Sayroam Privacy Policy

Notice revision: 2026-10-18.6 · Effective 18 October 2026

Sayroam is operated by MansaMusaInvst., a Swiss sole proprietorship, UID CHE-370.926.542, Speerweg 20, 8618 Oetwil am See, Switzerland. The operator is responsible for the information described here. Contact gravies.11.ribbons@icloud.com for privacy or account help. Availability follows the App Store offering and service availability.

Current availability

These notices cover Sayroam’s free-account social service, areas, optional cosmetic appearances, website and restricted tests described below. Account creation and the first approximately 25 km area are free. Optional paid features are available only when offered by the app with the required Apple product and current ownership checks; Apple shows the actual localized price before confirmation. Existing purchase recovery remains separate from new-purchase availability. Apple/Google sign-in and remote alerts are available only when configured and offered. Four supplied isolated App Review fixture accounts use a separate labelled hosted environment with fictional members, sample tones and simulated account/area access; their explicit uploads are real test data. A separately supplied ordinary Sandbox purchase-review account uses the normal social service and its ordinary account, audience, contact, area and safety rules. Its Sandbox designation limits Apple payments to the test environment; it does not isolate social data or make ordinary members fictional. Sayroam offers no identity-check service, identity-check purchase or verification badge.

Sayroam is offered in the countries and regions shown for it in the App Store and where its service is available. The initial offering excludes the European Economic Area (EEA), United Kingdom, China mainland, Türkiye (Turkey), Indonesia and Australia. Later expansion is subject to the applicable regional arrangements. Features and purchases can vary by country. This availability does not remove existing privacy rights or replace local filing and other requirements that apply. Our privacy contact remains available for requests.

The following describes the profile, voice and explicit Accept controls when offered by the updated app and service. New personal profile edits, including sanitized custom-image thumbnails and supported movement, publish after structural validation without individual human preapproval. New direct private voices and personal profile voice posts publish after audio and account/audience validation without individual human preapproval. Shared local/community voices still wait for human review. Existing historical pending content is not automatically approved or released by this change. Each profile voice thread starts friends only; its owner may choose public sharing with eligible signed-in members. Private conversations are never copied into that thread. Reports, blocking, audience controls, post-publication moderation and removal still apply.

Appearance choices

The standard bird artwork, standard recorder, no frame and Lilac & Pearl colour are free. Account → Themes holds all appearance controls. Wuzzzzup has a US$4.99 base price; Gold handle has a US$1.00 base price. Recorder collection is one US$2.99 pack for twenty recorder looks, Profile frames is one US$1.99 pack for twenty frames, and Colour styles is one US$2.00 pack for all twelve colour choices. These are optional one-time cosmetics, not subscriptions or identity/age/safety checks. Apple shows the actual localized price before any available purchase. An unavailable purchase control is not an offer to charge you. Choosing a preview does not buy or apply an unowned paid appearance.

An appearance preview or an earlier free test choice is not paid ownership and never authorizes a later charge. The public app ignores earlier free-test preferences. Historical server test-frame choices are not shared as paid frames; buying a pack does not convert them without explicit reselection. Actual paid ownership has the separate purchase, restore and refund rules below.

What Sayroam does

Sayroam lets adults meet through private recorded voice messages, shared local voice threads and a voice-post thread belonging to each profile. A profile is an emoji line, optionally including a Genmoji and movements you create. There are no typed conversations or written profile biographies. Creating an account is free. You choose a unique username and use a private email and password, or an available Sign in with Apple or Google option. You must confirm that you are at least 18. This is your declaration, not an identity or age check. Sayroam does not provide identity checks or verification badges.

Sayroam holds readable recordings and profile content and is not end-to-end encrypted. New direct voices, personal profile posts and personal profile edits, including structurally validated custom images, can be delivered or published before a person reviews them. The operator can access them to investigate reports and safety concerns. Shared local/community voices still wait for human review. Your display name is withheld from another member until you have an accepted connection. A recipient can explicitly accept an incoming hello without recording a reply; compatible older clients may still accept through an explicit accepting voice reply. This does not make your voice or profile anonymous: a person may recognise you, and information you say or place in an image is not automatically removed.

Information we use

We do not ask for your phone contacts, and the app does not upload your address book. A connection list created inside Sayroam is still personal information about your relationships.

Your voice or chosen symbols may reveal personal or sensitive information. Share only what you want the intended audience and reviewers to know. A local thread or public profile voice thread can be heard by eligible members who have never connected with you. Avoid recording other people without appropriate permission.

Accounts and optional Apple or Google sign-in

Your username is unique in Sayroam. It is not a verified legal name. The initial display name uses your chosen username; the app's existing name-visibility rules still apply. Your account email is private and is not included in other members' profiles. An email supplied for password signup is not automatically verified, and this release sends no signup-verification, retry-code or password-reset email.

