Privacy Policy

1. Who we are and what this policy covers

Nullframe, Inc. (“Nullframe,” “we,” “us,” or “our”) provides Voyager. This Privacy Policy explains how we collect, use, disclose, and retain personal information when you use Voyager’s websites, desktop applications, hosted services, APIs, command-line tools, and related features, or contact us.

This policy covers Voyager, including Voyager account and billing services accessed through moda.app. Nullframe also provides Moda; Moda’s privacy policy covers your separate use of Moda. A shared account can hold records relating to both products. If you use Voyager through an organization, that organization may also control how information in its workspace is used. Its policies and any applicable data-processing agreement govern processing we perform on its behalf.

Our Terms of Use describe the rules for using Voyager. This policy is a notice about personal information, not blanket consent to process another person’s face, voice, or other sensitive information. Contact us at support@voyager.so about this policy or a privacy request.

2. Information we collect

• Account and contact information: your name, email address, sign-in identifiers, profile details, organization and workspace membership, access permissions, and communications or preferences you provide. We also receive information from your sign-in provider and workspace administrators.
• Billing and service records: plan, purchases, credit balances, invoices, transaction and payment status, and payment-method details made available by our payment processor. Payment processors such as Stripe handle payment credentials through their own systems.
• Content submitted for processing: prompts, conversation context, tool results, selected or agent-accessed files, images, videos, audio, reference material, and generated outputs that a workflow sends to our hosted services. These can contain information about you or other people. Local storage and cloud processing are explained below.
• Technical and usage information: IP address, browser and device information, operating system, app version, timestamps, pages and features used, referring pages, identifiers, performance and error information, and the analytics, crash, and feedback data described below.
• Request and safety records: account, organization, and provider request identifiers; model or operation; usage and cost; results or result references; status and errors; and information needed to investigate a report, confirm permissions, or prevent abuse.
• Support and restricted-feature information: messages, reports, attachments, recordings, consent or authorization evidence, and verification information you or a person participating in a feature provide. We may receive a complaint or permission-withdrawal request from someone depicted or heard in content.

We receive information directly from you, automatically when you use the Services, and from providers, connected services, organization administrators, and people who contact us about your use. Providing some information is necessary to operate an account, process a payment, or perform the feature you request; without it, that feature may be unavailable.

3. Desktop storage, permissions, and local processing

Voyager’s desktop app stores project and conversation state, settings, caches, and diagnostic files on the machine running its app server. Project files and generated media may also be stored in folders you or an agent choose. When you connect a remote environment, relevant state and files may instead reside on that environment. Installing Voyager does not, by itself, upload every file on your computer to Nullframe.

Local installation does not mean all processing stays local. Depending on the task, connected provider, and permissions, an agent can read files and application context and send relevant content, conversation history, screenshots, or tool results to an AI provider or connected service. An authorized task can involve multiple requests without a separate prompt before each one. Review permissions, provider settings, and the content available to the agent before starting work.

Features may request access to your microphone, camera, screen, files, clipboard, or creative applications. Access depends on the feature and operating-system permissions. You can manage those permissions through your device and Voyager settings. Turning off a permission stops future access through that permission; it does not recall content already sent or saved.

Voyager’s built-in voice-input dictation transcribes microphone audio on the device. If you send the resulting text as a message, it becomes part of that workflow’s conversation context. Cloud speech generation, voice cloning, and other audio-processing tools are separate features and may transmit audio to providers.

Connected accounts may store credentials or authorization tokens on the machine running the connection and transmit them as needed to authenticate with the relevant service. Other tools can maintain their own credential stores. Protect access to your device and remote environments; disconnecting a service or deleting a local project does not necessarily delete records held by that service.

4. How and why we use information

We use personal information to provide requested features; authenticate users and manage organizations; route and complete AI and media requests; process payments and usage; respond to support and permission requests; diagnose problems and improve Voyager; communicate service updates and requested marketing; protect people and the Services; investigate abuse and disputes; and comply with legal obligations.

Where laws require a legal basis, we rely on performance of our contract with you for account, billing, and requested service processing; legitimate interests in operating, securing, supporting, and improving Voyager where those interests are not overridden by your rights; compliance with legal obligations for required records and disclosures; and consent where required for a particular activity. You may withdraw consent without affecting the lawfulness of processing before withdrawal. Special-category or biometric processing requires an additional legal condition where applicable.

