Effective date: October 3rd, 2026 | Last updated: October 3rd, 2026
Witness Audio ("we," "our," or "the app") is a mobile application that records audio in a rolling buffer on your device and lets you save portions of that buffer as audio files. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
Contact: For privacy questions or requests, email info@lybbtech.com.
In-app navigation used in this policy: wherever this policy says "the Privacy screen," it means the screen you reach by opening the hamburger menu in the app, tapping "Settings," and then tapping "Privacy Policy." That screen shows the privacy notice and contains the "Share App Usage Analytics" toggle.
1. Who is responsible for your data?
The Witness Audio app is made available by Lybb Tech Inc. For the purposes of this policy, "we" refers to Lybb Tech Inc. as the provider of the Witness Audio application. We are the data controller for the data described below that we process.
2. Information we collect and how we use it
2.1 Audio recordings
- What we collect: When you use the recording feature, the app records audio from your device's microphone and stores it in a rolling buffer on your device (up to 12 hours). When you save, the app writes the selected portion as a WAV file on your device.
- How we use it: Audio is stored only on your device. We do not upload, transmit, or have access to your audio recordings. Recording, buffering, and saving all happen locally.
- Retention: Buffered audio is overwritten as new audio is recorded. Saved files remain on your device until you delete them.
2.2 Location data
Location is used in one situation, and it is fully local.
- Evidence Packages (on-device only). When you save a recording, the app automatically creates an Evidence Package (see 2.3). If you have granted location permission, the app records a location sample approximately every 30 minutes while recording, plus one at the moment you save. If you have not granted location permission, no location is included. These samples are written only to the Evidence Package folder on your device; they are never sent to our servers.
We do not use your location for advertising or analytics, and we do not send your location to our servers.
2.3 Evidence Packages
When you save a recording, the app automatically creates an Evidence Package — a folder stored alongside the saved audio on your device. It is designed to help you demonstrate that a recording has not been altered.
- What it contains:
o A SHA-256 cryptographic hash of the saved audio file.
o A digital signature generated by a key held in the iOS Keychain, backed by the Secure Enclave on your device.
o Device and app information: device model, iOS version, app name, app version and build number, device time zone, and the identifierForVendor (a per-vendor identifier generated by iOS).
o Recording start/end timestamps.
o Location samples, as described in 2.2, if location permission was granted.
o A trusted timestamp response (see 2.4) if one could be obtained.
- Where it's stored: Evidence Packages are written to the app's Documents directory on your device, accessible through the Files app if file sharing is enabled. They are not transmitted to us.
- Retention: Evidence Packages remain on your device until you delete them.
2.4 Trusted Timestamps (third-party request)
To prove when a recording was saved, the app sends the SHA-256 hash of the saved audio (not the audio itself) over HTTPS to an RFC 3161 Time-Stamping Authority (TSA). Only one TSA is contacted per save — whichever one successfully responds. The app tries these in order:
1. FreeTSA — freetsa.org (tried first)
2. Sectigo — timestamp.sectigo.com (fallback if FreeTSA is unreachable)
3. Apple — timestamp.apple.com/ts01 (fallback if both of the above fail)
In normal operation, every save goes to FreeTSA; the other two are contacted only if a previous attempt fails. The TSA receives the audio hash, your device's IP address, and the time of the request. It does not receive the audio itself or any location or personal data. The signed timestamp response is stored inside the Evidence Package on your device. These third parties operate under their own privacy policies; we have no affiliation with them and do not direct their processing. If no internet connection is available, saving still works — the Evidence Package simply will not include a trusted timestamp.
2.5 App usage analytics (optional)
- What we collect: Unless you opt out, we use Firebase Analytics (Google) to collect anonymous, aggregated data about how the app is used — for example, screen views, that recording was started or stopped, that a save completed, that Exports or Settings were opened, and that certain features were used. This does not include your name, email, audio, or precise location.
- Advertising identifiers: The app configures Firebase Analytics to not collect the Identifier for Advertisers (IDFA), so your analytics events are not associated with Apple's advertising identifier. The app does not present the App Tracking Transparency prompt because it does not track you across other companies' apps or websites.
- How we use it: To understand feature usage, improve the app, and fix issues. Data is aggregated and not tied to your identity.
- Your choice: You can turn analytics off at any time on the Privacy screen by toggling "Share App Usage Analytics" off. This only affects analytics; crash reporting is separate (see 2.6).
- Third party: Analytics are processed by Google. See https://policies.google.com/privacy.
2.6 Crash reports and diagnostics
- What we collect: We use Firebase Crashlytics to collect crash reports and related technical information (e.g., device model, iOS version, stack traces) when the app crashes or when we log non-fatal errors.
- What we do not collect in crash reports: Crash reports do not include your audio recordings or your location.
- How we use it: To diagnose bugs and improve stability.
- Your choice: Crash reporting is not separately toggleable in the app; it is part of our service to maintain stability. If you do not want any crash data sent, please discontinue use of the app.
- Third party: Crashlytics is provided by Google. See https://policies.google.com/privacy.
2.7 Purchases (App Store)
Witness Audio offers a 3-day free trial. After the trial, continued use of the app requires a one-time in-app purchase, processed by the App Store through Apple's StoreKit framework. When you purchase, Apple processes the transaction under its own privacy policy and returns a transaction record to the app so we can recognize your entitlement on your device. We do not receive your payment method, name, or billing address. See https://www.apple.com/legal/privacy/.