If you choose Apple or Google sign-in when configured, Sayroam checks the provider's signed identity proof and binds the provider's issuer and account identifier to the Sayroam account. The requested scopes are sign-in and email; Sayroam does not request a provider profile name or phone contacts. A provider may supply a verified email assertion; Apple may supply a private relay address when you choose Hide My Email. Merely supplying the same email as another account does not link the accounts. The sign-in provider handles its own authentication under its privacy notice: Apple and Google.

The app sends the selected provider's authorization result to Sayroam's server. The server exchanges an Apple authorization code or a Google authorization code with its PKCE proof, validates the signed identity token and saves the provider/account binding. Identity tokens and raw authorization codes are not kept as an archive. OAuth state, nonce, code and PKCE verifier remain transient on the phone and are cleared after the grant. The resulting Sayroam session is saved in the device Keychain, not the provider's password or credential. A new-provider onboarding challenge is stored encrypted on the server and becomes unusable after ten minutes; expired rows are removed on later sign-in activity or worker cleanup. A digest of a used provider authorization is kept for a 24-hour replay window and removed on later activity or worker cleanup; the digest is not the raw token or code. Provider refresh credentials are encrypted on the server for sign-in/revocation handling, separate from ordinary profile data. Credentials issued for the same provider account, including older or sibling login grants, can remain bound to the Sayroam account until account deletion so they can all be revoked. Signing out does not itself erase these grants. An unfinished onboarding grant becomes unusable after its ten-minute window; when no live sibling or linked account requires its credential, cleanup queues that credential for revocation. Account deletion first queues revocation of that retained token and then removes the local account and provider binding. A failed revocation remains unresolved and retries in the background; after the bounded retry budget, it requires operator attention rather than a false completion claim; local deletion is not a claim that Apple or Google erased its independent account, history or every copy. A completed revocation removes the retained token from the active task. The provider handles its own login session, cookies and account settings under its own policy. If a failed Google exchange supplied only a short-lived access token, that token can instead be encrypted solely to queue its revocation; it is not a successful login credential. A returning Google account may continue to use its already retained encrypted refresh credential only after the exact provider/subject and active-account binding is validated; absence of a fresh refresh token alone does not create or merge an account.

There is no account-opening charge and no identity-document, selfie, biometric matching, age-estimation or duplicate-face capture in this version's signup. No identity-check provider is used by this update. The 18+ declaration, a chosen username, an Apple/Google sign-in and a purchase are not proof of a person's identity or age. We cannot promise one account per real person through these controls.

What other members and reviewers can see

Eligible members may see your published profile, selected interest and broad area label before you connect. New personal profile edits, including supported movement, sanitized custom PNG thumbnails and legacy bounded drawings, publish after successful structural validation without individual human preapproval. A new valid edit replaces the published revision atomically. Reports or other safety concerns can lead to later rejection, removal or account restrictions. Exact content already removed by moderation cannot be republished merely by using a different retry key. A historical pending edit remains separately labelled and is not automatically released; rejecting the current profile does not revive an older superseded revision. Profile shows the authoritative published profile and separately labelled historical pending or rejected state. This preview does not expand profile eligibility. An optional Gold handle decorates only the visible @username; the separate display name stays ordinary. It does not establish identity or trust.

A new private voice message can be up to 30 seconds. After the service validates its audio format, size and duration and checks the account/contact rules, it is delivered to its intended recipient without waiting for individual human review. These audio checks do not assess what the speaker says. Recipients can report harmful messages and block contact; the operator can investigate and remove or restrict content after delivery. Earlier messages can retain their original recording length. A shared local thread has a wider audience: eligible members can listen and reply when its anchor lies within one of their unlocked 25 km areas, even if they have not connected with its author. The opening voice and every reply need human approval before other members can hear them. You can see your own pending shared recording; rejected recordings are not published. A rejected opening voice hides the whole thread.

Starting, listening to or replying to a local thread does not create a connection, reveal your name or count towards area progress. Sending a first private hello expresses the sender's willingness to connect. Only one initial hello can remain outstanding between the pair. After a valid hello is delivered, its recipient may choose Accept connection without sending a recording, or decline. Acceptance establishes the connection, reveals display names to those two members and permits friends-only profile voice access where offered. A compatible older client may still accept by explicitly sending a voice reply; direct delivery and connection do not require individual human approval in that flow either. Listening alone, profile posts and emoji reactions do not accept a connection. Your private email and home coordinates are not shown in member profiles. Your display name initially matches your chosen username. Local-thread responses do not disclose the thread’s anchor coordinates, exact anchor area identifier/name or distance.

