Iris Privacy Policy

Leggi in italiano

Last updated: 23 October 2026

Public address of this policy: https://irisvoice.app/privacy/

This policy describes Iris 0.61 for Android. Iris is a voice interpreter for live conversations: it listens, transcribes, translates and speaks the translation. It can connect nearby phones, save or export conversations when the user chooses, and, if the user enters their own key, use an artificial intelligence (AI) service chosen by the user. The "Practice" mode is a future feature, not active in this version.

Many features work on the phone, but not all of them. Section 3 lists every case in which data leaves the phone, including cases handled by Android services and by the Google components included in the app.

1. Data controller

The data controller is:

• Stefano Salustri
• Vocabolo Poggio 27/9, frazione Romazzano, 06059 Todi (PG), Italia
• support@irisvoice.app

Iris does not require an account with the controller, and the controller does not operate a server that receives or stores conversations.

2. Data processed and sources

Audio and speech recognition

When the user starts a conversation, Iris uses the microphone to turn speech into text. Iris does not save audio as a recording: during normal use no feature of the app writes the conversation to an audio file.

Speech recognition is performed by Android services, in this order:

1. the on-device recognizer, if the phone offers it for that language;
2. the phone's default recognition service, first asking it to stay offline and then allowing the network;
3. last, the Google recognition service installed on the phone, using the network.

In steps 2 and 3 the recognition service may send the audio to its provider (Google or the phone manufacturer), according to the phone settings and that provider's terms. Iris does not receive or store that audio beyond the recognized text. To prepare listening, Iris also asks Android to download the recognition models for the selected languages: the download is performed by the system service.

This version still contains a technical test component that can write microphone audio to a temporary file in the app's private storage. No screen or feature of Iris starts it, so no audio file is created during normal use.

Synthetic voice

To speak the translation, Iris hands the translated text to the phone's text-to-speech engine. If the phone has only voices that require the Internet for a language and a network is available, Iris uses those voices; in other cases, too, the engine may use a network voice according to its own settings. With a network voice, the text to be spoken is sent to the engine's provider (for example Google). The resulting sound is written to a temporary file in the app's private storage and deleted after playback.

On-device translation

Ordinary translation runs on the phone with Google ML Kit. Sentences are not sent off the phone for this translation. ML Kit downloads one model from Google for each individual language needed; the same language model is reused in both translation directions. Downloads can be limited to Wi-Fi in the language settings.

ML Kit sends Google technical data for diagnostics and usage statistics: according to Google's documentation, the configured source and target languages, device information (manufacturer, model, system version), app name and version, per-installation identifiers, performance data and error codes. The two languages configure the translator direction and therefore appear as a pair in diagnostic data, including the user's language; they do not identify a model downloaded for a language pair.

AI translation and review

Conversation text may be sent to the AI service configured by the user. Users of the Google Play version find the key, provider, AI translation and consents at the bottom of Settings → Languages. Commands that review a whole conversation are not available in the Play build of version 0.61: they appear only in the internal test APK with administrator mode. The code still distinguishes two separate permissions:

• Permission for review, only in the administrator APK. Tapping ✧ Analyse in the conversation or ✧ Ask your AI to review it in the Archive, Iris shows who will receive the text and asks the user to confirm with I understand, review it. With this permission, each new tap sends the full transcript: original sentences and translations of all participants. Review permission never authorizes sending live turns.
• Permission for live sentences, also available in the Play build. It is given by turning on Translate turns with AI in Settings → Languages and answering Yes, use the AI to the prompt that names the service. It covers two cases:
  • with the switch on, turns are sent one by one to the AI service for translation;
  • with the switch off, the fallback: if on-device translation of a sentence fails and a network is available, Iris may send that single sentence to the AI service. The fallback also covers sentences retranslated with Translate and send again or Translate and speak again and turns arriving from the other phones. Without this permission the fallback does not start, even if a key is saved.

  Permission for live sentences does not authorize a full review.

When Iris offers to retry one turn with AI, the confirmation command is Yes, translate better.

