Privacy Policy — Penelope

1. The short version

Scripts you don’t share are stored only on your phone, along with your recordings and self tapes. When a feature needs a line — importing a script, or an AI voice reading it — the text passes through our server to a provider and isn’t kept.
Scenes you share from your library, calls with other actors, and anything you share during a call are end-to-end encrypted: we store and deliver them, but we can’t read, see or hear them. Everything else that leaves your phone travels encrypted, but we can read it while we process it.
We never sell your information, and we never use your scripts, voice, or tapes to train AI.
You can delete your account anytime in the app (Settings → Account & billing → Delete account).

2. What we collect

Your account. When you sign in with Apple, we receive a private ID for your Apple account, plus your name and email if you choose to share them.

Things you choose to send us. Scenes and folders you share, sealed on your phone so we only see that you shared, with whom, and when (never your recordings); your reader profile, if you make one, with whatever you add to it; reader requests, ratings, and feedback; reports and blocks; and your email if you join the waitlist.

Sharing keys. Shared scenes are encrypted with keys kept on your phone and in your iCloud Keychain. We store the public half of your key, plus a locked copy of each of your share keys that only your own key can open, so a new phone can get your shares back. A share link carries its key after the # in the link, which browsers and apps don’t send to us, so anyone you give the full link can open the scene.

Usage and purchases. How much you use metered features like AI voice lines and script imports, what they cost us, and the signed purchase record the App Store sends us, so we can run free allowances and Pro. We keep counts and scrambled fingerprints, not the lines themselves. Apple handles payment, and we never see your card.

Technical information. A device token if you allow notifications, basic call records (who connected with whom and when), and ordinary server logs.

Things that help us fix problems and improve Penelope. When the app or our servers hit an error, a report goes to Sentry so we can fix it. The app also tells PostHog which features you use, like starting a rehearsal, and records a small share of sessions as masked screen replays so we can see where the app is confusing. Screens with your script, rehearsal, recordings or camera are fully covered in those replays, and reports use a scrambled account ID, never your name or email. This website uses PostHog too: it counts page visits and clicks and can record your visit as a screen replay, with anything you type into a form hidden. It keeps a random ID in a cookie and in your browser’s storage so it can tell visits apart, and it can work out a rough location, like a city, from your internet address. The site asks first and stores that ID only if you accept; you can change your answer anytime with Cookie settings at the bottom of the page. Pages that open a shared scene or call invitation don’t load it.

3. What stays on your phone

Your scenes and the recordings of your lines, unless you share or convert them (see section 4).
Your self tapes. They’re stored privately and left out of iCloud backups, so save any you want to keep.
What you say while you rehearse. Penelope uses Apple’s speech recognition on your phone, so what you say isn’t sent to Apple or to us.
AI voice audio, which is saved on your phone once it’s been made.

4. AI features

Importing a script. When you import a PDF or photo, the app reads the text on your phone, then sends the text (not the file, its name, or your account details) through our server to an AI provider to split it into characters and lines. We don’t keep it. Please import scripts, not personal documents.

AI voices. Your scene partner’s lines go through our server to our voice provider to be spoken. If you turn on Perform with my delivery, your recording of a line is sent the same way, so the voice you chose can follow your pace, pauses and intonation. We don’t keep those recordings, and we delete the voice provider’s copies of what it makes within about a week.

Our AI providers are set up not to use your content to train their models, and we never do.

5. Reading with other actors

Calls between actors are end-to-end encrypted, so neither our call provider nor we can see or hear them. Your script is shared only when you choose to share it. Before a take, the app asks the other person to agree to being recorded, and takes are saved on the phone that recorded them.

Reader profiles start private. If you make yours public, other signed-in actors can find it. Sending someone a reader request shares your profile with them.

6. Who helps us run Penelope

We work with service providers that get only what they need to do their job for us: Apple (sign-in, payments, and notifications), Vercel (hosting, database, and storage), OpenAI (script parsing), ElevenLabs (AI voices), LiveKit (encrypted calls), Resend (email), Sentry (error and crash reports from the app and our servers), PostHog (app and website usage analytics and masked screen replays), and Google (fonts on our website). We may change or add providers that do similar jobs.

We don’t sell your information or share it for advertising. We may disclose information when the law requires it, to protect people or Penelope, or if Penelope is ever sold or merged.

7. How long we keep things

We keep your information while you have an account and for as long as we reasonably need it to run Penelope, meet our legal obligations, and prevent abuse.

When you delete your account (Settings → Account & billing → Delete account), we delete your account data, including your sharing keys, and the app erases your Penelope scenes and takes from that phone. A few things can remain: scrambled, de-identified records that stop free allowances and purchases from being reused by a new account; shared scenes under another actor’s control; copies other people already saved, like a take your scene partner kept; and backups for a short time.

Shared scenes stay under the owner’s control and sit sealed on our servers. If the owner stops sharing or removes you, the app removes that copy from your phone the next time it connects. Scenes shared with earlier versions of the app can stay readable to us. Once everyone they’re shared with has updated, the owner’s app encrypts them the next time it sends us a change.

8. Your choices

You can see and change most of your information in the app, and delete your account there. For anything else, email info@penelopeacting.com. If the law where you live gives you other rights (for example in the EU, the UK, or California), we’ll honor them; we may ask you to confirm it’s really you first. We don’t sell or share personal information for advertising.

9. Kids

Penelope is for people 16 and older, and we don’t knowingly collect information from anyone younger. If you think a child has signed up, email info@penelopeacting.com and we’ll delete it.

10. Security and changes

We use reasonable safeguards, including encryption when information travels and when it’s stored, but no system is perfectly secure. Our providers are mostly in the United States.

We may update this policy. When we do, we’ll post it here with a new date and, for big changes, let you know in the app or by email when we can. Questions or requests? Write to info@penelopeacting.com.