Vecta
Privacy Policy
Last updated: 7 November 2026
In short
Vecta asks for broad permissions because it bridges your phone and your watch. Your notifications, screen and photos go only to your own device, not to us, but that traffic is unencrypted on your local network. What lives in the cloud is voice memos, drawings and short messages: they stay in Google Firestore, and the app has no delete button for them.
Who is responsible
Vecta is published by Neuvikon. Neuvikon is the data controller under the GDPR and Turkey's Law No. 6698 (KVKK).
- Data controller
- Neuvikon
- neuvikon@gmail.com
Privacy contact: neuvikon@gmail.com
What this covers
This policy covers the Vecta Android app, the software on the Vecta device and the cloud services they use. There are no accounts. Most features run between phone and device, and each permission is requested when you turn on the feature that needs it.
What we process and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Location (approximate and precise) | Finder, Buddy compass, map, navigation and weather | GDPR Art. 6(1)(b): performance of a contract | The app keeps no location history; used while a feature is on, and providers apply their own log periods |
| Destination address you type, route start and end coordinates, map area | Finding the address, plotting a route, showing the map on the device | GDPR Art. 6(1)(b): performance of a contract | Not stored in the app; Nominatim, OSRM and OSM keep their own logs |
| Voice memos (from the phone microphone, up to about 10 seconds), sender label and time | Messaging other Vecta users in the same room remotely | GDPR Art. 6(1)(b): performance of a contract | Kept in Firestore indefinitely; no automatic deletion and no delete option in the app |
| Room name, device ID, drawings and short messages sent from the device | Communication between Vecta devices over the internet | GDPR Art. 6(1)(b): performance of a contract | Kept in Firestore indefinitely; no automatic deletion and no delete option in the app |
| Anonymous Firebase ID and IP address at connection | Reaching Firestore | GDPR Art. 6(1)(b): performance of a contract | Until removed from the Firebase project |
| Audio you say to the assistant (device microphone, about 4 seconds per recording), assistant text, your Gemini key | Running the voice assistant with your own Gemini key | GDPR Art. 6(1)(b): performance of a contract | The key stays on the phone until you remove it; Google's terms apply to audio and text, which never reach us |
| Notifications: app name, type, title (40 characters), body (150 characters) | Showing phone notifications on the watch | GDPR Art. 6(1)(b): performance of a contract | The device's memory holds the last 8; they go when it restarts or you dismiss them. They never reach us or the cloud. |
| Title, artist and cover of what is playing; optional Spotify session | Now-playing screen and lyrics | GDPR Art. 6(1)(b): performance of a contract | Spotify session stays on the phone until you disconnect; LRCLIB and Spotify keep their own logs |
| Photos, videos and documents you pick; new photos while photo watching is on | Showing the image or text on the device | GDPR Art. 6(1)(b): performance of a contract | Saved items stay in the phone's library until you delete them; nothing reaches us |
| Screen frames and touch gestures from the watch | Seeing the phone screen on the watch and controlling it from there | GDPR Art. 6(1)(b): performance of a contract | Flows only during mirroring; not stored and does not reach us |
| Wi-Fi network name and password, device addresses, device settings backups, module usage counts | Connecting the device, managing several devices, restoring settings | GDPR Art. 6(1)(b): performance of a contract | On the phone and device until you delete it or uninstall the app |
| Chosen module list and IP address | Starting a custom software build, downloading module and update files | GDPR Art. 6(1)(b): performance of a contract | The build name and file stay in a public GitHub repository, not linked to you |
| Your email address and message if you write to us | Answering support and deletion requests | GDPR Art. 6(1)(f): legitimate interest in answering you | Up to 1 year after the matter closes |
How data is collected
Data comes from actions you start and features you turn on. Notification mirroring, music, screen mirroring and photo watching run automatically and continuously while enabled. Voice memos are recorded only with the record button, and assistant audio only when you start it.
Do you have to provide it
No permission is mandatory; you can use Vecta for basic tasks such as sending images without them. If you refuse a permission, only the feature that needs it stops working, and you can withdraw any permission in Android settings. A Gemini key, Spotify and a room name are optional too.
What we do not collect
- Accounts, names, email addresses or phone numbers.
- Contacts, SMS, call logs or calendars. The app does not ask for these permissions.
- Background location. Location permission applies only while the app is in use.
- Ads, analytics or crash reporting tools.
- Sending your notifications, screen or gallery to us or the cloud. They go only to your own device.
- Screen content through accessibility. The service does not read the screen.
Permissions: why they are requested and where data goes
- Location: Finder, Buddy, map, navigation, weather. It goes to your device, to OpenStreetMap and OSRM for maps and routes, and to Open-Meteo for weather.
- Microphone: recording voice memos. Recordings are uploaded to Firestore. The phone does not listen in the background.
- Photos and videos: sending images you pick and passing newly taken shots to the device when photo watching is on. They go only to your device. Android may bundle this request with audio files; the app does not read your audio files.