We may review information submitted to our services to resolve a support request, enforce our terms, investigate misuse, and improve reliability. We may use aggregated or deidentified statistics to understand usage. Account-linked analytics are personal information, even if they do not contain your name or email. We do not use your private content, face, or voice in advertising without separate permission.

5. AI providers and connected services

Voyager can use AI providers and tools through either Voyager-managed access or accounts you connect yourself. Providers may include OpenAI, Anthropic, Google, fal and the model providers available through it, Runware, ElevenLabs, Fish Audio, Inworld, and Meshy, depending on the feature and your configuration. The Voyager in ChatGPT and Codex section lists the providers its hosted tools use. They receive the prompts, context, media, request metadata, or other information needed for their part of the workflow. A service that receives a reference URL may retrieve the referenced content.

For Voyager-managed requests, Nullframe’s infrastructure may receive and forward inputs and results and maintain account-linked service, billing, security, and request records. For a direct connection using your own account, content may go directly from your device or remote environment to that provider. Using your own account does not make its processing local.

Provider retention and model training vary. Providers process information under the applicable agreement, privacy notice, and account settings. Some permit content use for model improvement or training unless an opt-out or separate agreement restricts it. We do not promise that every provider excludes your content from training. Check your own provider’s settings, or contact us before using Voyager-managed access with material that needs specific data-use restrictions. Creating a requested personal voice model is itself a use of the supplied recordings for that feature.

Connected storage, email, creative applications, websites, plugins, and third-party connectors have their own permissions and privacy practices. For example, when you connect Google Workspace through a connector, review that connector’s notice and the Google permissions you grant. Content an agent reads from a connected service can become context for its AI provider. This policy does not expand a connector’s granted permissions or override restrictions on the data it accesses.

6. Faces, voices, and restricted generation

Where offered, face and voice features may process photographs, videos, voice recordings, transcripts, generated media, voice-model identifiers or representations, and consent or verification records. We and the relevant providers use this information to perform the requested generation, create or operate a requested voice model, confirm eligibility and permission, prevent impersonation and abuse, and address complaints or withdrawal requests.

Identifiable images and recordings are personal information. Depending on the processing and applicable law, derived face or voice information or identity verification may also involve biometric or other sensitive information. Separate notices, permissions, and retention requirements may apply; accepting the Terms or this policy does not replace them or authorize use of another person’s identity.

ElevenLabs may process recordings and voice data for voice modeling and speaker verification. See its Privacy Policy and Voice Processing Notice for its practices. Verification performed directly with a provider is also governed by that provider’s notice. We may receive permission records, identifiers, or verification results needed to administer access.

To report unauthorized use of your face or voice, withdraw permission, or request deletion or disabling of a voice model, email support@voyager.so. Include enough information to identify the relevant content or voice; do not send unnecessary identity documents or sensitive recordings. We may need to verify the request and coordinate with the account holder or provider. Stopping future use cannot recall copies of content already exported or shared. Feature eligibility and consent requirements are described in the Terms of Use.

7. Desktop analytics, crash reports, and feedback

Usage statistics. In current production desktop installations, “Share usage statistics” is on by default. You can turn it off in Settings → Privacy. Optional events report app and device characteristics, recognized provider and model categories, feature use, operation outcomes and durations, and sanitized error information to PostHog through Nullframe’s service. They are associated with your account identifier, not anonymous. Failed sign-in reporting can use a separate random installation identifier.

These usage events exclude conversation text, file contents, recordings, API keys, file paths, and command arguments. Desktop usage reporting does not include session replay. Network infrastructure still receives connection information such as IP addresses.

Crash reports. The same setting controls optional crash reporting to Sentry. Reports can include error information, stack traces, app and operating-system details, recent app-health events, and a profile-directory hash. They are not intentionally linked to your account. Native crashes may also include a minidump, which is a snapshot of process memory and may contain personal information present in memory at the time. We filter ordinary report fields, but cannot guarantee that memory snapshots contain no sensitive information.

