Privacy Policy

1 Who we are

A small Queensland company. Email is the way to reach us.

crmpt (“crmpt”, “we”, “us”, “our”) is operated by Crumpet Co Pty Ltd (ABN 83 656 267 015), an Australian business based in Queensland.

This policy explains how we handle your personal information when you use the crmpt app, our website at crmptco.com, and any related services (together, the Service).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where you are in the EU or UK, we also handle your information consistently with the GDPR and UK GDPR.

Contact: hello@crmptco.com. We are a small team and email is the fastest way to reach us. If you need to write to us by post, email us first and we will give you a postal address.

2 The short version

You speak. We keep the words, encrypted, and never sell them.

• crmpt is a voice journaling app. You speak; we transcribe what you say and store the text, encrypted, so it can be read back to you as Reflections and Patterns.
• Your voice recordings and transcripts are sent to third-party AI providers to turn speech into text, to write Reflections and Patterns, and to power Aloud. Every one of them is named on our Trust page.
• Aloud is an AI. It is not a person, and no person reads your conversations with it.
• Those providers may not use your content to train their models, and they keep it only as long as it takes to return a result. Some of them are outside Australia, including in the United States.
• We do not sell your personal information and we do not use it for advertising.
• You can ask us to delete any of your entries, or your whole account, at any time.

The rest of this policy is the detail behind those points.

3 What we collect

Your account details, what you record, and a little about your device.

3.1 Information you give us

• Account information. Your email address, the display name you choose, your date of birth (used only to confirm you are 18 or older), and a profile photo if you add one.
• Voice recordings. The audio you record when you tap or hold the orb. It is transcribed and then discarded — see section 8.3.
• Transcripts. The text version of your recordings, and how long each recording was.
• Reflections and Patterns. The letters and themes crmpt writes back to you, generated from your entries.
• Aloud conversations. What you say to Aloud and what it says back. A transcript of the conversation may be kept — see section 5.3.
• Preferences. Your Topping (colour theme), Aloud voice, capture mode, Reflections cadence, notification and haptics settings, and your time zone.
• Support correspondence. Anything you send us by email or through in-app feedback, along with the screen you sent it from and your app version.
• Early-access requests. What you enter on our website’s early-access form: your email address and, if you give them, your name and how you heard about crmpt.

3.2 Information we collect automatically

• Device information. Device model, operating system version, app version, language and time zone, collected with crash reports.
• Usage information. Features used, entry counts, Aloud call minutes, and crash and error logs.
• Sign-in sessions. Each session records the IP address and device or browser identifier it was created from, so we can spot a sign-in that was not you.
• Push notification token. If you allow notifications, the token Apple issues so we can deliver them.
• Plan and usage. Which plan you are on and how much of any daily allowance you have used.

Beyond the session record above, your IP address is processed by our hosting providers to deliver requests and defend against abuse; we do not derive your location from it. We do not collect your precise GPS location, your contacts, your photo library (choosing a profile photo hands us only the one image you pick), or your health data from Apple Health.

3.3 Sensitive and health information

This is the part that matters most for an app like crmpt.

When you record a voice entry or talk to Aloud you may talk about your mental or physical health, your relationships, your religious or political views, your sexuality, or other deeply personal matters. Under the Privacy Act, some of this is sensitive information, and information about your health is health information.

We do not ask for this information and we do not analyse your entries to categorise you. But because your entries may contain it, we treat everything you record as sensitive by default.

We only collect this information with your consent. You give that consent when you agree to this policy during onboarding and each time you choose to record an entry or talk to Aloud. You can withdraw it at any time by asking us to delete your entries and your account (see section 9).

4 How we use your information

To run crmpt for you, and for nothing else.

We use your personal information to:

• Provide the core Service. We transcribe, store and read back your entries.
• Generate Reflections and Patterns. We gather your recent entries and produce a short personal letter, and the recurring themes, back to you.
• Run Aloud. We carry the conversation between you and the voice agent.
• Operate your account. We authenticate you, apply your plan, and keep your settings.
• Support you. We respond to questions, bug reports and feedback.
• Improve the app. We use aggregated, de-identified usage data, such as which features are used and where crashes occur.
• Keep the Service safe. We detect fraud, abuse and technical failures.
• Meet our legal obligations.

We do not:

• sell, rent or trade your personal information;
• use your voice recordings, transcripts, Reflections or Aloud conversations to train our own models or anyone else's;
• use your entries for advertising or share them with advertisers;
• read your entries, except in the narrow circumstances in section 6.

