Your startup idea is valuable. Here's exactly how we protect it.
The Short Version
0Ideas stored permanently
E2EEncrypted sessions
GDPRCompliant
SOC2In progress
Our Data Principles
- No Permanent Idea StorageVoice sessions are processed in real-time and not recorded. Your idea description exists only during the active session.
- Encrypted in TransitAll data between your browser and our servers is encrypted with TLS 1.3. WebSocket connections for voice use WSS (encrypted).
- Reports Are YoursGenerated reports are stored in your account and can be deleted at any time. We don't use your data to train models.
- No Third-Party SharingYour idea, reports, and session data are never shared with third parties, advertisers, or other users.
Infrastructure
| Component | Provider | Region | Encryption |
|---|---|---|---|
| Voice processing | Google Gemini Live | US/EU | TLS 1.3 + WSS |
| Report storage | Firebase / Google Cloud | US | AES-256 at rest |
| Authentication | Firebase Auth | Global | OAuth 2.0 / Email |
| Payment processing | Polar (MoR) | EU | PCI DSS compliant |
| Web hosting | Vercel | Global CDN | TLS 1.3 |
What We Store vs. What We Don't
| Stored | Not Stored | |
|---|---|---|
| Voice audio | Raw audio is never saved | |
| Session transcripts | Optional (your choice) | Deleted if you choose |
| Generated reports | In your account | |
| Your idea description | Not stored after session | |
| Email & auth | Required for account | |
| Payment info | Handled by Polar (MoR) |
AI Model Usage
We use multiple AI models for cross-verification. Important details:
- Your data is not used to train any AI models — we use API-only access
- Sessions use Google Gemini, Anthropic Claude, and other models via API
- Each model provider's enterprise API terms prohibit training on customer data
Note
Cross-model verification means your data is sent to multiple AI providers for fact-checking. All providers are bound by enterprise API agreements that prohibit data retention and model training on customer inputs.
Your Rights
- Access: Download all your data at any time from Settings
- Delete: Remove your account and all associated data
- Portability: Export reports as PDF
- Consent: You choose what to store, what to delete
Compliance Roadmap
We're actively working toward formal certifications:
- GDPR — Compliant (EU data handling, right to deletion, DPA available)
- SOC 2 Type II — In progress, expected Q3 2026
- HIPAA — Not applicable (we don't handle health data)
Questions?
Contact us at privacy@gonogo.team for any security or data handling questions. We respond within 24 hours.