Turning off usage statistics stops optional reporting and clears queued usage events; it cannot recall reports already received. Necessary hosted-service, billing, and security records, website analytics, and a connected provider’s own reporting are separate.

Feedback and support. Agent feedback has a separate control in Settings → Privacy and is on by default in current installations. When enabled, an agent may send a short report about a problem, together with thread, model, app, and recent-error context. A report can include the agent’s description or a short quoted excerpt; it is not an automatic upload of the full conversation. Reports appear as tool calls. You can disable agent feedback independently of usage statistics.

Feedback you send yourself and “Get help” support bundles are also separate from usage statistics. A support bundle can include conversation content and diagnostic information that you review before sending. We attempt to redact secrets and local identifiers, but you should review what you share. Reports are handled through our support and analytics systems, including internal Slack and PostHog; attached support bundles are shared with our support team through Slack.

8. Website analytics, cookies, and communications

Our websites and account services use cookies, browser storage, and similar technologies for sign-in, security, preferences, and analytics. Production Voyager websites use PostHog and Google Analytics to collect page views, referring pages, device and browser information, identifiers, and interactions such as clicks or form activity. Website session replay is disabled. These website tools are separate from the desktop privacy settings.

If you join the waitlist, your email is stored in our mailing-list service, Loops, and may be associated with earlier website activity in PostHog. A signup may also send an internal notification through Resend. Our email providers may record delivery and engagement information. Unsubscribe using the link in a marketing email or contact us; we may still send necessary account, billing, security, and service messages.

If you create an account from a phone, we send one email with the link to download Voyager for your computer once you verify your address. Resend delivers it to the address on your account, and Clerk holds a marker on your account record (that you signed up from a phone, and when) that triggers the send. We limit it to one such email per account per day, and it does not add you to a mailing list. Our earlier request-a-link form, which stored no contact, is being retired.

You can use browser controls to block or clear cookies and site storage, and tracking controls to limit analytics. Google also provides an Analytics opt-out browser add-on. Blocking necessary storage can affect sign-in or other features. Clearing browser storage does not delete records already held by us or our providers. Contact us to exercise applicable privacy rights.

9. When we share information

• Service providers: companies that help with hosting and delivery, authentication, payments, AI processing, storage, analytics, diagnostics, email, and support. Examples include Cloudflare and Google Cloud for infrastructure, Clerk for authentication, Stripe for payments, and the providers described above. They receive information relevant to their role.
• People and services you choose: collaborators, recipients, connected providers, and publishing destinations involved in your instructions or sharing settings. Organization administrators may see membership, billing, usage, and workspace information available through their role. Organization membership alone does not upload all local files.
• Safety, law, and disputes: when required by law or reasonably necessary to investigate abuse, respond to valid legal process, enforce agreements, or protect rights, safety, and the Services. Handling a copyright or identity complaint may involve sharing relevant information with an affected user or provider.
• Business changes: advisers and parties involved in a merger, acquisition, financing, reorganization, or sale of the relevant business, subject to applicable protections.
• With your direction or permission: for another purpose explained when you choose it.

We do not sell personal information for money. The analytics disclosures above still apply; privacy laws can define “sale,” “sharing,” or targeted advertising more broadly than a monetary sale. You may contact us about applicable opt-out rights, as described below.

10. Voyager in ChatGPT and Codex

The Voyager remote plugin lets ChatGPT, Codex, or another app you connect use Voyager’s hosted creative tools with your Voyager account and a workspace you select, without the desktop app. The connected app decides when to call a tool and sends only the inputs it includes in that call. Tools that return Voyager’s own guidance do not send your content to a generation provider. Searching the model list sends the search terms to fal. Connecting does not upload all files from your device or all attachments in your chat.

What the plugin receives and keeps.

