Podkin Privacy Policy

At a glance

This policy covers the Podkin iPhone app from the App Store and its TestFlight beta builds, and the Podkin Android app from Google Play and its testing builds. Where the two apps differ, this page says so. Podkin is provided by Atelier Advani LLC, an independent software studio in New York.

• Your library and saved conversations are stored on your device. There is no Atelier Advani account or studio-operated service storing your library.
• Podcast discovery and delivery contact Apple and podcast providers. Speaker detection runs on the device; on iPhone its models download once from Hugging Face, and on Android they come with the app.
• AI features can send voice, transcript text, episode details, and questions to the AI providers Podkin works with — currently OpenAI, Anthropic, Google, Groq, and OpenRouter — after you choose Allow AI features. Podkin sends them through Atelier Advani’s server, on the studio’s accounts with those providers. Some topic and chapter generation, and Podkin’s own notes about episodes, happen without starting a conversation.
• Purchases go through Apple on iPhone and Google Play on Android. Atelier Advani’s server receives the store’s purchase records, never your payment details, to count your Ask minutes, and keeps a pseudonymous record of them.
• Usage analytics sends counts, timings and feature use to PostHog for Atelier Advani. You can turn it off in Settings → Privacy.
• We receive support information you send and, for beta testers, information Apple shares through TestFlight. We do not sell personal information.
• The iPhone app from the App Store includes Meta’s SDK only to measure Podkin’s own ads on Instagram and Facebook. It tells Meta a few moments, such as the app being opened and Plus being bought, and nothing about what you play, search or say. Podkin never asks to track you across other companies’ apps, and it follows the same Share usage analytics switch.

Information on your device

Podkin stores subscriptions, episode details, playback positions, queue and download settings, downloaded media, transcripts, generated topics and chapters, saved conversation text, ratings, and local diagnostic information on your phone. It uses this information to play episodes, maintain your library, provide episode context, and let you return to a conversation.

Private-feed credentials are stored in the iOS Keychain. So is a random installation identifier, kept on this device only, which survives reinstalling Podkin; it identifies your free Ask minutes and is attached to your purchases, as described under Plans. On Android, private-feed addresses are encrypted with a key held in Android’s keystore, and the random installation identifier is kept in Podkin’s own storage on this phone, left out of backups and device transfers; it does not survive reinstalling. Importing an OPML file reads the subscriptions from the file you choose and contacts their feed providers. We do not receive your OPML file.

When a publisher does not supply a transcript, Podkin can transcribe downloaded episode audio using Apple’s on-device speech tools. This transcription does not upload the episode audio to Atelier Advani or any AI provider. Transcript text may later be sent for AI features, as described below.

The Android app does not transcribe on the phone. After you choose Allow AI features, it gets a public episode’s transcript from Atelier Advani’s server, as described under AI features: it reduces its own download to an acoustic fingerprint on the phone and uses it to line the server’s transcript up with that download. The fingerprint stays on the phone. The server never fetches a private feed, so on Android an episode from a private feed has no transcript yet.

To tell the people in an episode apart, Podkin analyzes the downloaded audio on the phone and keeps voiceprints — numerical descriptions of each voice, not recordings — beside the episode. When an episode names a speaker, Podkin remembers that person’s voiceprint with their name, so it can recognize them in later episodes that mention them. These voiceprints are of the podcast’s speakers, never of you; they stay on the device (on Android, made with models that come with the app), are never sent to Atelier Advani, an AI provider or anyone else, and are removed when you remove the show. Device backups you enable are governed by your backup provider’s settings and policies.

Microphone and voice commands

Podkin requests microphone permission so you can talk to the companion. During a conversation, microphone audio is sent to an AI provider Podkin works with (currently OpenAI) for processing, transcription, and a spoken response, through Atelier Advani’s server. Text from the exchange is saved in the episode’s notebook, and recognized speech may appear in the local diagnostic log.

When Listen for commands is on and your audio route supports it, the microphone can remain open during playback to recognize commands on the device. Setup enables this feature after you allow microphone access. Command recognition runs locally; starting a conversation begins the AI voice exchange.

Turn off Listen for commands in Podkin’s Settings → Voice commands to disable that hands-free listening, or revoke microphone permission in iPhone Settings or in Android’s settings for Podkin. Ordinary podcast playback works without microphone permission.

AI features and AI providers

The App Store build sends requests through api.podback.atelieradvani.com, and TestFlight builds through podback-api.atelieradvani.com; the Android app from Google Play uses the first and its testing builds the second. Requests go through these servers, operated by Atelier Advani on Amazon Web Services in the United States, and then to one of the AI providers Podkin works with, using the studio’s API accounts. You never provide a key, and you do not need an account with any of these providers.