Turning off Translate turns with AI while the live-sentences permission is active, Iris asks whether to keep sending only the sentences the phone cannot translate: No, only those sentences keeps the fallback; Yes, no more sentences to the AI withdraws the live-sentences permission, while the review permission does not change.

Each permission applies to the service named in the prompt through which it was given. Changing the service or its address makes Iris withdraw the permission that went to that service and ask again at the next request, naming the new service.

The granted permissions are shown in Settings → Languages, in the AI section under Text sent to the AI, and can be withdrawn with Stop sending text to the AI (section 6).

For users updating Iris from a previous version: the live-sentences permission is kept only by those who already had Translate turns with AI on; everyone else gives it again at first use, and review asks everyone for its permission once.

Each request contains the text, the instructions for the model, the model name and the user's personal key. The controller does not receive these requests.

The services preset in Iris are:

The user can also enter the address of another service. The provider processes data under the contract and privacy policy that apply to the user's account: the controller has no contract with these providers and does not control their processing. Before entering a key, the user should read their terms.

Network encryption. Preset addresses use HTTPS. The interface also accepts http:// only for localhost, .local and private addresses; however, the Android 0.61 configuration targets SDK 36 and does not enable cleartext traffic, so Android normally blocks those HTTP requests. If a future build actually enabled local HTTP, text and key would travel without encryption to that server. The manifest of the final store AAB must therefore be checked before publication.

Conversation Archive

A conversation is saved permanently when the user taps ⤓ Save. In the administrator APK it is also saved automatically, together with the review, when an AI review succeeds. The Archive contains original text, translation, languages, date and time and, if present, the review. The files are stored in Iris's private folder on the phone and are not synchronized to a cloud service of the controller.

From the Archive the user can share a conversation with Share as text, after confirming I understand, share it: Iris creates a text file and hands it only to the app chosen by the user. From then on, processing depends on the chosen app and recipients.

Practice

The "Practice" mode is a future feature, not active in this version of Iris.

Technical log

To help diagnose problems, Iris records the session's technical events in volatile app memory: timings, microphone, translation, voice and connection status, errors, names of connected audio accessories (with the Bluetooth address masked), and short excerpts of spoken sentences and translations (at most 48 characters each). For messages from another phone, until it has been verified, the log records only the type, connection and length. It keeps the last 4,000 lines and loses them when the app process closes.

Administrator mode does not exist in the Google Play build: the Log has no screen, cannot be opened, cleared or exported and does not leave the phone. Only the internal APK used for testing can display and export it after confirmation. The technical raw-audio recorder is also enabled only in that internal APK; in the Play build its calls are rejected and no audio file is created.

Settings and the name shown to other phones

Languages, audio preferences, AI service addresses and models, and the choices about AI use are kept in the app's private preferences on the phone.

If several Bluetooth accessories are connected for calls, Iris may ask which one is your headset. The answer stays only on this phone as a fingerprint of the Bluetooth address: it is a pseudonym, not anonymous data, and does not contain the address in plain text. It is excluded from Android backup and Android transfer to a new phone.

On first launch Iris asks for a name and confirms the user's language. The name is optional: with Skip, other phones see the language name, for example "English". Name and language stay in the app's private preferences on the phone and can be changed in Settings → Languages → Your name; Use the language name removes the name. When a guest sends a request to join a conference, the valid name typed or confirmed in the waiting room is also saved in their profile on the phone. Iris does not create accounts and does not send the name to the controller or to any server.

Personal AI keys

API keys are provided by the user and stored in Android secure storage. There may be two: Your key and, if the user chooses Use a separate translation service, Translation service key. Iris sends each key only to the address configured for that service, to authenticate the request. The controller does not provide its own key and does not receive the user's key.

Connection between nearby phones (Nearby)

When the user taps Turn on the connection (Settings → 2 phones), Iris uses Google Nearby Connections to find and connect nearby phones through Bluetooth, Bluetooth Low Energy or Wi-Fi managed by Android.