• Connection and account: you sign in through Clerk and choose a workspace. We keep a connection record (your account, workspace and organization, the connecting app’s name and client ID, granted permissions, and when it was created or revoked) and encrypted access tokens. Account tools read your workspace name, plan, seat status, and credit balance.
• Prompts and settings: the prompts, text to be spoken, model choices, and generation settings in each tool call.
• Imported references: one image, video clip, or audio file per import that you attach or link. For a link, our server downloads the file from that address.
• Generated results: images, videos, speech, music, sound effects, 3D models, and their previews.
• Brand kits: colors, typefaces, and logos read from your workspace’s existing brand kits. A logo or other workspace file used in a generation is copied into a private reference.
• Cast: each card’s name, kind, description, style, origin (generated, your photos of a fictional or unnamed subject, a real person, or someone else’s character), reference images with their roles and notes, and an optional voice. For a real-person or licensed-character card, we keep a permission record of the confirming user, time, card version, and permission notice version. Saved Cast is visible to members of the workspace; imported references and results are private to the person who made them.
• Voices: premade-voice searches and the voice you choose. Where your plan includes voice cloning, the plugin can list and use voice clones you already made in the Voyager app; it does not create clones.
• Job and billing records: for each generation, the operation, model, prompt and settings, the request sent to the provider, the references and Cast card version used, output identifiers, status, errors, and credits estimated and charged.

Why we use it. To run the tools you call, estimate and charge credits, return results and let you recover them after a conversation closes, apply plan and Cast permission rules, prevent duplicate charges, secure the service, and investigate problems. The remote tools do not send prompts or media to our product analytics. Error reports can include a provider’s error message, which may repeat part of a request.

Who receives it.

• The app you connect: ChatGPT and Codex are provided by OpenAI. The app sends tool inputs and receives the results, previews, and links we return, which can stay in your chat history under that app’s own terms and settings. See OpenAI’s Privacy Policy.
• fal: image and video generation, including Cast reference images, runs on models offered through fal. fal receives the prompt, settings, and reference images for that request. Many of these models are developed by other companies, such as Google, Kuaishou, or ByteDance; how fal runs a model, including any processing by its developer, is governed by fal’s terms. The available models change over time; the plugin lists the current ones.
• Runware: some video requests for models that Runware also serves, such as Seedance, may be sent to Runware instead of fal.
• ElevenLabs: speech, music, and sound effects. ElevenLabs receives the text or prompt and the selected voice, including your own existing voice clone. Where the plugin offers voice models from Fish Audio or Inworld, speech with those voices goes to that provider instead.
• Meshy: 3D generation and retexturing. Meshy receives the prompt and any reference image.
• Google Cloud: stores imported references, results, and Cast images in a private storage bucket. Providers retrieve the references for a request through links that expire after one hour.
• Clerk: sign-in and connection authorization.
• Websites you link: when you import from a web address, that site receives a request from our server.

These providers process information under their own terms and privacy notices, as described in AI providers and connected services.

How long we keep it. The hosted media retention schedule is separate from desktop project storage:

• Abandoned uploads: 24 hours.
• Imported references: 7 days. Work already accepted may keep a reference available while the job runs, for at most 24 hours past its normal expiry.
• Generated outputs: available to download for 30 days.
• Saved Cast: cards and references explicitly saved into Cast persist until deleted.

Media links last at most 10 minutes and may expire sooner with the asset. New requests check current access. Revoking a connection or deleting an asset stops new authorized requests; it cannot recall a downloaded copy or bytes already streaming.

Expiry ends access before physical cleanup finishes. Deletion is queued and retried if it fails. Provider copies, chat history, and financial, security, or request records have separate retention rules; the media schedule does not delete those records.

Job and billing records have no automatic expiry. We keep them for billing, refunds, duplicate-charge protection, and support, and they remain when the media they produced expires or is deleted, when you revoke a connection, and after account deletion. A Cast permission record is removed when its card returns to draft or is deleted. Connection records remain after revocation; their access tokens are deleted.

Your controls.

• Delete an asset: deleting an imported reference or generated result removes its stored file immediately. A file a running job is using can be deleted after the job ends. A record that the file existed, including its name, type, and size, remains.
• Change or delete Cast: removing a reference image from a real-person or licensed-character card returns it to draft for a new permission review. Deleting a card deletes the card, its permission record, and reference images no other card uses. A job already running keeps access to its images for up to 24 hours. Job records that used the card are not changed.
• Cancel a job: you can ask to cancel an image, video, or speech job. Cancellation is best effort; work a provider already did can still be charged. Music, sound-effect, and 3D jobs cannot be cancelled through the plugin.
• Revoke a connection: use Connected apps. Revoking stops new requests and deletes that connection’s access tokens; work already sent to a provider may finish and be charged. Disconnecting in ChatGPT or Codex does not necessarily revoke the Voyager authorization. Revoking does not delete media, Cast, or job records. Delete media and Cast separately; job records remain as described above.
• Delete your account: requesting deletion revokes your remote connections immediately. After a 30-day grace period, we delete your private references and results, and workspaces where you are the only remaining member are deleted with their Cast. Cast you saved in a workspace with other members stays with that workspace. Job and billing records are kept as described above. Email support@voyager.so to ask about deleting other records.