The AI providers Podkin works with are currently OpenAI, Anthropic, Google (the Gemini API), Groq, and OpenRouter, which passes requests on to the AI model providers it works with. Atelier Advani chooses which provider handles each feature, conversations included, and may change that choice without an app update; any of the information described below for a feature may go to whichever of these providers handles it. We will update this policy, and ask for your permission again in the app, before adding a provider not named here.

This server processes conversation audio, questions, transcript context, and responses in transit. It does not save conversation content or your library to its database, and does not put request or response content in application logs.

After you allow AI features, public podcast episodes listed in the catalog can contribute transcript passages, and the topics, thoughts and speaker names generated from them, to a shared cache on this server. These records last up to 30 days and let other listeners of the same episode reuse them, timed to their own copy of the episode. Cache records contain no listener identifier, conversations, listening history, or record of which thoughts you saw or dismissed. Private feeds are excluded. Turning off AI features stops new contributions; it does not remove public passages already cached.

For the same public episodes, Podkin also reduces your downloaded copy to an acoustic fingerprint, a sequence of numbers describing the sound from which the audio cannot be recovered, and sends it to this server with the transcript’s sentences and where its ads fell. The server keeps these by the episode alone, for up to 30 days, and gives them to other listeners’ phones, which line their own copy up with that transcript instead of transcribing it. Nothing about you goes with it. Private feeds are never shared.

Where no other phone has shared an episode and yours would be slow to transcribe it — or cannot, as an Android phone cannot — Podkin sends the server the episode’s public address and its show’s feed address, and the server downloads the public episode itself, once, and transcribes it with one of the AI providers named above (currently OpenAI). It keeps the transcript and a fingerprint of its own copy for up to 30 days, never the audio, and nothing about you or your copy. Podcast publishers can ask us not to do this; see how Podkin reads public episodes.

For a public episode in the catalogue, Podkin also sends the transcript a few minutes ahead of where you are listening to Atelier Advani’s server, which picks the moments a drawing would help with and draws them with the AI providers named above. It keeps the drawings, the moments and the lines they draw for up to 30 days, by the episode alone, and shows them to every listener of that episode. Nothing about you goes with them. For a private feed, Podkin sends the same transcript passages, and the server draws the sketches for you alone and sends them back to your iPhone, keeping nothing of them. The Android app does the same: it sends the same transcript passages, and a private feed’s sketches, like a sketched answer, are kept on your phone.

TestFlight beta builds use the testing server without an Apple account sign-in. It sends a random installation identifier with its requests. The server hashes that identifier, stores daily request and voice-session counts to enforce testing limits, and sends the hashed identifier to the AI providers for abuse prevention. The identifier is pseudonymous, not anonymous. Usage records older than seven days are removed as requests are processed. Network infrastructure and service providers also receive connection information needed to operate and secure the service.

Every build also asks Atelier Advani’s server which AI models Podkin should use and which of its features are switched on. That request carries the app’s version number and no identifier, and the server does not log it. When a new model is tried on some devices first, whether yours is one of them is worked out on your device.

On iPhone, when you pause an episode, Podkin asks Atelier Advani’s server to remove its Live Activity from your Lock Screen a few minutes later, through Apple’s push notification service. The request carries the push token Apple issues for that one Live Activity, what it shows (the episode and show names and where you paused), and no identifier. The server keeps the request only until the Live Activity is removed or the request is cancelled, at most a few hours, and passes it to Apple to deliver.