5 AI processing and who we share your data with

crmpt can't work without specialist providers. Here is what each one gets.

crmpt cannot work without sending your audio and text to specialist providers. This section explains what each kind of provider receives. The providers themselves — who they are, where they run, and what their terms let them do — are listed on our Trust page, which we update before any provider changes.

5.1 Speech-to-text

Your voice recordings are sent to a speech-to-text provider to be converted into text.

• What is sent: the audio of the recording.
• What is not sent: your name, email address or account identifier.

5.2 Reflections and Patterns

Your transcripts are sent to a language-model provider to generate your Reflections and Patterns.

• What is sent: the text of the relevant entries and, where one has been kept, the transcript of an Aloud conversation.
• What is not sent: your name, email address, audio or account identifier.

5.3 Aloud

Aloud is a conversation with an AI model. The call runs over a real-time voice platform, and the audio is end-to-end encrypted between your phone and our voice agent. The agent turns your speech into text, sends it to a language model to generate the reply, and turns the reply back into speech.

• What is sent: your speech, the earlier turns of the current conversation so Aloud can follow the thread, and the display name you chose, so it can greet you.
• What is not sent: your journal entries. Aloud does not read your notes. Your email address and account identifier are not sent either.

A transcript of an Aloud conversation may be kept after the call ends, encrypted in the same way as your notes, so that your Reflections can draw on it. Where a transcript is not kept, the conversation is gone when the call ends. You can ask us to delete any kept transcript at any time.

5.4 The terms we hold them to

Each of these providers operates under terms that require them to:

• process your content only to return a result to crmpt;
• not retain your content beyond what is needed to return that result, other than short-lived logs kept for abuse monitoring where the provider's terms say so;
• not use your content to train or improve their models;
• provide protection for your information equivalent to that described in this policy;
• maintain appropriate security controls.

Each provider’s own published retention and training position is quoted and linked on our Trust page.

5.5 Infrastructure and operations

Alongside the AI providers, crmpt runs on hosting, database, email, notification, crash-reporting and job-scheduling services. Your entries are stored in a database in Sydney, Australia, encrypted with a key the database provider does not hold. The full list, with what each service receives and where it runs, is on our Trust page.

5.6 Other disclosures

We may also disclose your information:

• to professional advisers (lawyers, accountants, auditors) under confidentiality obligations;
• where required by law, court order, or a request from a regulator or law enforcement agency;
• where we reasonably believe it is necessary to prevent a serious and imminent threat to someone's life, health or safety;
• to a buyer or successor if crmpt is sold, merged or restructured, in which case we will notify you and this policy will continue to apply to information collected before the change.

6 When a human might see your entries

Almost never, and only for a reason you would recognise.

Your entries are not reviewed as a matter of course. A member of our team may access an entry only when:

• you ask us to, for example when you report a bug with a specific recording and give us permission to look at it;
• we are required to by law; or
• it is necessary to investigate a serious security incident, and only to the minimum extent needed.

Access is limited to the people who need it and is subject to confidentiality obligations.

7 Overseas disclosure (APP 8)

Some providers are overseas. We hold them to the same standard.

Some of the providers listed on our Trust page store or process personal information outside Australia. The countries this is likely to involve are the United States and the European Union.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual data-protection commitments and, where relevant, Standard Contractual Clauses.

By using crmpt and consenting to this policy, you consent to your personal information being disclosed to overseas recipients on this basis. You should be aware that overseas recipients may be subject to foreign laws, and that Australian law may not be enforceable against them in the same way.

8 Storage, security and retention

Encrypted in transit and at rest, stored in Sydney, kept until you delete it.

8.1 Security

We use measures appropriate to the sensitivity of the information, including:

• encryption in transit (TLS) everywhere, and end-to-end encryption of Aloud call audio between your phone and our voice agent;
• encryption of the text of your entries at rest (AES-256-GCM), with a key held only by the service that writes and reads them — not by the database provider;
• access controls, so that only authorised personnel can reach production systems;
• authentication by one-time code sent to your email address, with no password to leak;
• monitoring of our production systems for errors and unusual activity;
• regular review of our providers' security posture.

No system is perfectly secure. We cannot guarantee absolute security, but we take our obligations seriously and will tell you if something goes wrong (see section 8.4).

8.2 Where it lives

Your entries are stored on database servers located in Sydney, Australia. Profile photos are stored on a global object store. The providers are named on our Trust page.