Deleting in Voyager cannot recall files you downloaded or shared, results and links in a connected app’s chat history, or copies a provider retains under its own terms.

11. Retention and deletion

Retention depends on the type of information, why it is processed, your account and settings, contractual commitments, and legal requirements. We consider whether information is needed to deliver an ongoing service, resolve support or permission issues, reconcile transactions, prevent duplicate charges or fraud, maintain security, or establish or defend legal claims.

Local projects, conversations, generated files, caches, and credentials remain on your device or remote environment until removed through the relevant application or storage controls. Uninstalling Voyager may leave data behind. Deleting local content does not automatically delete provider-held copies or hosted account records, and deleting a hosted account does not remotely erase independent local files.

Hosted account, support, analytics, and content records follow the applicable service and provider retention settings. Some billing and request records are maintained on an ongoing basis without an automatic expiry to support reconciliation and prevent duplicate processing; they are not automatically removed when you delete a local project. A generated-file URL expiring does not mean all related records have been deleted.

You may request deletion at support@voyager.so. We evaluate requests under applicable law, including retention needed for legal obligations, security, disputes, and other permitted exceptions. Backup copies may persist until they are overwritten or removed in the normal backup cycle. For a connected provider account, also use that provider’s deletion controls. For Voyager-managed face or voice features, contact us so we can address the relevant records and coordinate any provider-side request.

12. Your rights and choices

Depending on your location and applicable law, you may have rights to know about and access personal information, receive a portable copy, correct inaccuracies, request deletion, restrict or object to processing, withdraw consent, and opt out of sale, sharing, targeted advertising, or certain profiling where those activities and rights apply. You may have the right to limit certain uses of sensitive information and to appeal a denied request. We will not unlawfully discriminate against you for exercising your rights.

Email support@voyager.so with your request and the account or content it concerns. You do not need an account to report use of your face or voice. We may verify your identity or an authorized agent’s authority using information proportionate to the request. If we cannot fulfill a request, we will explain the applicable reason and any available appeal process. You may reply to request an appeal or lodge a complaint with your local data-protection authority.

You can also change available account details, revoke connected-service access, manage device permissions, turn off desktop usage statistics and agent feedback, and unsubscribe from marketing. If an organization controls the relevant information, we may direct the request to its administrator or help it respond. Tell us whether an account request concerns Voyager, Moda, or both so we can address shared records correctly.

13. Security and international processing

We use technical and organizational measures intended to protect personal information, including access controls and protections for transmission and storage appropriate to the service. No system is completely secure. Keep your devices, account credentials, and connected-provider accounts secure, and avoid sharing unnecessary sensitive information.

Nullframe is based in the United States. Information may be processed in the United States and other countries where we and the providers involved in your workflow operate; their data-protection laws may differ from those in your location. Destinations and transfer arrangements depend on the service and provider. Contact support@voyager.so for information about relevant destinations and applicable transfer safeguards, or to request a copy where available. This policy does not itself establish a cross-border transfer mechanism or waive protections required by applicable law.

14. Children

Voyager is intended for adults aged 18 and over. We do not knowingly permit children to create accounts. If you believe a child has provided personal information through an account or otherwise in violation of applicable requirements, contact us so we can investigate and take appropriate action. Content involving other people remains subject to their rights and the restrictions in our Terms, including restrictions on minors in face and voice features.

15. Changes and contact details

We may update this policy as Voyager and our practices change. We will post the revised policy and date here and provide additional notice of material changes where required. If a change requires consent, this notice alone does not supply that consent.

For privacy questions, rights requests, or concerns about personal information, contact: