Privacy policy

Car Voice for Hermes (Android app com.vantixwealthlabs.carvoice), the Car Voice bridge and the website carvoice.app. Last updated 20 October 2026.

In short: Car Voice sends your questions only to your own bridge, which you run, and the bridge talks to your own Hermes Agent. The connection between app and bridge is end-to-end encrypted. When the two cannot connect directly, our relay (relay.carvoice.app) passes the encrypted traffic on: it cannot read your conversations and sees only connection details, described below. We receive none of your conversations. The app has no account and no advertising. Some parts do use third-party services; they are listed below.

Who is responsible

The controller is Vantix Wealth Labs, Industrieweg 9, 2254 AE Voorschoten, The Netherlands. Vantix Wealth Labs makes Car Voice for Hermes and runs carvoice.app. For anything about privacy, email privacy@carvoice.app. The company details are on the support page.

Car Voice is a front end for Hermes Agent, which you install and run yourself. The Car Voice bridge is software that you install on your own machine and manage yourself: you decide where it runs, which services it uses and what it keeps. We have no access to your bridge, your Hermes or what passes through them.

On your phone (the app)

Data	What happens
Your voice	Recorded only while Car Voice listens: after you tap Talk, when you open it in Android Auto with Start listening when you open Car Voice on, and for a follow-up after an answer. The recording is sent to your bridge over an end-to-end encrypted connection (or over HTTPS to an address of your own; plain http only to a bridge on the phone itself) and is not stored on the phone.
Typed questions	Sent to your bridge the same way.
Conversation on screen	Kept in memory only; never written to storage.
Bridge address and access token	Stored on the phone, encrypted with a key in the Android Keystore, excluded from backups. The token is never shown again after saving and never put in logs or URLs. The bridge address is normally the bridge's ID (the public key of your bridge).
Connection key	For each connection to the bridge the app makes a new, random key that identifies the phone to the relay and the bridge only for that session. It is not stored.
Pairing code	When you connect with Enter pairing code, the app sends the code once to the bridge you entered, over the same encrypted connection, and receives the access token in return. The code is not stored or logged.
Settings, trial start date, unlock status	Stored in the app's private storage, excluded from backups and device transfers.
Language and reply style	Your phone's language (or the one you chose) and Short/Full are sent to your bridge with every question.
Microphone reports	When a listening attempt fails, the app sends a one-line report to your bridge (microphone source and input device name, peak sound level, duration, car API level, whether Android Auto was connected, a technical error name; no audio and no words), which forwards it to your Telegram chat if you set that up.
Contact support	Opens your own email app with a message to support@carvoice.app, filled in with the app version, Android version, phone model and, when known, the bridge version. It never contains your bridge address or token. Nothing is sent until you send the email yourself.
Setup prompt	Copy setup prompt and Share put the prompt text on your clipboard or hand it to an app you choose. The prompt contains no personal data.

Permissions: microphone (to hear your question), internet and network state (to reach your bridge) and Google Play billing (the one-time unlock). Libraries add a wake lock and an internal broadcast permission; neither gives access to your data.

The relay (relay.carvoice.app)

The app reaches your bridge by its bridge ID with iroh, an open-source networking library. Both connect to our relay, relay.carvoice.app, which we operate. The connection between the app and your bridge is encrypted end to end (QUIC with TLS 1.3, authenticated by the bridge's key): the relay holds no key that can decrypt it. Whenever the two networks allow it, the app and the bridge switch to a direct connection and the relay no longer carries the traffic.

What the relay processes, only to pass the traffic on and to operate and secure the service:

the bridge's ID and the phone's throw-away ID for the session;
the IP addresses of your phone and of the computer with the bridge;
when they connect and how much encrypted data the relay passes on itself.

It never sees your questions, answers, recordings, access token or pairing codes. The relay may record such connection details in its server logs to operate and secure it, as a web host does. The relay is also used to tell each side its own public address (QUIC address discovery). If you use an HTTPS address of your own instead, the relay is not involved.

With a direct connection, your phone and the computer with the bridge learn each other's IP address, as with any direct connection between two devices. To make direct connections possible, the bridge may ask your router for a temporary port mapping (UPnP, NAT-PMP or PCP) when the router offers that.

Third-party services the app uses

Google Play Billing handles the one-time unlock purchase and its restore. The purchase is made with Google under Google's terms and privacy policy; Car Voice never sees your payment details. The app asks Google Play on the phone whether the unlock was bought and keeps only the result.
Android Auto (Google) shows Car Voice on the car screen and provides the car microphone.
Google code scanner (Google Play services, ML Kit) reads the pairing QR code. The camera runs inside Google Play services; Car Voice gets no camera permission and receives only the text of the code. Google states that the image processing happens on the device and that it does not store the images or scan results. The underlying ML Kit SDK sends diagnostics and usage data to Google, such as device model, OS and app version, performance metrics and a per-installation identifier; see Google's ML Kit data disclosure. Entering a pairing code instead does not use the scanner.
Android text-to-speech on your phone reads error messages, and the answer if the bridge's audio cannot be played. That is the speech engine installed on your phone.

On your bridge (which you run)

Questions and answers stay in the bridge's memory for 15 minutes so a dropped mobile connection can pick up a running answer. On disk it keeps only which Hermes conversation is current, per phone. Logs contain no tokens, pairing codes, audio or text of questions and answers, only stages, lengths and timings.
Pairing codes are kept as a salted hash with their expiry, for at most 10 minutes and until used, in the bridge's data directory.
The bridge's key (iroh-secret-key) stays in its data directory; only its public half, the bridge ID, is shared, with the relay and with the phones you pair.
Speech recognition runs on your machine with local Whisper, or, if you configure an OpenAI-compatible service (for example Groq), your recorded question is sent to that service under its privacy terms.
Hermes Agent receives the text of your question and answers it with whatever models and tools you have configured in Hermes. That is outside Car Voice.
Text to speech uses Microsoft's Edge online text-to-speech service: the text of each spoken answer is sent to Microsoft to create the audio.
Telegram (optional, off unless you configure it): the full text of long answers and the microphone reports are sent to your chat through the Telegram Bot API. The bridge keeps the sent texts (the newest 2,000) in outbox.sqlite3 in its data directory.
Setting it up with Hermes: if you let your Hermes install the bridge, your conversation with Hermes (including the bridge address and the pairing code it sends you) is handled by Hermes and the services you use with it, such as your model provider and your messaging app. The setup never puts the access token in that conversation.

This website

carvoice.app sets no cookies and uses no analytics, trackers, external fonts or other content from third parties. Its only script is the copy button. The web host may record requests in server logs (such as the IP address, time, requested page and browser) to operate and secure the site. The bridge downloads come from the same site.

Email

When you email support@carvoice.app or privacy@carvoice.app, we use your address and what you write to answer you and to follow up on your question.

Deleting your data

On the phone: Settings › Connection › Clear connection removes the address and token; uninstalling the app removes everything it stored.
On the bridge: remove the phone's entry from the tokens file, and delete the bridge's data directory (which also removes its key and so its bridge ID).
Emails: ask at privacy@carvoice.app.

Your rights

You can ask us at privacy@carvoice.app which personal data we hold about you, and ask us to correct or delete it. Most data in Car Voice never reaches us: it stays on your phone and your own bridge, where you control it. You can also complain to your data protection authority.

Children

Car Voice is not directed at children.

Changes

Changes to this policy are published on this page with a new date.