How Earmio handles your data

Earmio records parts of your day, at your request, into an archive that only you can open. That makes privacy the product, so this policy is written to be read. It says exactly what is collected, by which part of Earmio, where it is kept, for how long, who can see it, and how to get it out or deleted. Effective 10 November 2026. Version 2026-11-10. It is one of the two documents you accept when you create an account; the other is the terms of service.

At a glance

Recording: Only the Earmio watch app records, only while you have turned listening on, and only to your own archive. Websites and the web app never use your microphone, location or camera.
Who can hear it: You. Nobody at Corvidae listens to your recordings unless you ask us to for support, or the law requires it. Your audio is never used to train AI models and never sold.
Where it lives: On AWS servers in New Zealand (Auckland). Transactional email is sent from Sydney, Australia.
How long: Recordings, locations and notes stay until you delete them or your account. There is no automatic expiry in this stage. Server logs go after 31 days at most.
Third parties: Processors only: AWS, Cloudflare, Google (sign-in and analytics), Microsoft (website analytics and sign-in) and Zoho (support mail). No advertising, no data brokers, no sale of data.
Your rights: Access, correction, deletion and a copy of your data on request, within 20 working days. Complaints go to us first, then to the Privacy Commissioner.

1. Who we are

Earmio is operated by Corvidae Ltd, a company registered in New Zealand (corvidae.co.nz). Corvidae Ltd is the agency responsible for your personal information under the New Zealand Privacy Act 2020 and, where those laws apply to you, the controller under the UK and EU General Data Protection Regulation and the organisation under the Australian Privacy Act 1988. Our privacy officer can be reached at support@earmio.com. Put the word Privacy in the subject line and we will answer within 20 working days.

2. What this policy covers

This policy covers every Earmio surface:

earmio.com, this website.
sample.earmio.com, the preview with a fictional sample day.
app.earmio.com, the web app, together with identity.earmio.com (sign-in) and api.earmio.com (your data).
The Earmio watch app for Wear OS, paired to your account.

It does not cover other people's websites or services that you reach by a link, or the watch, phone and browser you use, which have their own privacy settings and policies. In particular, Google's policies apply to Wear OS and to your Google account.

3. What we collect, and from where

Each Earmio surface collects a different set of information. Nothing is collected by a surface that is not listed under it.

Your account (app.earmio.com and identity.earmio.com)

Email address, a one-way hash of your password (never the password), and optional first name, last name and contact email.
Display preferences: theme and language.
A record of every acceptance of these terms: the version, the time and the IP address it came from, kept as proof of agreement.
Sign-in events and security events (successful and failed sign-ins, password resets, verification codes) with their time and, where recorded, the IP address.
If you sign in with Google or Microsoft: your email address and basic profile (name) from that provider. We never see your Google or Microsoft password.

Your paired watch (the Earmio watch app)

Device details at pairing: a name you choose, model, manufacturer, operating system version and app version. The pairing code and the device token are stored as one-way hashes.
A status report every 15 minutes while idle and every 5 minutes while capturing: listening state, pause state, location state, battery level and charging, free storage, how much is waiting to upload, network type, app version, the last error and the current session id. Only the latest report is kept per device.
Audio: while listening is on, the watch records audio in 60 second pieces, encrypted on the watch, and uploads them to your archive. Each piece carries its start and end time, duration, size and a checksum. Audio is captured only when you have turned listening on. It is off on first run and after every reinstall.
Coverage gaps: the start, end and reason for every period the watch was not capturing (for example stopped, privacy pause, battery, reboot), so your day is never shown as more complete than it was.
Location: while location is on, position samples (latitude, longitude, accuracy, altitude, speed, bearing, time) at an interval that depends on movement and battery. Location is off by default and has its own switch.
Bookmarks: the time, the window length and any short note you add when you tap Remember this.
Places you name (a label, a position and a radius) and visits that Earmio derives from your own location samples: arrival, departure and the place. Nothing about a place comes from any source other than your samples and what you type.
Your capture settings and privacy presets as applied on the watch.

The web app (app.earmio.com)

Two preferences in your browser only: theme and whether sample data is shown. They never leave your device.
Page views in Google Analytics 4: the route path and the page title, nothing else. Off when your browser sends Global Privacy Control or Do Not Track. The route path never contains a recording, a place or a name.
Standard request data in server logs: IP address, user agent, the address requested, the time and the response code.

This website (earmio.com) and the preview (sample.earmio.com)

earmio.com: Google Analytics 4 and Microsoft Clarity cookies and events (pages read, scrolling, clicks). Google Analytics truncates your IP address. Clarity masks page text by default. Both are off under Global Privacy Control or Do Not Track.
sample.earmio.com: nothing. The preview loads no third-party script, sets no cookie, and keeps only theme and sample mode in your browser.
Standard request data in server and Cloudflare logs as above.

What we do not collect

No microphone, location or camera access from any browser page. Our servers send a Permissions-Policy header that tells the browser to refuse it.
No contacts, calendars, messages, photos or health data. Calendar access is a planned feature that will have its own switch and its own notice.
No speaker recognition or voice matching in this stage. Each is a planned feature that stays off until you turn it on, and this policy will be updated and re-accepted before any of them exists. Transcription and AI organisation (summaries, commitments, answers from your own history) exist and are described in sections 5 and 6: each is off until you turn it on.
No advertising identifiers, no ad networks, no cross-site tracking, no fingerprinting.
No background fetch of your audio by anyone: every read goes through our API with your own sign-in, and there are no public or shareable links to your archive.

4. Other people in your recordings

A recording of your day can contain the voices of other people, and a location trail can show where you met them. You decide when the watch listens; Corvidae stores and processes what you capture only to provide the service to you. This has three consequences.

You are responsible for recording lawfully. The terms of service set out what you must and must not do, including telling people when the law requires it and never recording a conversation you are not part of.
Corvidae staff do not listen to, analyse, or share your recordings, and nothing transcribes them unless you turn transcription on yourself. The only exceptions to staff access are a support request in which you ask us to look at a specific item, a security investigation into misuse of the service, and a lawful demand described in section 10. Such access is limited to the Corvidae staff who operate the service and is never routine.
A person who believes they appear in your archive can contact us. We will not confirm or deny what your archive holds, but we will pass the request to you, and where the Privacy Act requires us to act on it we will tell you what we are required to do before we do it.

5. How we use information

To run the service: pair your watch, receive and store what it captures, show it back to you, and carry out your stop, pause and delete instructions.
To keep accounts secure: verify sign-ins, detect abuse, rate-limit the API, and investigate incidents.
To support you when you write to us.
To send service emails: verification codes, password resets, security notices and notices of changes to these documents. We send no marketing email.
To understand use of the service in aggregate: counts of accounts, devices, uploads and page views. These figures never identify a person and are never joined to recording content.
To meet legal obligations, including the record of your acceptance of these documents.
To transcribe your recordings, only after you switch transcription on in Settings, Processing. Transcription is automated, produces a machine transcript stored with the conversation, and stops queueing new work the moment you switch it off. You can ask for an older conversation to be transcribed from its page.
To organise your transcripts with AI, only after you switch AI organisation on in Settings, Processing and allow cloud processing: a summary, decisions, open questions and proposed commitments per conversation, and answers to questions you ask about your own history, each built from your transcripts and notes only and shown with its sources. Nothing is generated from audio, and nothing is sent to anyone else.

We do not sell personal information, share it with advertisers or data brokers, use it to train machine learning models, or make automated decisions with legal or similarly significant effects on you.

Where the GDPR applies, our legal bases are performance of our contract with you (sections 3 and 5, first four items), our legitimate interests in security and in understanding aggregate use, compliance with legal obligations, and your consent for optional sign-in providers and for website analytics, which you can withdraw as described in section 3. Transcription and AI organisation each rest on your consent, given by their switches in the app and withdrawn by turning them off.

6. Who processes it for us, and where

Corvidae uses a small number of processors. Each works under a contract that limits it to our instructions, and none may use your data for its own purposes. We add nothing to this list without updating this policy first.