Each profile has a separate voice-post thread. Only its owner can post new recordings there. Its default audience is friends only, meaning the owner and currently accepted, eligible connections who are not blocked. The owner can instead choose public, which means eligible signed-in Sayroam members who can view that profile; it is not an unauthenticated web page or a promise that everybody worldwide can access it. Changing the setting applies to all existing and future published profile posts, including earlier posts when changing to public. New valid personal voice posts publish immediately to the selected eligible audience without individual human preapproval. Historical pending posts remain owner-only and are not automatically released; rejected or deleted posts are not published. The exact same removed personal-audio payload cannot be republished under a new retry key, including after deleting the rejected post; the existing payload hash and moderation record enforce that check without semantic scanning. Private-message recordings are never automatically copied into profile posts.

Only a currently accepted, eligible connection can add one reaction from the supplied Unicode emoji palette to a published eligible profile voice post. The friend can change or remove that reaction; no typed comments, captions, custom reaction images or other people's voice replies are supported in a profile thread. Eligible listeners see reaction counts and their own selected reaction, rather than a published list of reacting accounts. Sayroam retains the account/post link needed to enforce these choices. A withdrawal of connection, restriction or block can hide reactions from current responses without itself erasing the stored reaction. Profile voice posts and reactions do not count towards area progress or create a private conversation.

The operator can listen to submitted recordings, inspect profiles and movement, and access reports and the identifiers needed to investigate them. The operator handles safety review, reports, appeals and support personally. New direct private messages, personal profile voice posts and personal profile edits, including custom images, do not wait for individual human approval; reports and other safety concerns can lead to review, removal or contact/account restrictions after delivery or publication. Structural audio/image validation does not judge meaning. Shared local/community voices still require human review before other members can access them. AI moderation assistance is disabled in this release; submitted voices are not sent to an AI moderation service. Continuous monitoring or a fixed response time is not promised. The service holds readable content and allows authorised operator access; it does not provide end-to-end encrypted delivery.

You can block independently for 24 hours, seven days, or until you unblock. Either person's block stops contact, prevents friends-only profile voice access and reactions between them, and hides their shared voices from the other. Blocking a thread’s starter hides the whole thread; blocking a reply author hides their contributions. Blocking does not erase a name someone already learned or a copy they made outside the app. Established connections remain in account history while the accounts exist; account deletion removes the service records described below.

Location and device permissions

You can pick a starting area on the map without granting location access. An optional starting-area location action requests location while in use and rounds the selected coordinates to two decimal places. The service stores a selected area rather than continuous movement history. Additional-area purchase/unlock requires a separate fresh reading while physically inside its particular circle. This sends unrounded coordinates, accuracy, timestamp and software-simulation indication. The service validates the reading and issues a hashed account/area-bound permit lasting 30 seconds; its permit table does not store the raw reading or display it to members. The API suppresses routine access/request-body logs. Actual infrastructure handling is described below. Declining location still permits browsing, but prevents additional-area purchase/unlock. There is no background tracking.

The area label and who is available nearby can still reveal a broad geographic association. A local thread’s anchor is the centre of the starter’s selected owned area. The local-thread list shows anchors within 25 km of the viewer’s selected unlocked centre; access to that local thread, its replies and audio requires an anchor within any of the viewer’s unlocked 25 km areas. Profile voice threads instead follow the owner’s audience choice and profile/connection/block controls described above. These are selected-area permissions, not a measurement of current physical proximity or continuous location tracking.

The microphone starts only after you choose to record. The app provides playback before sending. A draft that you do not send, share or post is not uploaded through the private-message, local-thread or profile-thread APIs. Apple map services and system features may communicate with Apple under its own privacy information.

Information that stays on this phone

Favourites, saved conversation ideas, listening markers and saved-voice bookmarks are private device activity, scoped to your Sayroam account and API address. They are not sent as read receipts or synchronized to another phone. A voice bookmark keeps only the direct-message identifier, counterpart identifier and context; it does not copy audio or create offline access. The Saved list and playback still require current source authorization. Blocking, account restrictions, unavailable/deleted source content or other lost access cannot be bypassed by a bookmark. Stale links can be pruned after a successful complete refresh; an unsuccessful refresh does not prove erasure. Remove an individual bookmark or use Account → Clear saved activity; neither deletes the original voice. Signing out also clears this activity from the app.

Your saved live sign-in is held in the device Keychain. The app uses temporary files for recording and playback and removes the files it tracks when the session is cleared. The device's own backup and recovery behaviour remains subject to its settings.

The optional Wuzzzzup appearance is a one-time cosmetic, non-consumable Apple purchase with a US$4.99 base price; StoreKit shows the actual localized price before confirmation. It is not a subscription. The app checks the verified theme entitlement through StoreKit and stores your appearance selection on this phone. That selection alone is not proof of ownership. For the ordinary cosmetic purchase, Sayroam does not send this theme entitlement to its server or bind it to your Sayroam account ID. The separately enabled private financial test described below has different, account-bound test records and grants no ordinary appearance access. Apple processes the purchase under its own arrangements. Restore Theme uses the same Apple Account, including when you use another Sayroam account. The theme changes artwork only; it does not unlock areas or change who can receive your voices. Free artwork preview does not unlock the paid theme.