2.8 Information you give us directly
- Support / bug reports. If you contact us — for example, by using the in-app "Report a bug" option — we use the information you provide (such as your email address and message) only to respond to your request. We do not use it for marketing unless you agree.
- Consent and preferences. When you accept the in-app Use Policy and Privacy Notice, we store that acceptance locally in app preferences. We may also record that consent was given as an anonymous analytics event (without identifying you) for compliance and product purposes.
3. What we don't do
We do not:
- Collect your name, email, or contact information (except when you voluntarily email us for support).
- Sell or rent your personal data.
- Serve ads, or share data with advertising networks or ad-tech SDKs.
- Transmit the contents of your audio recordings — they never leave your device.
- Send your precise GPS location to our servers — it is used only on your device for Evidence Packages.
4. Legal basis for processing (EEA/UK)
If you are in the European Economic Area or the United Kingdom:
- Consent — for in-app analytics (while the analytics toggle is on) and for the in-app consent and privacy notice flow.
- Legitimate interests — for crash reports and diagnostics, which we use to maintain and improve the app's stability and security. We do not use this data for marketing.
- Contract — for processing necessary to provide the app (e.g., storing your preferences, enabling recording and saves).
You may withdraw consent for analytics at any time on the Privacy screen. Withdrawal does not affect the lawfulness of processing before withdrawal.
5. Data retention
- On your device. Audio in the rolling buffer is overwritten over time. Saved files and Evidence Packages stay on your device until you delete them. We do not control your device storage.
- Analytics. Firebase Analytics data is subject to Google's retention and aggregation policies. We do not maintain our own copy of analytics data on our own systems.
- Crash reports. Retained as long as needed to diagnose and fix issues, in line with Firebase Crashlytics practices.
- Trusted Timestamp requests. The TSA that handled your save retains records of the request under its own policy; we do not retain them.
- Support emails. Retained as long as needed to resolve your request and for a reasonable period for record-keeping.
6. Sharing and third parties
We do not sell your personal data. We share data only as follows:
- Google — Firebase Analytics & Crashlytics. Analytics and crash-reporting data are processed by Google under its privacy policy and the Firebase terms. Google may process data globally.
- Time-Stamping Authority (FreeTSA, with Sectigo and Apple as fallback). When you save a recording, the SHA-256 hash of the saved audio plus your IP address are sent to one TSA per save, as described in 2.4.
- App Store. Purchase transactions for the one-time unlock are processed by Apple under its privacy policy.
- Legal requirements. We may disclose information if required by law, court order, or government request, or to protect our or others' rights, safety, or property.
- Business transfers. If we transfer our business or assets, we may transfer data as part of that transaction, subject to the same privacy commitments.
Your audio and precise location are not sent to us or to third parties; they remain on your device (including in any saved files and Evidence Packages you create).
7. Data security
- Audio and precise location used by the app are processed and stored only on your device.
- The Evidence Package signing key is generated and held inside the iOS Keychain, backed by the Secure Enclave. On supported devices, the private key is protected by hardware-level security and does not leave the Secure Enclave.
- Where network processing is involved (Firebase, RFC 3161 Time-Stamping Authorities), we rely on industry-standard services with security measures described in their respective policies.
- No method of transmission or storage is 100% secure; we take reasonable steps to protect the data we process.
8. Your rights
Depending on where you live, you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate data.
- Deletion — request deletion of your personal data, subject to legal exceptions.
- Opt out of analytics — toggle "Share App Usage Analytics" off on the Privacy screen.
- Portability — in some jurisdictions, request a portable copy of your data. Note that most of your data (audio, saved files, Evidence Packages) already lives on your device and can be copied directly using the Files app; portability primarily applies to analytics and crash data held by Google.
- Object or restrict processing — in some jurisdictions, object to or ask for restriction of certain processing.
- Withdraw consent — where we rely on consent, you may withdraw it at any time (for example, by disabling analytics in the app).
- Complain — lodge a complaint with a supervisory authority in your country.
To exercise these rights, email info@lybbtech.com. Because we do not have access to your recordings, your location, or your Evidence Packages — those stay on your device and you can delete them directly from the Saved Files screen — some requests may need to be handled by the relevant third party (Google or a TSA) through their own tools.
California residents. We do not sell personal information as defined under the CCPA. We may "share" or "disclose" information for analytics, crash reporting, and trusted timestamping as described above; you can opt out of analytics on the Privacy screen.
9. Children
The app is not directed at children under 13 (or a higher minimum age where required by local law). We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it as required by law.
10. International transfers
If you are outside the United States, your data (e.g., analytics and crash data sent to Firebase, and timestamp requests to FreeTSA, Sectigo, or Apple) may be transferred to and processed in the United States or other countries where those providers operate. We rely on appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms) where required by law.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy at the same URL and update the "Last updated" date. For material changes, we may notify you in the app. Continued use of the app after the effective date of changes constitutes acceptance of the updated policy.
12. Contact
For privacy questions, requests, or complaints:
- Email: info@lybbtech.com
- In-app: open the hamburger menu, tap "Settings," then tap "Privacy Policy" to view the privacy notice and manage analytics.
We use cookies to analyze website traffic and optimize your website experience. By accepting our use of cookies, your data will be aggregated with all other user data.