inference is not integrated. Select an on-device model and the app tells you so — “On-device inference is still rolling out. Your provider has not been changed.” — and pointedly does not reroute you somewhere else without asking.
The full policy is at the E:Voice privacy policy, linked from Settings → About, and account deletion has its own public page.