Password-account recovery uses a random 256-bit code that you save privately, for example in a password manager. Sayroam stores its hash, not the readable code. Creating or replacing a code requires your signed-in account and current password. If you forget your password, enter the account's username and saved code and choose a new password. A successful reset replaces the code and ends all existing sign-ins; save the replacement before signing in again. Recovery keeps the same account, purchase records and area access, subject to their existing account and purchase status. It does not undo permanent deletion or an account restriction. The saved-code flow does not send an email or use an emailed reset link. Account email is collected separately at signup or supplied through a chosen sign-in provider. Losing both the password and saved code leaves no automatic password-account recovery route; an email, purchase receipt or identity document does not let support bypass the ownership proof. Never send a password or recovery code to support.

Emoji search words and an unfinished movement-editing gesture are not profile biographies or messages. Saving a profile sends the selected emoji data and saved movement, not the picker search query.

Apple controls Genmoji creation, its keyboard storage and any reference-photo choices in that interface. Sayroam shares a bounded PNG thumbnail instead of Apple's original glyph description and identifier. A fixed image hint you select is public and may be spoken by VoiceOver. Resetting Sayroam does not remove items from Apple's keyboard.

For an ordinary area payment verified by Apple but awaiting server confirmation, the app keeps a recovery restriction in this phone’s preferences: your Sayroam account UUID, the area product identifier and the exact verified unfinished Apple transaction identifier or identifiers. These records contain no signed receipt payload, password, recovery code, identity media or payment-card details. They prevent another purchase for the same account/product while the payment remains uncertain; they do not grant a pass. A successful matching server acknowledgement clears that particular transaction marker, while another unresolved transaction stays restricted. Relaunching, an empty unfinished-purchase scan or changing accounts does not clear the original account’s restriction. The records have no automatic age-based expiry and may remain after sign-out or Sayroam account deletion. Use Recover purchases or contact support before buying again; Apple’s own purchase history is separate.

For an uncertain Gold handle purchase, this phone keeps an account/API-scoped recovery marker containing a random attempt identifier, its start time and, when returned by Apple as verified, the exact transaction identifier. It blocks another checkout while confirmation is unresolved. A server-confirmed active entitlement, acknowledgement of the exact matching transaction or a definite cancellation/no-payment result for that same attempt clears the relevant hold. An inactive or revoked status alone does not clear an unresolved checkout. The phone also keeps the last server-confirmed current original-purchase binding and restrictive revocation times for each original so stale state cannot show the old gold appearance. A late refund for an older purchase cannot hide a newer paid original. Only newer server-confirmed active purchase proof for the affected original clears that restriction; the service alone decides whether a new purchase is available. These local markers contain no identity documents, selfies, provider-check data, password, receipt or signed purchase payload. They have no automatic expiry and may remain after sign-out or account deletion. They do not grant an entitlement, transfer a purchase or erase Apple’s independent records.

Optional Gold handle

The Gold handle is an optional one-time cosmetic purchase with a US$1.00 base price. Apple shows the actual localized price before confirmation. It adds a gold-coloured shimmer only to your @username, where that username is already permitted to appear. Your separate display name stays ordinary and is not styled gold. It has no shield or verification badge and does not check or establish identity, age, uniqueness, safety, trustworthiness or intentions. It does not reveal a hidden name, change the connection rules, unlock an area or give extra messaging access.

Other members see your @username only after an accepted active connection and while both accounts remain eligible and neither person has blocked or paused the other. It is hidden before acceptance, during a block or pause, or when either account is inactive or restricted. A display name already shared with a connection may remain visible in connection history or a blocked list; hiding the @username cannot make someone forget information they already learned.

The service grants this appearance only after validating the Apple purchase and its binding to the original Sayroam account used to buy it. Payment alone, a saved preference or a screenshot is not an entitlement. Use the purchase-recovery/restore control with that same Sayroam account and the matching Apple purchase. Restoring does not transfer Gold handle to another Sayroam account, including an account using the same email or Apple Account. A refund or revocation removes the appearance; recovery does not override that result. There is no subscription.

Gold handle purchases remain unavailable until the app and service actually offer them. Do not buy an area pass or Wuzzzzup expecting it to grant Gold handle. Account deletion removes its account-linked service entitlement and does not itself request an Apple refund or transfer ownership. Contact support before deleting an account if a paid purchase is affected. Apple’s refund process and mandatory consumer rights remain protected.

