Privacy policy

This policy explains what happens to the data of a call made on digfone. It is specific because the product is specific: a video conversation with translated captions produces personal data derived from voice, and that deserves a straight explanation.

Audio and video never pass through us

Picture and sound travel directly from one browser to the other. Our servers exchange what participants need to find each other (network addresses and the chosen language), issue short-lived credentials and process typed chat messages, as explained below.

When the two networks cannot connect directly (which happens behind certain routers and corporate networks), audio and video go through a third-party relay server, which forwards the packets end-to-end encrypted and cannot open them. It is not ours and it stores nothing. The main point still holds: on neither path is the audio or video available to us.

This is not a promise about our conduct, it is how the system is built. We cannot hand the audio of a conversation to anyone, under any circumstances, because it was never with us.

Your captions come from your own microphone, through a speech recognition service

Each participant transcribes their own microphone. The audio goes from your browser straight to a specialised speech recognition service, located in the United States, using a temporary credential issued by us. What comes back is text, and text is all that travels between participants: your original sentence and its translation, so that both sides end up with the conversation in both languages.

Typed messages during the call

When you send a chat message, the text passes through our servers for delivery to the participants present. When translation is needed, we send that text to a language processing service. Each participant receives a translation in their chosen conversation language and can read the original underneath.

Chat is not added to account history, summaries or PDFs. The server keeps a limited temporary copy to recover deliveries on reconnections of up to 30 seconds and deletes it when the room closes. The screen shows up to 200 recent messages during the call. We keep only identifiers and technical usage and cost counters, without message text, to limit the service. Provider processing follows the terms applicable to that service; this digfone memory period is not a statement about the provider's retention.

Ask AI about your conversations

Eligible plans can ask questions about one conversation or their conversation history. We consult only available transcripts your account can access. Asking sends your question, recent context and necessary transcripts to our AI provider. Deleted, expired or opted-out conversations are excluded from new queries. Questions and answers stay in page memory without an additional permanent history in digfone. We retain usage and cost counters without question or answer content. Provider processing follows the applicable service terms.

Optional navigation and experience measurement

You can separately accept or decline two measurements to improve Digfone. Existing aggregate visit counts described below continue independently of this choice. Declining does not prevent signup or calls. Optional navigation measurement records landing visits, 10 visible seconds of engagement, and signup and call steps. A random code stays in this tab for up to 30 minutes and may accompany the move to the call app. Your accept or decline choice is remembered in this browser until you change it or clear local storage. Session expiry does not erase your choice or require another answer. No session code is stored permanently in your browser. This table contains no typed fields, IP address, browser identity or account. Event linkage is deleted after 30 days, and events without an identifier after 400 days. These are sessions, not unique people. You can change the choice in measurement preferences; withdrawal removes events still linked to that session code.

During calls with history enabled, each participant can allow analysis of their own captions after that choice to identify reports about Digfone quality, performance, failures, usefulness and satisfaction. Text excerpts may be sent to OpenRouter and TypeSafe for AI classification outside Brazil, including in the United States. Providers follow their processing and retention terms; we do not assume zero retention. We send no media or account identifiers to the model. We reduce obvious identifiers in text, without guaranteeing anonymization. Results and participant identity are restricted to administrators; they are not used to assess personal matters, decide credit or automatically change campaigns. This telemetry stores no second copy of speech. Results last up to 30 days, or less when history expires. The call quality control lets you withdraw, deleting linked results and preventing further requests. Requests already received by a provider cannot be undone. Later requests can be made through our privacy contact. Budget, availability and AI errors may leave speech unclassified; signals require human review.