While the connection is on, the phone announces itself by radio. The announcement is visible to any nearby phone that is searching with Iris, even if it is not part of the conversation, and contains the language name, the protocol version and a random connection identifier. The user's name is not part of the announcement or of the first greeting between phones, which happen before the session is verified: they only carry the language name. In ordinary session messages, the name reaches other phones only after the connection has been accepted (digits or QR), bound to the session and, in a conference, after the guide has admitted the new phone. There is one exception before admission: the guide sees the name the guest types or confirms in the request to join. A phone waiting in the waiting room, or turned away, only sees the guide's language name.

After connecting, the phones in the session exchange:

• the name chosen in the profile (or, if the user skipped it, the language name) and the phone's language; the guide of a conference sees them grouped by language;
• the original text of each turn and, when available, its translation;
• random identifiers and technical data used to authenticate the session, manage turns, admissions and confirmations, and keep the connection alive;
• QR badge data: the lead phone identifier, the session identifier and secret code, and the session type.

Iris does not send audio or files through Nearby. Each participant sees the text received and can save it in their own Archive; the controller does not control copies kept or shared by other participants.

According to Google's documentation, the Nearby component of Google Play services also sends Google performance data about discovery and connection and device information (model, country, system version, app package name). Google states that users can allow or deny this collection in the phone's Google settings, under usage and diagnostics.

QR badge and camera

The camera is used only when the user chooses to scan another phone's QR badge. Images are analysed on the phone by Google ML Kit's code reader, included through the camera component. Iris uses only the content of the code: it does not take photos, record video, or store or send camera images. Like translation, the ML Kit code reader sends Google technical data for diagnostics (device and app information, per-installation identifiers, performance, configuration), not the images.

Location and nearby devices

On Android 12 and 12L, and on earlier versions, the system may ask for the Location permission because Nearby requires it to search for nearby devices. Iris does not read coordinates, determine the user's location, or store or send location data. From Android 13, it uses the system Nearby devices permissions.

Notifications

During a conversation Iris shows a local notification, "Iris sta ascoltando" ("Iris is listening"), in the Conversazione Iris ("Iris conversation") channel: it keeps the microphone service running. The notification is not used for advertising and its content is not sent to the controller.

Vibration

When this phone's microphone is genuinely ready and the turn belongs to its user, Iris vibrates for 40 milliseconds together with “Speak now”. It happens once per local turn and not during another phone's turn. Vibration does not collect or transmit data.

Accessibility and TalkBack

When an accessibility service such as TalkBack is active on the phone, Iris locally passes it labels, states and a limited set of announcements needed to use the app: microphone errors and permission outcomes, admission requests or rejections, requests to speak and raised hands. Iris does not send these texts to the controller or to its own server. The accessibility service is an Android component or an app selected by the user and may process them under its own settings and terms.

Advertising and analytics

Iris does not include advertising, Sentry, Firebase Analytics, Crashlytics, or other analytics, crash-reporting or profiling tools of the controller. The technical data described above are sent by Google components (ML Kit and Nearby) to Google, not to the controller.

3. When data leaves the phone

This is the complete list of data leaving the phone as provided for in the app's code:

Iris does not sell personal data and does not send conversations to a server of the controller.

4. Purposes and legal bases

Data are processed to:

• recognize speech, translate it, speak the translation and manage turns;
• keep saved conversations on the phone;
• connect nearby phones, authenticate the session and deliver turns to participants;
• perform the AI translation or review chosen by the user;
• allow the sharing and export decided by the user;
• make the app usable through the accessibility service chosen by the user;
• keep the conversation running and diagnose technical problems.

For the features requested by the user, processing is based on providing the requested service (Article 6(1)(b) GDPR). Sending text to an AI provider is based on the user's choice described in section 2 (Article 6(1)(a) GDPR); the user may decline and continue to use the features that work on the phone. Permission can be withdrawn at any time in Settings → Languages; withdrawing it stops later sending and does not affect sending already made.

Conversations also contain other people's words and may contain sensitive information, for example about health. The choice made by the user in Iris concerns the user: before sending a conversation to an AI service or sharing it, the user must inform the other people and make sure they are allowed to do so.

Iris does not make automated decisions that produce legal or similarly significant effects. Machine translations may contain errors and must not be the only basis for medical, legal, safety or emergency decisions.

5. Recipients and transfers outside the European Economic Area

Depending on the features used, the recipients are those listed in section 3: other participants, the apps and people chosen for sharing, the AI provider chosen by the user, Google and the other providers of the phone's speech recognition and text-to-speech services.

Some recipients are based in, or process data in, countries outside the European Economic Area. The preset AI providers are based in the United States (Anthropic, OpenAI) and in China (Z.ai). The European Commission has not adopted an adequacy decision for China; for the United States, the adequacy decision applies only to companies participating in the Data Privacy Framework. The applicable safeguards depend on the provider and account chosen by the user, who should read their terms before entering the key.

6. Retention and deletion

Data on the phone: the user can delete them.

• Iris does not save audio.
• Clear, in the conversation, deletes the current conversation. It does not delete copies already saved in the Archive, already received by other phones or already shared.
• In the Archive, the user can delete a single conversation (by holding it) or use Clear the archive. Deletion is permanent: there is no recycle bin.
• The technical log disappears when the app process closes. Only the administrator APK can clear it manually.
• Keys are deleted with Remove.
• The headset choice can be changed in Settings with Change (including None of these); it disappears when Iris data is cleared in Android settings or Iris is uninstalled.
• Archived conversations, settings and keys remain on the phone until the user deletes them, clears the app data in Android settings, or uninstalls Iris.
• Files prepared for sharing or export stay in the private cache and Iris deletes them the next time it opens; Android may delete them earlier.

Iris disables Android cloud backup of its data. During a direct transfer from an old phone to a new one (Android 12 and later), Android may copy Iris's settings; the Archive and the keys are not copied. Settings can therefore arrive on the new phone without the keys: at the first start with no key at all, Iris resets the permissions to send text to AI, which must be given again. The same happens to a user who removes all the keys and reopens Iris.

Data held by others: Iris cannot delete them.

• Texts sent to an AI provider are kept under the rules of that provider and of the user's account. Deleting them requires the provider's tools or contacts.
• Data processed by Google or the manufacturer for speech recognition, text-to-speech, ML Kit and Nearby follow those providers' rules and the phone settings.
• Copies received by other participants or shared with other apps remain under the control of whoever holds them.

Stopping AI sending. In Settings → Languages, under Text sent to the AI, Stop sending text to the AI withdraws permissions and turns off the switch: withdrawal applies from the next sentence, including turns arriving from other phones. When Translate turns with AI is turned off, Iris asks whether to stop also for sentences the phone cannot translate. In the administrator APK, the review commands also request their own consent again after withdrawal. Stopping sending does not delete data already received by the provider.

7. Security

Local data are stored in the private areas Android assigns to the app. API keys use the device's secure storage. In the Android 0.61 configuration, allowed network requests use HTTPS; the local HTTP case described in section 2 must be checked against the final AAB. According to Google, Nearby connections between phones are encrypted.

No system is risk-free. Anyone taking part in a conversation can read, save or share what they receive. Other people should be informed before AI is used or a conversation is shared.

8. Data subject rights

Where Articles 15-22 GDPR apply, data subjects can request access, rectification, erasure, restriction, portability and objection by writing to support@irisvoice.app. They may also lodge a complaint with the competent supervisory authority; in Italy, this is the Garante per la protezione dei dati personali.

The controller does not receive conversations and has no account identifying the user: for this reason it has no access to data that remain on the phone, nor to data sent to providers chosen by the user. Data on the phone are controlled with the commands listed in section 6. For data sent to an AI provider or processed by Google and the other providers of the phone's services, data subjects must also contact those providers.

9. Children

Iris is intended on Google Play for people aged 13 or over and is not designed for children under 13. Iris does not create accounts, so the controller does not knowingly collect children's data through accounts. Anyone using Iris with a minor must ensure they have the necessary authority and permissions before sending or sharing the minor's words.

Reports about processing concerning a child should be sent to support@irisvoice.app.

10. Changes to this policy

This policy is updated when Iris, the providers or legal obligations change. The date at the top shows the latest version.

11. Contact

For privacy questions or to exercise data protection rights:

Stefano Salustri

Vocabolo Poggio 27/9, frazione Romazzano, 06059 Todi (PG), Italia

support@irisvoice.app