Processor	What it does	What it handles
Amazon Web Services (AWS)	Hosting of the API, identity service, database and your audio archive (Auckland region). Transactional email through Amazon SES (Sydney region). Amazon Bedrock (Auckland region) generates summaries, commitments and answers from your transcripts, only after you switch AI organisation on in Settings, Processing.	Everything in your account and archive, encrypted in transit and at rest. SES sees the recipient address and the content of service emails. Bedrock receives transcript text and your question, never audio; Amazon states that Bedrock does not store prompts or outputs and does not use them to train models. We keep a usage record per call (model, tokens, estimated cost) that never contains the text.
Cloudflare	DNS and the network in front of earmio.com, sample.earmio.com, app.earmio.com and identity.earmio.com. Uploads from the watch go directly to api.earmio.com and do not pass through Cloudflare.	IP address, user agent and request metadata of web requests, kept in Cloudflare logs under its own retention.
Google	Sign in with Google (optional) and Google Analytics 4 (earmio.com and page views in the app).	Sign-in: your email and basic profile, shared by Google with your permission. Analytics: cookie ids, truncated IP address, pages viewed. We do not enable Google Signals or advertising features.
Microsoft	Microsoft Clarity on earmio.com only, and Sign in with Microsoft when it is enabled.	Clarity: cookie ids, masked page interactions, device and browser type. Sign-in: your email and basic profile.
Transcription provider (only when you turn transcription on)	Converts your recordings to text, one audio piece at a time, only after you switch transcription on in Settings, Processing. The app names the provider in use and whether it runs on our own server or in the cloud. No cloud provider is configured today; when one is, it will be named here with its region and retention before transcription becomes available to you, and cloud processing needs your separate tick in the app.	The audio pieces of the conversations being transcribed and your optional language hint. We keep a usage record per call (provider, duration, estimated cost, success) that never contains audio or text.
Zoho	Mailbox provider for support@earmio.com and hello@earmio.com.	Whatever you write to us by email.

Your archive and database are stored in New Zealand. Service email leaves from Australia. Google and Microsoft process sign-in and analytics data in their own regions, including the United States, under their standard contractual terms. New Zealand is recognised by the European Commission as providing adequate data protection. We do not otherwise transfer your data out of New Zealand.

Transcription runs only if you turn it on. Today it can run only on our own server in New Zealand; a cloud transcription provider is not configured. Before any cloud provider is used it will be named in section 6 with its region and retention, you will be asked to accept the updated policy, and the app will ask for a separate tick allowing cloud processing. AI organisation (summaries, commitments and answers) runs only if you turn it on and give that tick; it sends transcript text, never audio, to Amazon Bedrock in the Auckland region, so the data does not leave New Zealand.

7. How long we keep it

Data	Kept
Recordings, coverage gaps, location samples, bookmarks	Until you delete them or your account, or until the retention period you choose in Settings, Your data runs out (off by default; audio, transcripts and location samples each have their own period). An expired recording keeps its time and length in your coverage so the gap is honest, but the audio file is gone. Forgetting a time range deletes everything recorded in it and leaves a visible gap on your timeline.
Exports you create	Kept in your archive storage for 7 days, then removed; you can delete one earlier. A copy you downloaded is outside our control and cannot be recalled.
Visits, named places, context labels, conversation titles and notes	Derived from your samples and recordings or typed by you. Kept with the archive until you delete them or your account.
Transcripts (machine generated, only when transcription is on)	Stored in the database next to the conversation and deleted with it or with the account. Transcription usage records (no audio or text) are kept for cost accounting for the life of the account.
AI summaries, decisions, open questions, commitments and saved answers (only when AI organisation is on)	Stored next to the conversation or in your question history, deleted with the conversation, individually, or with the account. Proposed commitments are replaced when a summary is regenerated; ones you confirmed, completed or dismissed are kept until you delete them.
Account details, settings, terms acceptances	For the life of the account. Deleted with the account.
Device status report	Latest report only; each report overwrites the last. Removed when the device is revoked or the account is deleted.
Sign-in and security events	For the life of the account. Deleted with the account.
Application logs (API and identity)	31 days at most, rolled daily. They hold request metadata and error details, never audio or location content.
Database backups	The 20 most recent backups, taken by us for disaster recovery. A deleted row can remain in a backup until that backup rotates out. Backups never contain audio files.
Website analytics (Google Analytics 4, Clarity)	Up to 14 months for event data in Google Analytics, and Clarity recordings for 30 days, under each provider’s settings.
Support email	For as long as needed to resolve the matter and to keep a record of it, up to 3 years.