• Conversations send your voice, episode details, playback context, relevant transcript text from what you have heard, and relevant conversation history so the companion can answer in context.
• Web lookups send the question, the claim being checked when applicable, and the show name to an AI provider’s web-search service. Search queries may be handled by that provider’s search providers.
• For episodes without published chapters, with Write chapters on, an AI provider writes the chapters from the episode’s transcript: the whole transcript once it is complete, or half an hour at a time while it is still being prepared, including portions you have not yet heard. Write chapters is on by default. With it off, topics are written as you listen by an on-device model when available, and otherwise by an AI provider from parts of the transcript.
• To find an episode’s ad breaks, Podkin sends its transcript to an AI provider in overlapping excerpts as it is transcribed, closest to where you are listening first, including portions you have not yet heard. With Skip ads on, the breaks it finds are skipped.
• To name who is speaking, Podkin sends parts of a finished episode’s transcript, marked by voice and including portions you have not yet heard, with the show’s published credits. No audio or voiceprint is sent; a name is kept only if the episode’s own words support it.
• Podkin’s thoughts during an episode send each topic’s transcript once it has been transcribed, which can include parts you have not heard yet, so Podkin can offer something useful about it. A thought appears only after you have heard what it is about.
• To choose a line for each episode card on Home, Podkin sends sentences from the first 15 minutes of the transcript of episodes you have not started, or from what you have heard of ones you have. The line itself is always words said in the episode, never a model’s own.
• To notice when a new episode gets into something you asked before, Podkin first sends each conversation you save, with the lines you had just heard, to decide whether it held a question worth remembering and to write that question down on its own. It then sends the questions it kept together with passages from the new episode’s transcript. This happens while new episodes are prepared, before you play them.
• Sketching an answer sends your question and the first part of Podkin’s answer, to decide whether a drawing would help and to draw it beside the answer. The sketch is kept with the conversation on your phone; nothing of it is kept on the server.
• Hooks for new episodes in Home’s greeting send each episode’s title and the publisher’s summary.
• Add a show sends the public name, author, category and description of the shows your search finds, to write one line about each. Private and pasted feeds are never described.

In every build, AI features are off until you choose Allow AI features. The permission screen is available during setup, when you tap Ask, and in Settings → Privacy → AI features. This choice covers conversations, web lookups, hosted topics and chapters, and the companion’s thoughts, Home’s lines and callbacks, and Add a show’s descriptions. You can keep playing podcasts without allowing these features.

Choose Turn off AI features on that screen to withdraw permission. This stops new sharing through Atelier Advani’s server and cancels active voice and text requests; it does not erase information already processed by service providers. Features that work entirely on the device and published chapters remain available.

Once AI features are enabled, background requests can occur during listening without tapping Ask. Turning off Write chapters limits advance chapter generation but does not disable topic generation during listening. Microphone permission and chapter settings are separate controls: denying the microphone alone does not prevent transcript-based AI requests.

Subscriber feed addresses are protected and redacted from AI context, but the content of a private episode may still be included in transcript context. Use these features only with content you are comfortable sending to these AI providers.

Each AI provider handles the requests it receives under its own terms and privacy policy, and may retain content for a limited time for abuse monitoring and service operation. Removing information from Podkin does not remove copies already processed by a provider. See Anthropic’s privacy policy, the Gemini API terms, Groq’s privacy policy, and OpenRouter’s privacy policy; requests OpenRouter passes on are also subject to the policies of the provider that serves them.

OpenAI states that API content is not used to train its models unless you opt in to share it. OpenAI may retain content and operational information for abuse monitoring and service functionality; standard abuse-monitoring retention is up to 30 days, with exceptions described in its documentation. Podkin’s standalone text requests disable saved Responses, but that does not disable abuse-monitoring retention. Retention also depends on the feature and the API account’s controls; App Store and TestFlight requests use the studio’s account. Removing information from Podkin does not remove copies already processed by OpenAI. See OpenAI’s API data controls.

Plans, purchases, and Ask minutes

Listening is free. Asking is measured in Ask minutes: ten come with the app, Podkin Plus is a monthly subscription with thirty more each month, and extra minutes can be bought at any time. On iPhone, Apple processes every purchase and subscription under its own terms and privacy policy; on Android, Google Play does. We never receive your name, Apple Account, Google account, or payment details. Manage or cancel a subscription in iPhone Settings → your Apple Account → Subscriptions, or in Google Play → Payments and subscriptions → Subscriptions.

To count your minutes, the app sends Atelier Advani’s server the signed purchase records the App Store gives it: transaction and original-transaction identifiers, the product, purchase and renewal dates, the App Store environment and, while a renewal payment is being retried, its renewal status. Your purchases carry the installation identifier described above, so the server can tell which installation bought them. Apple also notifies the server of renewals, refunds and other changes to these purchases.

For the free minutes, the server keeps a hash of your installation identifier. To stop free minutes being claimed over and over, a new installation first proves it is Podkin on a genuine iPhone with Apple’s App Attest: your iPhone asks Apple to vouch for a key made on the device, and the server keeps only a hash of that key. When free minutes start, the server also counts new starts per network address for the day, under a keyed hash of the address that is removed within a few days.

On Android, the app sends the server the purchase records Google Play gives it: the purchase token, the order number and the product. The server checks each with Google, confirms it to Google, and Google notifies the server of renewals, refunds and other changes. Each purchase carries a hash of the installation identifier described above, so the server can tell which installation bought it. For the free minutes, in place of App Attest, the phone sends a hash of the identifier Android gives Podkin on that device (its Android ID, which Android keeps through a reinstall and changes with a factory reset), which the server hashes again, together with Google Play Integrity’s answer that the request comes from Podkin installed from Google Play on a genuine device. Podkin never stores that identifier on the phone. The server keeps the account the device last had Podkin Plus on under the same hash, so a lapsed subscription bought again finds its minutes.

The server keeps a ledger of minutes: for a subscription, the purchase identifiers, the current period’s dates and the seconds used; for the free minutes, the hashed installation identifier and the seconds used; extra minutes bought and what is left of them; each purchase it has seen and whether Apple or Google refunded or revoked it; and, for three days, a random identifier per conversation so a conversation is never counted twice. It records how long each conversation lasted, not what was said: it does not save conversation audio, questions, conversation transcripts or answers. It also keeps daily request and voice-session counts under a hashed identity to enforce usage limits, removed after seven days, and sends the AI providers a hash of your ledger account, never a purchase identifier itself, for abuse prevention.

If you ask Apple for a refund of a Podkin purchase, Apple may ask us about it, and the server answers from the ledger: whether the purchase was delivered, how much of its minutes you had used, and that ten free minutes came first. It sends nothing else about you, and states no preference about the refund; Apple decides. Buying a plan or extra minutes means you agree to this, as the purchase terms say. Google Play decides refunds of Android purchases without asking us; when it refunds one, the server takes back the minutes that purchase bought.

The ledger deletes each record on its own 13 months after it last changed — for a subscription, 13 months after its last period ends — except that an account holding extra minutes is kept while it holds them, since they do not expire. The ledger is backed up continuously, so a deleted record can remain in backups for up to 35 days. The server’s own logs, kept for 30 days, record its operation, never a credential, a request’s content or a conversation. These records are pseudonymous, not anonymous. To ask about or delete them, email us the support code shown in Podkin under Settings → Privacy (the row there writes the email for you), or the order ID from Apple’s or Google Play’s purchase receipt; deleting a record also removes the minutes it holds. Deleting the app does not remove the installation identifier from the Keychain, so reinstalling does not start the free minutes again; on Android the free minutes follow the hashed Android ID, so reinstalling does not start them again there either.

Podcast and Apple services

Searching for a show by name sends the search text to Apple’s iTunes podcast directory, which Add a show also asks for episodes matching the search. Reading feeds, downloading or streaming episodes, and loading artwork, transcripts, or published chapters contacts the providers hosting that content. Those providers receive the request, your IP address, and ordinary connection information, and may use them for delivery, security, or their own analytics.

On iPhone, speaker detection uses machine-learning models that Podkin downloads once from Hugging Face, pinned to a published version and checked before use. That download sends Hugging Face and its content delivery network ordinary request and connection information, including your IP address; no podcast audio, transcript or voiceprint is sent there. See Hugging Face’s privacy policy. The Android app downloads nothing from Hugging Face: its models for speaker detection, voice commands and laughter come with the app.

On Android, reading along with a public episode needs its show’s number in Apple’s directory; for a show you added by its feed address or an OPML file, Podkin looks it up by the show’s title. Private feeds are never looked up.

Private feed requests include the subscriber address or credentials needed by the publisher. Treat these addresses like passwords. Podkin does not send a pasted feed address to Apple’s directory as a search query.

See Apple’s privacy policy and, for Google Play and Play Integrity, Google’s privacy policy. Podcast providers publish their own policies. Providers may process information in the United States and other countries where they operate.

Usage analytics

Release and TestFlight builds send product analytics to Atelier Advani’s PostHog project in the United States to help us understand what is useful and improve reliability. Share usage analytics is on by default; turn it off in Settings → Privacy to stop new collection. This choice is separate from microphone permission and the permission for AI features. On Android, the app from Google Play sends the same usage analytics, marked as Android’s. Turn it off in Settings → Privacy.

Events include library, queue and download counts; listening time and episode completion; setup, discovery and feature use; answer ratings; coarse error categories; playback and answer timings; numeric AI usage and estimated costs; and app version, build, device model and OS version. A random installation identifier connects events from the same installation. Show, episode and saved exchange identifiers are transformed with an installation-specific key, so they cannot be matched across installations or read as podcast addresses. The one exception is a public show listed in Apple’s podcast directory: its events also carry the directory’s public catalog number for the show, so that we can see which shows many people listen to. We name a show in our own reports only once 25 or more installations have played it. For a public show you added by its feed address, Podkin looks the show up once in Apple’s directory by its title to find that number, and only while analytics is on. Private feeds never carry a catalog number and are never looked up. These identifiers are pseudonymous, not a guarantee of anonymity.