Recorder collections, profile frames and local recording tools

The Recorder collection is one optional one-time US$2.99 base-price pack containing all twenty recorder looks: Ocean, Aurora, Cosmos, Sunrise, Forest, Ember, Glacier, Desert, Lagoon, Storm, Prism, Neon, Moonlight, Meadow, Confetti, Ripple, Vinyl, Lantern, Comet and Origami. The Profile frames collection is one separate optional one-time US$1.99 base-price pack containing all twenty frames: Halo, Orbit, Bloom, Scallop, Postage, Diamond, Woven, Laurel, Constellation, Wave, Circuit, Ribbon, Sunburst, Droplet, Facet, Bamboo, Cloud, Confetti, Aurora and Arch. These are two packs, not a charge for each design. Apple shows the actual localized price before any available purchase. There is no subscription.

The service validates Apple purchase proof and records product, environment, transaction/original-purchase identifiers, original Sayroam account binding and purchase/refund/revocation status for each pack. Recovery/restore requires that original Sayroam account and matching Apple purchase; the same email or Apple Account does not transfer it. A refund or revocation removes the affected paid appearance. Account deletion removes account-linked collection records and does not request a refund or transfer ownership. This is distinct from Wuzzzzup's existing Apple-Account-based ownership. Apple and Railway remain the existing providers.

A paid recorder design is saved locally in account/API-scoped preferences and never alters the recorded voice, pitch, speed or duration limit. A curated frame choice is different: the service stores only the owner's selected frame identifier (or none), update time and paid/test source marker alongside the account. Eligible viewers receive a paid frame only with that owner's published emoji profile and active frame-pack proof. Historical free-test frame choices are not shared by the public service. Changing a frame does not upload a new image, publish a historical pending profile edit, expand profile eligibility or reveal hidden names/@usernames. A stored selection alone never grants paid ownership.

Like Gold handle, each collection can keep small account/API/product-scoped device markers for an interrupted purchase, its random attempt identifier, start time, prior original-purchase binding and verified matching transaction if available, the last server-confirmed original-purchase binding and restrictive per-original signed/revocation times. These contain no audio, password, payment-card data or raw signed purchase payload. They prevent duplicate payment or stale appearance; they do not grant an entitlement. Unknown/pending results remain restricted until matching confirmation, active server proof or a definite matching cancellation/no-payment result resolves them. A terminal refund acknowledgement can resolve an unknown-transaction hold only when verified account/product proof identifies the same new original purchased during that attempt; a newly signed refund for an older original cannot clear it. An inactive ledger alone does not prove a pending checkout was cancelled. There is no automatic marker expiry, and local restrictions can remain after sign-out or account deletion. Apple's independent history is separate.

Pause/resume and trimming run on the device and are free. Paused time is excluded from the 30-second capture budget, and a paused recording must be stopped before sending. Backgrounding, interruption or route loss finalizes/stops capture and cancels an unfinished trim. Trim exports a selected interval of at least one second into a separate protected temporary file without pitch/time changes or voice effects. The original is kept while the composer remains open so a successful trim can be reset; failed/cancelled exports do not replace the draft. Trimming itself uploads nothing. Only the separate send/share/post action uploads the chosen draft. Tracked temporary original/trim/playback files are removed when the relevant session is cleared, subject to the device's own handling; no universal physical-erasure guarantee is made. An attempted send freezes that draft for retries until an explicit new recording is chosen.

Optional notifications

If enabled and configured, live voice alerts use Apple Push Notification service (APNs). Sayroam links this installation's identifier and Apple device token to your account/session for eligible delivered hello, voice-message or mutual-connection alerts. Local threads and profile voice posts do not generate these alerts. The service keeps limited queue/delivery-attempt records. Apple receives the token and generic payload, including the recipient's internal account ID so the app can open Home → Your voices for the correct account, rather than another member's name, profile, recording or location.

Control live alerts under Account → Notifications. Turning them off asks the service to remove this installation’s registration. If that request cannot reach the service, removal is not yet confirmed; iPhone notification settings can stop presentation on the phone. A remaining registration cannot send through an expired account session. Delivery depends on Apple, network conditions and your iPhone settings. An alert already sent to Apple or displayed on the phone cannot be recalled by the service.

Send local test schedules a generic sample on this iPhone after five seconds. It does not contact the remote notification server or establish that live alerts work. The optional weekly reminder is also scheduled locally; it is a reminder to open the app, not an incoming-message alert. You can manage these controls in the app and iPhone notification settings.

Why we may use information

Where UK or EEA data-protection rules apply, our bases for using information are:

These explanations do not turn a device-permission prompt or acceptance of general terms into consent for every use of personal information. Contact gravies.11.ribbons@icloud.com about a privacy request. In-app account deletion removes the linked service records and queues affected file cleanup. State the username or reference you already know and do not send a passport or selfie by ordinary email. We explain the consequences and any alternative before you choose.