8. Your controls: stop, delete, export, access

Stop and pause

Listening and location each have a switch on the watch and can be stopped or paused from the web app. An explicit stop or pause always wins over presets, reconnects, restarts, timers, schedules and anything our servers send. There is no remote start. A stop sent from the web app shows as Pending until the watch confirms it, because a request is not proof that capture has stopped. Stopping does not delete anything already captured.

Delete

Revoking a watch ends its access and removes its status; the watch returns to the pairing screen. Deleting your account removes your account, devices, recordings, coverage, locations, bookmarks and settings from our database, and we remove the audio files from the archive as part of the same deletion. Copies of database rows in backups disappear as those backups rotate out, within a few weeks. Forget recent (Settings, Your data, or the watch's Privacy screen) deletes a chosen time range: the audio, transcripts, summaries, commitments, bookmarks, location samples and visits recorded in it, and, if you tick it, the things you typed for that time; it previews the counts first, cannot be undone, and leaves a visible gap on your timeline. Self-service account deletion inside the app is Coming soon; until then, email support@earmio.com from your account address and we will delete your account within 10 working days and confirm when it is done.

Export

You can play back any recording in the web app and download each audio piece. Export (Settings, Your data) builds a zip for a date range with your conversations, transcripts, summaries, commitments, activities, habits, places, visits, people (notes only if you tick it), bookmarks, plans and reflections as JSON and CSV, plus GPX and GeoJSON tracks if you include locations. Audio is downloaded per piece rather than zipped. If you need help, ask us and we will give you a complete copy of your data within 20 working days.

Access and correction

You have the right to ask what personal information we hold about you, to receive a copy of it, and to have it corrected. Write to support@earmio.com. We will confirm your identity through your account email, answer within 20 working days, and tell you if the law allows us to withhold anything and why.

9. Security

Audio is encrypted on the watch with AES-256-GCM using a key held in the watch's hardware keystore, and a piece is removed from the watch only after our server confirms it is stored.
Every connection uses TLS. Archive objects are encrypted at rest. Device tokens and pairing codes are stored only as hashes. Passwords are stored only as salted hashes.
Every read of your archive goes through our API with your sign-in. There are no public, presigned or shareable links.
Production secrets are held outside the code, and access to servers and to administrative tools is limited to the Corvidae staff who operate the service.
If a privacy breach is likely to cause serious harm, we notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act 2020 requires, and we say what happened and what to do.

10. Requests from authorities

We disclose personal information to a third party only when a law we are subject to requires it, or when necessary to prevent a serious threat to someone's life, health or safety. We require valid legal process under New Zealand law, we release only what the process covers, and we tell you about the request before complying unless the law forbids it or doing so would endanger someone. We do not volunteer your data to anyone.

11. Age

Earmio is for adults. You must be 18 or older to create an account, and the service is not directed at children. If we learn that an account belongs to someone under 18 we close it and delete its data. A parent or guardian who believes a child has an account can write to support@earmio.com.

12. Your rights and complaints

Under the New Zealand Privacy Act 2020 you have the right to access and correct your personal information, and to complain to us and then to the Office of the Privacy Commissioner (privacy.org.nz). If you are in the United Kingdom, the European Economic Area or Switzerland you also have the rights to erasure, restriction, portability and objection, the right to withdraw consent at any time, and the right to complain to your local supervisory authority. If you are in Australia you may complain to the Office of the Australian Information Commissioner. Exercise any of these by writing to support@earmio.com. We do not charge for requests and we do not treat you differently for making one.

13. Changes to this policy

This policy carries a version date. Whenever we change what is collected, who processes it, how long it is kept, or how it is used, we publish a new version here, email every account holder before it takes effect, and ask you to accept it again at your next sign-in before the changed part of the service is available to you. Corrections of wording that do not change the meaning are published without a new version. Earlier versions are available on request.

14. Contact

Corvidae Ltd, New Zealand. Privacy officer: support@earmio.com. General enquiries: hello@earmio.com. Company details are at corvidae.co.nz.

Read the terms of service Back to the home page