8.3 How long we keep it

• Voice recordings. Transcribed and then discarded. We do not keep the audio.
• Transcripts, Reflections and Patterns. Until you ask us to delete them, or until your account is deleted.
• Aloud transcripts (where kept). Until you ask us to delete them, or until your account is deleted.
• Deleted entries. Removed from live systems immediately; gone from point-in-time database history within 24 hours.
• Account information. Until your account is deleted. We action a deletion request within 7 days of confirming it came from you.
• Sign-in sessions. While the session is valid. Removed with your account.
• Crash and error reports. 90 days, with the text of entries never included.
• Early-access requests. Until you ask us to remove you, or until we close the early-access list.
• Records we must keep by law. As long as the relevant law requires (for example, tax records for 5 years).

8.4 Data breaches

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

9 Your rights and choices

Ask and we'll show you, correct it, or delete it.

9.1 Access and correction

You can read your Reflections and Patterns in the app at any time. You can also ask us for a copy of all the personal information we hold about you — including your transcripts — or ask us to correct it, by emailing hello@crmptco.com from the email address on your account. We will respond within 30 days. There is no charge, unless a request is unusually large or repetitive, in which case we will tell you the cost before proceeding.

9.2 Deletion

To delete individual entries, a kept Aloud transcript, or your whole account, email hello@crmptco.com from the email address on your account and tell us what you want removed. We will confirm the request came from you, then action it within 7 days. Deleting your account removes your entries, transcripts, Reflections, Patterns, Aloud transcripts, profile and account record.

Deletion is permanent and cannot be undone. Once your content has been processed by a provider, we may not be able to delete every copy that briefly existed in their systems, but their terms limit how long it can live there, and we will take all reasonable steps to have it removed.

9.3 Withdrawing consent

You can withdraw your consent to AI processing at any time by asking us to delete your account. Because transcription and Reflections are core to how crmpt works, the app cannot function without them.

9.4 Notifications and marketing

You can turn off push notifications in your device settings. We do not currently send marketing email; if we ever do, every such email will carry an unsubscribe link. We will still send you essential service messages, such as sign-in codes and security notices.

9.5 Anonymity

Because crmpt stores your entries against an account so you can get them back on any device, we cannot offer the Service anonymously or under a pseudonym.

10 If you are outside Australia

Your local rights still apply, and here is the legal basis we rely on.

10.1 EU and UK users

Where the GDPR or UK GDPR applies, our legal bases are:

• Providing the Service — performance of a contract (Art. 6(1)(b)).
• Processing entries that may contain special category data — your explicit consent (Art. 9(2)(a)).
• Improving the app, security, fraud prevention — legitimate interests (Art. 6(1)(f)).
• Legal compliance — legal obligation (Art. 6(1)(c)).

You have rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your local supervisory authority. Contact hello@crmptco.com to exercise them.

10.2 California users

We do not sell or share personal information as those terms are defined under the CCPA/CPRA. You may request access to, deletion of, or correction of your personal information, and we will not discriminate against you for exercising those rights.

11 Children

crmpt is for adults.

crmpt is not intended for people under 18 and we do not knowingly collect personal information from them. We ask for a date of birth when you join and do not create an account for anyone under 18. If you believe a child has created an account, contact hello@crmptco.com and we will delete it.

12 Our website

No cookies. Page views are counted without identifying you.

crmptco.com does not set cookies. It uses Vercel Web Analytics to count page views; the beacon is served from this site, sets no cookie, and does not identify you across other sites, so there is nothing to opt out of. The early-access form on this site sends what you enter to our API and nowhere else.

13 Automated processing

AI writes Reflections and speaks as Aloud. Neither makes decisions about you.

Reflections, Patterns and Aloud are all generated by AI models and are not reviewed by a person before you see them. They are reflective and conversational features, not an assessment, diagnosis or decision about you.

Aloud is an artificial intelligence. It is not a person, it is not a counsellor, and there is nobody on the other end of it. crmpt does not use automated decision-making to make decisions that produce legal effects or similarly significantly affect you.

14 Changes to this policy

If something material changes, you'll hear about it first.

We may update this policy from time to time. If we make a material change, such as adding a new AI provider or a new category of data, we will notify you in the app or by email before it takes effect, and where the change requires it, we will ask for your consent again.

The current version is always available at crmptco.com/privacy.

15 Complaints

Tell us first. If we don't fix it, the OAIC is the next step.

If you think we have mishandled your personal information, email hello@crmptco.com with the details. We will acknowledge your complaint within 5 business days and respond within 30 days.

If you are not satisfied with our response, you can complain to:

Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
1300 363 992 · oaic.gov.au