Providers, other recipients and international handling

Railway hosts the API and stored app data. The joinsayroam.com website and its policy pages are delivered through OpenAI Sites and Cloudflare infrastructure. The service and its persistent volume are in US West / San Francisco, United States. Apple handles optional sign-in, App Store billing and APNs delivery; Google handles its optional sign-in. The support mailbox uses iCloud. AI moderation assistance is disabled.

Railway publishes a Data Processing Addendum. Apple and Google describe their sign-in processing in the notices linked above.

Sayroam is operated from Switzerland; the Railway API and persistent volume are in US West/San Francisco, United States. Railway Corporation publishes a Data Processing Addendum describing a customer-controller/hosting-processor relationship, separate company account/usage purposes and transfer clauses including EU SCCs, a UK Addendum and Swiss adjustments where applicable. Its Terms incorporate that DPA where applicable, while the published DPA also specifies an execution procedure. The operator has confirmed signing the customer-specific DPA. Railway’s counterexecution and the effective customer-contract record have not yet been independently verified, so we do not represent those steps or a completed customer-specific transfer assessment as confirmed. Ask our privacy address for the applicable available safeguards/terms or a copy. Apple/Google handle chosen authentication under their linked notices; Apple also handles billing/APNs and the iCloud support mailbox. Other members and authorised shared review-account users may be abroad. These services are not described as EEA-only; an EU hosting default at another provider would not change the US API location.

We assess disclosures outside ordinary service operation under applicable law, for example a binding legal demand or a necessary response to a specific safety incident. This is not a promise that every request will be granted.

Private recipients and eligible thread listeners may be in other countries. Sending a private voice shares it with its recipient; sharing a local thread makes it available to eligible listeners with the required area access. Posting to a profile thread shares approved recordings with accepted friends or eligible signed-in profile viewers under the owner’s selected audience. Ask our privacy contact about safeguards applicable to your information.

Apple processes optional remote notifications through APNs as described above. The recipient account ID in the payload identifies the signed-in recipient; it is not another member’s display name. Apple’s services and device settings also control notification presentation.

Apple processes App Store payments. Sayroam receives purchase-verification information and account-linked transaction records, not your payment-card number through the app's purchase flow. Apple's records and applicable billing rights are separate from Sayroam's account records.

The app contains no advertising or third-party analytics SDK. Routine API access/request-body logging is suppressed, including location payloads and authorization data. Infrastructure logs, email and backups have separate handling described below.

Retention and deletion

We use these periods or specific criteria:

To remove one of your own profile voice posts, open Profile → Your voice thread, choose Delete post on it and confirm. The post becomes unavailable and its reactions are removed. The service queues media erasure; limited moderation/report and retry records remain as described in the table. An individual post deletion does not delete private messages, local threads, the account or other profile posts. Deletion cannot recall a copy another person independently saved.

Delete your account under Account → Delete account → Delete permanently. A successful request removes your account and its linked database records from Sayroam's service, including connections, profile versions, blocks, reports, push registrations, related queued alert records and account-linked purchase rows. The independent notification/reconciliation metadata described above has a different lifecycle. Private recordings you sent or received are removed from app access. Your profile voice posts, their selected-audience preference, linked reactions and linked review/report/retry records are removed; your reactions and reports on other profile voice posts are removed too. Deleting the account that started a local shared thread removes the entire local thread, including replies recorded by other members. Deleting a reply author’s account removes that person’s replies from others’ local threads. Associated media files are queued for erasure, with retries if cleanup cannot finish immediately. Completion arrangements are that affected files enter a retryable erasure queue. Cleanup is attempted immediately, on startup and on later service activity, in bounded batches. A failure can delay physical erasure without restoring app access. There is no guaranteed physical-erasure completion time; contact our privacy address about a pending request.

If unresolved profile-upload cleanup prevents the service from safely accounting for stored media, an individual or account-deletion request can fail with an error instead of claiming completion. Retry or contact our privacy address. When local account deletion is confirmed, access has stopped even if an acknowledged media-erasure queue is still pending. A cleanup task or deletion marker is not a promise that every physical or backup copy has already disappeared.

Reviewer-exported copies follow the handling above. Apple’s records follow Apple’s processes. Deletion cannot erase a recording or image another person independently captured. Signing out or removing the app does not delete a live account.

Website visitors and enquiries

This information website has no signup, payment or upload form. Our website code adds no advertising or analytics cookies/scripts or browser storage, externally hosted fonts or embedded third-party content. Hosting and security providers may use essential security cookies, such as Cloudflare __cf_bm for bot protection, and security-challenge cookies when required. Cloudflare says __cf_bm expires after 30 minutes of continuous inactivity. See Cloudflare’s cookie information. A page request supplies connection information such as IP address, requested URL and browser information to deliver and secure the page; OpenAI Sites and Cloudflare handle website delivery, infrastructure and security metadata. Railway continues to handle the separate app backend as described above. Emailing support sends the address, message and any attachments you choose to our iCloud mailbox. Website delivery/security relies on our legitimate interests in providing and protecting the requested pages; enquiries follow the support and rights-request bases above. The website implementation creates no Sayroam visitor database or retained request bodies. Hosting providers may retain their own delivery, security and operational records under their applicable notices. Infrastructure and correspondence follow the retention criteria below.