- Screen capture: screen mirroring. Android asks each time and shows a notification. Frames go only to your device. While mirroring, everything on screen appears on the watch, including passwords and private messages.
- Notification access: mirroring notifications to the watch, reading Google Maps directions, seeing what is playing. There is no filter: titles and bodies from every app, including messages, bank alerts and verification codes, go to the watch. They go only to your device.
- Accessibility: applying watch touches to the phone. It injects gestures only during screen mirroring and does not read screen content. You turn it on yourself in settings.
- Bluetooth: sending navigation and notification packets to the device. They go only to your device.
- Notifications and foreground services: showing that mirroring, music or photo watching is running.
- Internet and network state: reaching the device and the services below.
A room name is not a password
In the Room (remote messaging) feature, anyone who enters the same room name can see that room's voice memos, drawings and messages. The app gives short names as examples, but choose something hard to guess, avoid names and numbers, and do not say anything confidential. Without a room name this feature does not work and nothing goes to Firestore.
Gemini assistant
The assistant runs on your own Google Gemini key. Your audio and text go straight from your phone to Google and never pass through us; for this use your relationship is with Google. Under Google's terms for its unpaid tier, content may be used to improve products and may be read by human reviewers. Google asks you not to submit sensitive, confidential or personal information there and requires users to be 18 or older.
If you enable the XiaoZhi or OpenClaw modules, voice or text goes to the server you enter. We are not responsible for that server.
Unencrypted traffic on your local network
Wi-Fi traffic between phone and device is plain HTTP, so it is not encrypted. Notifications, photos, screen frames, location and your Wi-Fi password travel this way, and someone on the same network could see them. Use the device on networks you trust, and turn off notification mirroring and screen mirroring on public Wi-Fi.
Who receives data
| Party | Role | Location |
|---|---|---|
| Google Firebase (Firestore, Authentication) | Stores voice memos, drawings, messages, room names, device IDs and anonymous IDs, and sees the connecting IP address. | Google infrastructure, outside Turkey |
| Google Gemini API | Only if you enter a key. Processes audio and text and produces the reply and speech, on your own key and Google account. | Global |
| Spotify | Only if you connect it. Provides what is playing, using your session. | Global |
| LRCLIB | Receives artist and track names and returns lyrics. Phone and device connect directly. | Not disclosed |
| Open-Meteo | Receives your coordinates and returns the weather. Phone and device connect directly. | Swiss company; server location not disclosed |
| OpenStreetMap (maps and Nominatim) | Receives the map area and your address search, and sees your IP address. | UK and global |
| Project OSRM | Receives route start and end coordinates and returns the route. It is a free public server and we have no specific contract with it. | Not disclosed |
| Cloudflare | The Worker that forwards build requests sees the module list and IP address and stores neither. cdnjs also serves the PDF reader files; the PDF itself is not sent. | Global |
| GitHub | Serves the module list and software files and runs builds. Sees your IP address during downloads. | US and global |
| Google (Gmail) | Email service where messages to us are stored. | Global |
We use these parties only for the purposes above. Some are public services with no contract with us, so we cannot guarantee how they protect the data. We do not sell your data. We may disclose information where a lawful request from an authority requires it.
International transfers
Voice memos, drawings and messages in Firestore are held on Google's servers outside your country. Depending on the features you use, location, address searches, track names and your IP address also go directly from your phone or device to the international services above. Notifications, screen frames and your gallery go no further than your device, so they do not leave the country.
Security
Connections to cloud services use HTTPS. Wi-Fi traffic between phone and device is unencrypted. The device's own Wi-Fi network uses a fixed password and its local interface has no login, so someone on the same network can send it commands. Your Gemini key and Spotify session are stored unencrypted on the phone and may be included in Android backups. Avoid these features on a shared phone.
Deleting your data
With no account, there is no account to close. Uninstalling the app deletes keys, settings, the library and backups on the phone. You can also delete library items in the app, disconnect Spotify and withdraw permissions in Android settings. There is no way to delete voice memos, drawings or messages in Firestore from the app or the device, and they do not expire. To have them removed, send us your room name and we will delete that room's records by hand; content from other people in the room may go with them. For Gemini records, you need to contact Google.
Children
Vecta is for users aged 18 and over. It has broad access to the microphone, location and notifications, and Google requires Gemini users to be 18 or older. The app does not ask your age. If we learn a record belongs to someone under 18, we delete it; parents can send us the room name.
Your rights
You may ask for access to your data, correction, erasure, restriction and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time, without affecting earlier processing. Turkish users have the rights in KVKK Art. 11, listed on our data protection notice page.
Write to the address above with your name and request. It is free, and we answer within one month at the latest (30 days under KVKK). KVKK applications are made in Turkish.
Complaints
You can complain to us first. You may also complain to your local data protection authority (in the UK, the ICO) or, in Turkey, to the Personal Data Protection Board (KVKK).
Changes
When this text changes, the date at the top changes too. Significant changes are also announced in the product or its release notes. We do not respond to browser Do Not Track signals.