These events do not include podcast titles, feed or media addresses, search text, transcript or conversation text, recordings, API keys, emails, or Apple transaction identifiers. Automatic screen capture, session replay, person profiles, location enrichment and automatic exception uploads are disabled. The project discards client IP addresses from stored events, although PostHog receives connection information in transit to operate its service. See PostHog’s privacy policy.

Turning analytics off removes its pending local queue and resets the local identifier. It does not recall requests already in flight or erase events already received. Analytics is retained only as long as needed to improve the app and meet legal obligations. Contact us with privacy requests; because no contact profile is attached to these events, we may need additional information to locate an installation’s records. We do not use these analytics for advertising or sell the information.

Measuring our ads

We advertise Podkin on Instagram and Facebook. To learn which of those ads bring people to Podkin, the iPhone app from the App Store includes Meta’s software development kit and tells Meta Platforms, Inc. when Podkin is opened, when the first-run setup is finished, when the first episode has played for a minute, and when Plus or more Ask minutes are bought, with the price. Meta’s SDK also receives device and app information such as the app version, iOS version, device model, language and a random identifier Meta’s SDK creates for this installation, and Meta receives connection information such as an IP address.

Nothing about what you listen to, search for, ask or say goes to Meta, and no podcast title, feed address, transcript, recording or Apple transaction identifier. Podkin does not ask iOS for permission to track you, so it never reads your advertising identifier, iOS blocks Meta’s tracking address, and Meta counts these events only in the aggregated, limited form Apple and Meta provide for apps that do not track. Meta’s automatic event logging, advertiser identifier collection, screen and app-link metadata, app-layout sampling and crash reporting are turned off.

TestFlight builds and the Android app send nothing to Meta. Turning off Share usage analytics in Settings → Privacy stops these events too, and removes the identifier and any unsent events Meta’s SDK kept on your phone; it does not recall events already sent. Meta processes this information under its own terms; see Meta’s privacy policy.

Support, diagnostics, and TestFlight

When you email us, we receive your email address, message, and any attachments you choose to send. Mail is hosted by Google Workspace. We use support information to respond, investigate problems, and improve Podkin.

Podkin keeps a rolling diagnostic log locally. Settings → Send feedback creates a conversation-statistics file and a log for you to share. These can contain episode information, timestamps, conversation timings and ratings, technical details, and the words you spoke. The export redacts private feed URLs. Review it before sending: we receive these files only if you choose to share them with us.

In the Android app, Report what I said sends us the words of Podkin’s you reported and what they were (an answer, a topic, a greeting, a line about a show), the episode and the moment in it, the reason you picked, a note if you write one, and the app’s version, which we keep for about 180 days (backups a few weeks longer) to fix what Podkin gets wrong; a report never includes your voice, and nothing in it says who sent it beyond what you write in the note.

If you install a beta through TestFlight, Apple automatically collects and shares crash and usage information with us. It can also share feedback, screenshots, device and app details, and tester contact information, depending on how you were invited and what you submit. We use this information to test and improve Podkin. See TestFlight & Privacy.

We keep support correspondence, shared diagnostics, and beta-testing information only as long as needed to address the issue, support the app, or meet legal obligations. We do not add you to a mailing list or use this information for advertising.

Retention, deletion, and your choices

Local library records and saved conversations remain on your device until removed through app or device controls. Downloaded audio can be deleted independently; deleting a download does not delete conversation history. Local diagnostic logs rotate as they fill.

Deleting Podkin removes its local app data, but Keychain items and device backups may remain. On Android, deleting Podkin removes everything it keeps on the phone, private-feed addresses included, apart from device backups. Before removing the iPhone app, unsubscribe from private feeds to remove their saved credentials. Manage backups separately with your backup provider.

There is no Atelier Advani account to close. Depending on where you live, you may have rights to access, correct, export, or delete information we hold, or to object to or restrict its use. Email us to make a request concerning support or beta-testing information or your Ask minutes. For information held by Apple, Google, an AI provider, or a podcast provider, their privacy controls and policies also apply.

Children

Podkin is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has sent personal information to us, contact us so we can address it. Third-party services have their own age requirements.

Changes and contact

We will update this policy and its effective date when Podkin’s data practices change. Material changes will be explained in the app or release information.

For privacy questions or requests, contact Atelier Advani LLC at support@atelieradvani.com, or write to 418 Broadway, Ste N, Albany, NY 12207, United States.

The Atelier Advani privacy policy covers the studio’s own website and its other applications. For help using Podkin, see Podkin Support.