Infrastructure logs, backups and required records

Routine application request, access and body logging is suppressed. Railway processes infrastructure and security information separately, including network and platform metadata; its log-history and administrative-audit availability windows are not guaranteed erasure deadlines. No Sayroam-managed automated or offsite production backup is configured or confirmed. Provider-controlled recovery copies, logs and legal/security records follow the provider's processes; no Sayroam-specific physical-erasure deadline for those copies has been verified. Account-linked transaction and area-credit/use rows are removed with the account. Minimal Apple notification-event metadata and purchase state received after account removal can remain without an account link; this release has no automatic time-based purge for those records or the remaining random cleanup-completion metadata. A missing account link does not establish anonymity. No separate Sayroam statutory accounting-retention period is claimed. The support and downloaded-review-copy periods above do not determine infrastructure, Apple or provider-copy retention. Contact our privacy address about a particular record or pending erasure.

Security

The release app requires HTTPS. Passwords are verified using salted password hashes; server session tokens and recovery codes are stored as hashes. Recovery codes are single-use and replaced after a successful password reset. Administrative moderation and service credentials are restricted to service/operator use and are not embedded in the iPhone app. The four isolated fixture credentials permit member access only within their separate fictional review tenant. The separately supplied ordinary Sandbox purchase-review credentials authenticate a normal member account: Sandbox-only payment classification is not social-data isolation. That account can access real members or content whenever the normal area, audience, contact, blocking and safety rules permit. Both kinds of credentials are supplied privately for review and provide no administrative moderation access. The application restricts database/file permissions. These protect transport and service access; they do not provide end-to-end encryption or guarantee that an incident will never occur. Authorized review remains possible as described above. Backup and other infrastructure handling follows the section above.

Private owner financial tests

Historical private Apple Sandbox/TestFlight area-pass, theme and activation financial-test records can remain for the designated owner account. New checkout in that restricted financial lane is retired; signed status, reconciliation and refund/revocation handling remain. Those private financial tests grant no ordinary social access, usable area unlock or paid-theme appearance. They are separate from both the four isolated fixture accounts and the ordinary Sandbox purchase-review account described below. The financial screen requests no microphone or location reading and does not collect identity evidence.

The existing account's authentication and recovery records remain in use. Sayroam stores a separate test ledger and reservations, product/environment, relevant Apple transaction identifiers, account links, times and financial status on its existing Railway service in US West / San Francisco. Raw signed Apple payloads are verified rather than retained as a receipt archive. Apple handles its own account and test-purchase records. Other members do not receive the test ledger.

Before an offer, the iPhone stores the test account identifier to keep matching private Sandbox theme transactions out of ordinary theme handling. A pending/uncertain checkout additionally stores its product, a random attempt identifier and, if direct verified success supplied it, the exact Apple transaction identifier. These local preferences contain no password, receipt or signed payload. Only cancellation for that same attempt or server acknowledgement of its recorded matching transaction clears the pending hold; older receipts do not clear a newer attempt. An unknown pending checkout can remain blocked and need support even after a later test result is confirmed. The markers survive relaunch, sign-out and an account switch, with no automatic expiry.

Linked account/test rows are removed with account deletion; independent Apple event and later unlinked lifecycle metadata can remain as described in the retention table. Deleting the Sayroam account need not erase local exclusion markers or Apple's history. Stopping tests, signing out or removing the app does not erase server-side test records. See the private purchase-test privacy notice for the limited test's handling, deletion and support routes.

Four isolated hosted App Review fixture accounts

Each of the four separately supplied fixture accounts uses an isolated hosted test area with fictional members, sample tones and simulated account/area access. It does not establish a real identity or a paid Apple entitlement. New Apple purchases and remote push delivery are unavailable there. The app labels this account as a review sandbox.

A recording you explicitly send, a profile you save or another test action can still create real server data. The operator and relevant holders of the supplied test credentials may access it under the account's ordinary audience and human-review rules. There is no automatic content-age expiry; account/profile removal and retryable media cleanup apply as explained in the review-account privacy notice. Sign-out or app removal does not erase hosted test data. This is separate from the on-device offline demo described below.

Separate ordinary Sandbox purchase-review account

A separate account is supplied for Apple to test genuine Sandbox purchase and restore flows. It is an ordinary Sayroam account stored and authenticated by the normal service, with an operator-designated durable Sandbox-only payment classification. That classification rejects Production transactions and keeps its signed financial lifecycle in the Sandbox environment; it is not an isolated social tenant, an identity check or a synthetic paid grant.

The account starts without a paid entitlement, unlocked area or connection. If its holder chooses a first area, publishes a profile, sends content or connects, the normal free-account, area, audience, consent, reporting, blocking and moderation rules apply. It may encounter real eligible members or content under those rules. Use generic test material; its inbox and profile are not private personal storage when credentials are supplied to more than one authorised reviewer. No account password, Apple credential, raw signed receipt or secret key is made public by this notice.

When enabled and completed, genuine signed Sandbox purchases can grant the normal tested area or cosmetic benefit to this account under the applicable ownership, presence and progression rules, without a real financial charge. Recovery, refund/revocation and account deletion follow the ordinary handling described in this policy and Terms, with Sandbox and Production records kept separate. Sandbox availability is not proof that an actual device purchase or refund has succeeded. The four isolated fixture accounts cannot use this ordinary payment lane, and the older restricted owner financial tests do not supply its entitlements.

Your rights and choices

Depending on the laws that apply, you may request access, correction, deletion, restriction, an appropriate portable copy or review of a disputed automated outcome. Contact gravies.11.ribbons@icloud.com. We may need proportionate information to confirm that a request concerns your account; do not send identity documents by ordinary email unless a verified secure process specifically requires them.

You may object to processing based on legitimate interests, where that right applies. You may also withdraw consent for a use that relies on consent. We assess requests under the applicable rules and explain any permitted restriction. Our rights-request procedure is to email gravies.11.ribbons@icloud.com with the request and the username/reference you already know. We may need proportionate ownership checks, explain permitted limits and respond under the law that applies. Do not send your password, recovery code or identity documents by ordinary email.

You can complain to the relevant data-protection authority. In Switzerland, information is available from the FDPIC; in the UK, from the ICO. As of 18 October 2026, MansaMusaInvst. has no EEA or UK establishment and has not appointed an EEA or UK privacy representative. The initial public offering excludes the EEA, UK, China mainland, Türkiye (Turkey), Indonesia and Australia; planned expansion is subject to the applicable regional arrangements. Our Swiss controller and privacy contact remain available for existing requests. An App Store availability restriction is not an exemption from any duty that still applies to actual processing. These contact details will be updated if genuine appointments are completed.

Adults, demonstrations and changes

Sayroam is for people aged 18 and over. If you believe a child is using the service, report the account or contact gravies.11.ribbons@icloud.com. Our response is to assess the report, restrict access where appropriate and apply the account/content removal process; a checkbox does not establish age. Support must assess reported or disputed existing-account concerns rather than treating an email as proof of age.

The on-device demo uses fictional people and simulated account access, review and purchases. Your microphone is real, but demo recordings and profile changes stay in that session and are not delivered to another phone. Leaving, resetting or restarting clears the demo. A local sample or enabled reminder can remain after force-closing until the next launch cancels it. The demo does not register for remote voice alerts. Apple maps and keyboard features remain separate from the demo's local data.

We date and version our notices and keep the current pages available through the app's Privacy & Rules links. Before applying a material change, we explain the change and provide any advance notice, agreement or separate consent required. We defer the affected change until the necessary notice and choice arrangements are in place. Publishing an updated page alone does not record your agreement or consent. The revision and effective date above identify these notices. Publishing an updated page does not itself change your existing service choices or record any separately required agreement.

Support and deletion · Terms

System text and colour styles on your device

The five tabs are Home, Connections, Explore, Profile and Account, in that order. Open Account → Themes for Colour style, Your recorder, Profile frames and Gold handle controls. Profile contains your published profile, Edit profile and Your voice thread, without a shop or cosmetic selectors. Remove your emoji profile through Profile → Edit profile → (…) → Remove profile; removal deletes stored profile versions, not your account or connections. Private conversations are in Home → Your voices. Text uses a fixed system font with iPhone text-size/accessibility settings; there is no font-style selector or font purchase. Lilac & Pearl is free; other colour choices require the separate Colour styles pack described above.

Colour styles

Lilac & Pearl remains the free default. The optional one-time Colour styles pack has a US$2.00 base price and includes all twelve supplied styles; it is not a payment for each style. Apple shows the actual local price before any available purchase. Previewing is free; applying a paid colour requires current server-confirmed pack ownership bound to the original Sayroam account and matching Apple purchase. Restore does not transfer the pack to another Sayroam account. Refund, revocation, account restriction or sign-out returns the visible style to the free default.

The selected paid colour is saved only in device preferences scoped to the API address and Sayroam account. The service receives purchase proof and keeps the account-bound entitlement/lifecycle records, not the chosen colour identifier. Old unscoped free-test colour preferences are ignored in paid mode. A saved preference is not an entitlement and never authorizes a later charge. This is separate from the existing Wuzzzzup artwork ownership, which follows its purchasing Apple Account.