What we keep, and for how long

• Conversation text, if the host’s plan includes history: 7 days on Free, 90 on Basic, 365 on Pro. Once that period is over the text is deleted, not archived.
• AI summary, when generated, kept for the same period as the text.
• Answer to the question at the end of the call, if you answer it: a rating from poor to good and, if you want to write, a comment of up to 200 characters. The comment is deleted after 365 days. The rating stays with the record of that call and is used only anonymously in administrative screens by default. If you select the identification option, that new rating may show your name or participant identity to the admin. Older ratings remain anonymous. Ratings are not identified without that choice. Deleting your account deletes the rating and the comment with it.
• Account: e-mail, name if given, language, time zone and country estimated by the network. If you previously told us your main use for the product, that answer remains in your profile.
• Where you came from: if the link that brought you to digfone carried a source code (for example ref or utm_source, set by whoever published the link), we keep that code once, when the account is created. It travels in the page address itself, with no cookie, and the account does not keep the address of the page you came from. When you open a payment (for a plan or an hour pack), we also keep which digfone screen it started from (for example the limit notice or the pricing page), even if you do not complete it, and that tag goes to the payment processor with the order. It serves to learn which channels bring people, and nothing else. When the payment asks for the invoice details, we also keep whether that step appeared, was completed or failed (only the kind of error, never what you typed), to learn whether it makes people give up. The sign-up code, the tags of payments you opened but did not complete and the tags of the invoice step are deleted with the account; the tag of a completed purchase is part of that purchase's record. All of it appears in your data export.
• Visit count: when a page of the site opens in a browser and the person taps, clicks, scrolls or types, or keeps the page visible for at least 10 seconds, we add 1 to that day's count. We keep only the day's total, split by page, page language, the language set in the browser (only the language, for example French), country reported by the network that delivers the site, the domain of the previous site when you arrive from elsewhere (for example google.com, never the full address), the link's source code (ref), device type (phone or computer), whether it was the first page of the visit, and whether the count came from something you did (tap, click, scroll or key) or from time on screen. This count uses no cookie, stores nothing in your browser, does not record the IP address and keeps no record of each visit, only the total. In it, the IP is used only at that moment, in the server's memory, to limit abuse, and is forgotten at most 15 minutes after the last page. Reloading or coming back another day counts again: the count does not know who has been here before. Account and dashboard screens are not counted. It serves to know how many people reach the site, from where and in which language, and nothing else. But the request your browser makes to count is a request to the site like any other, so it is written to the server access log, with the IP and the browser, for the period described in “Server access log”, just below.
• Server access log: every request to digfone's pages (the site and the call app), whether or not you have an account, is written to the log of the server that delivers them: the IP address, the date and time, the requested address (without the part after the question mark and without room and shared conversation codes, which are removed before writing), the site the request came from (domain only) and the declared browser. Some requests also go to the server's error log, with the IP, the full requested address and the previous page. They serve to diagnose failures, contain attacks and count visits to the site. Each day of these logs is deleted 15 days later. The exception is a copy of them from the two weeks before 24 September 2026, kept when the site moved to a new server, which is deleted in December 2026.
• Billing: amount, date, status and, in order to issue the Brazilian tax invoice, the Brazilian tax number (CPF/CNPJ) or foreign tax identification number, country, legal name and foreign address. We reuse billing details and request necessary additions in your tax profile. Card details stay with the payment processor; we neither receive nor store them.
• Tax spelling compatibility: names and addresses written in other scripts may be sent to an AI service (Anthropic) for conversion to Latin characters. We retain the original details and the transformation for review. Fields for tax identification numbers, e-mail, card details and payment amounts are excluded from this request. Processing may take place outside Brazil, and provider retention follows the applicable commercial terms; we do not assume zero retention. You can review and correct your tax profile or request review of an already submitted document.
• Tax and accounting archive: documents, receipts, fees, exchange rates, payouts and changes are retained to comply with legal obligations (Brazilian LGPD, articles 7 II and 16 I), including after account deletion. Minimum retention extends through the fifth year following the record and may be longer for legal obligations, inspections or disputes. Authorized administrators, our accounting firm and competent authorities may access these records for their respective purposes.
• Guest e-mail, if they ask to receive the conversation by e-mail at the end of the call. It is tied to that call and is deleted with it, unless that person creates an account, in which case the record becomes the trace of how their account started. The message we send to that address contains no conversation, no summary, no title and no participant name: it only says the conversation exists and carries a link to open it. That link is what confirms the address, and the conversation is only sent afterwards. So an address typed wrong receives an invitation and nothing about anyone. Every such e-mail carries a link that deletes the address in one click, with no account needed. That address is kept for at most 45 days and, during that period, may receive up to two reminders about the product. After that it is deleted on its own, whether or not the person created an account. The conversation itself is still deleted on the retention of the plan of whoever created the call, which is shorter.
• Scheduled meeting data, when someone opens an invitation and confirms: the e-mail (if they choose to leave one), the language they speak, the time zone they are in and how far ahead they want to be reminded. We use them to show them the right time, open the captions in their language and send the reminder they asked for. The invitation carries no participant name and no meeting title: the address is typed by whoever invites, and one wrong letter would send someone's meeting to a stranger. These data are kept while the meeting is scheduled and for up to 30 days after it, at most 120 days; someone who was invited and never confirmed goes earlier, 7 days after the scheduled date. Every meeting e-mail carries a link that deletes these data in one click, with no account needed. If you have a digfone account with that same address, they go away with it when you delete the account.
• Browser alert (notification), if you turn alerts on for a device: we keep the delivery address the browser generates for that device, the two keys it creates along with it, the language you read in and the browser model, the last one only so you can recognise the device in your data export. The notification carries only a short title, one sentence and the path of the screen it opens: never conversation text, never a room code, never an access link. Whoever taps it lands on a page of the site, and it is your session that decides what shows up there. The subscription is deleted when you turn the alert off, when you sign out on that device, when you change your password (which signs out every device), when you delete the account, and also when delivery fails repeatedly, which is how a device that no longer exists drops off on its own.
• Contacts and call ring: a contact request keeps who asked, who received it, the state it is in and the dates. A call ring keeps who called, who was called, the state (ringing, answered, declined, no answer) and the times, and is deleted after 30 days. No call is created and no minute is consumed while nobody answers. Whoever receives a request sees only the name and the first letter of the e-mail of the person who asked. Accepted contacts see the name and the public identifier (handle), never the phone number and never the conversation history.
• Product reminders, sent to your account address: short messages about how to use digfone and about what your plan includes. Every reminder carries a link that turns these messages off in one click. Turning them off does not delete your address and does not remove the account access link: it still arrives whenever you ask to sign in.
• Contact message, if you write through the form on the site: your name, your email, the subject and the text you sent. We use it to reply, and for nothing else. We keep it for 12 months and then delete it, whether or not the conversation ended. If we ask something by email and you would rather stop, just do not reply.
• Usage metering: duration and number of caption sessions, which is what determines the charge.
• Security log: at sign-up, once, the IP address, the browser/device and the country; and, during use, the IP of sensitive account actions (sign-in, plan change, deletion). They serve support and abuse containment. When the account is deleted they go with it: the sign-up record is deleted and the IP is removed from the others. Only the record of the deletion request itself remains (the date, the email and the IP of whoever asked), as proof that it was fulfilled.
• Error log: when a page fails in the browser of someone visiting us, we keep the error message and type, its technical trace (where in the code it happened), the path of the page, the browser and the IP address, including for people who have no account with us, because the failure we most need to see is precisely the one that kept someone from loading the site at all. Along with the error go technical details of the page and the connection: the screen size, the page language, the site version, how the page was opened (for example from a link or with the back button), the progress and timing of the page load (how much of the page and of the site files had arrived, and whether the site had already reloaded the page on its own), the protocol and the kind of network the browser reports (for example 4G), the estimated latency of the connection, whether data saver is on, and signs that a translator or an extension changed the page (the page classes and how many elements and attributes they added, never their names). The page address goes without the access codes and the email address that some links carry, and the same cleanup applies to the error message and the technical trace. It serves to fix the defect, and nothing else. The IP is deleted after 7 days and the whole record after 90 days.
• Attack attempt log: the site keeps traps on paths that do not exist (addresses only a scanning program looks for) and refuses access to internal routes. When one of those traps is touched, we keep the IP address, the country reported by the network that delivers the site, the declared browser, the requested path and the time. We never keep the content that was sent: nothing typed into a form, no password, no conversation text. It serves to detect attacks and protect accounts, and nothing else. Everything is deleted after 90 days.
• Technical call quality: during a conversation, your browser measures its own connection and sends us numbers about the network, never the content: round-trip time, packet loss, whether the picture froze, how long captions took, and the device class (for example Chrome · Android, never your browser's full identification). It serves to find out why a call went badly and fix it, and nothing else. No audio, video or text from the conversation is in those numbers, nor your IP address. The minute-by-minute detail is deleted after 30 days; the per-call summary follows the call's own retention.
• Caption diagnostics: when the audio from your microphone stops reaching the captions in the middle of a call, your browser sends us a short record of the episode, logged with the room code, a random code for the participant, the language and the country of the connection. The record says how long the audio was stopped and what brought it back (a touch or key press, the page coming back to the screen, a new capture attempt, or nothing we could see), the state of the browser's audio processing, whether the page was visible or in the background and for how long, how long ago it came back to the screen, whether there had already been a touch or key press on the page, whether the microphone and the camera were active, muted or absent, at what point of the call it happened, how many attempts to resume the capture were made and how many failed, and the device class (for example Safari · iOS, never your browser's full identification). With it goes the count of those episodes in the call: how many there were, how many were recorded, how many ended without the audio coming back, how many lasted only an instant and, if the call's limit of records is reached, which one was left out. No audio, video or text from the conversation goes into this record, nor your IP address. It serves to find out why captions stopped and fix it, and nothing else. It is deleted within 30 days.

Whoever receives the link is a data subject too

The person who joins through the link has no account with us, and half of the conversation is their own speech. We recognise that person as a data subject: they may request deletion of the text of any conversation they took part in, by writing to contact@digfone.com with the date and the room code. Their request deletes the conversation for both sides, because there is no such thing as half a transcript.

Turning the record off

There is a control in your account for keeping no transcript at all. It applies to the calls you create: in those, the voice transcript exists only on screen and is not sent to our servers for storage. Typed messages are still processed temporarily for delivery and translation, without permanent chat history. In a call created by someone else, it is that person who decides whether there is a record: it is their account that answers for that transcript, and their plan that sets how long it is kept.

Your rights

You can request access, correction, export or deletion of your data, and withdraw consent, at the e-mail above. We reply within 15 days.

Deleting your account also deletes the conversations you hosted. In our live systems the deletion is immediate and cannot be undone.

One caveat that has to be written down: the database has a backup, which exists only for disaster recovery. Those copies rotate, are not kept indefinitely, and are never used to restore data that someone asked us to delete. The same applies to text purged by the retention period: it leaves the live systems at once, and the copies on the following cycle.

We do not sell any data, and we do not use the content of your conversations to train any model.

International transfer

Part of the processing happens outside Brazil, including in the United States and Germany. Anthropic reports storage in the United States and processing that may also occur in Europe, Asia and Australia. The tax request converts the spelling of details needed for the invoice. Transfers are subject to the grounds and safeguards in article 33 of Brazil’s General Data Protection Law and the terms applicable to each processor.

To find out which processors handle your data, and for what purpose, write to the data protection officer, at the end of this page.

Data protection officer

Requests about personal data: contact@digfone.com.

The rules for using the service are in the terms of use.