The short version
Hollr has no ads, no analytics and no tracking. We never sell or share your information.
In an iCloud space (iPhone and Apple Watch only), your messages, transcripts, reactions, name, colour and role are kept in iCloud, in a space shared with the people in it. They don’t pass through servers of ours, and we don’t access them. The one exception is a report: if someone reports a message and chooses to include what was said, we see that message’s transcript, never its audio. And if you use Lock Screen talk, a small relay server of ours keeps what it needs to wake your iPhone for new messages: a push token and some random IDs, never audio or words (see section 6).
To let people join with a code, to alert them while Hollr is closed, and to let anyone report a message or a person to us, Hollr saves a few small records in its public iCloud database. If we suspend an Apple Account after reports, we add a record there too. They hold things like a first name, a space’s name and the space’s iCloud link, never audio. Only a report can hold anything said in a message, and only if the person reporting chooses to include it. We can see these records. Section 2 lists exactly what’s in them.
Apple’s speech recognition makes the transcripts, on the device where it can.
Apple handles purchases. We never see your payment details.
A space that Android phones can join has to live somewhere every phone can reach, so Hollr keeps it on its own server instead, and you get a Hollr account: a random ID, with no email or password (section 2). You can delete that account, and everything you sent, from Settings › Delete my account at any time.
You can delete your recent messages, leave a space or close a space you started at any time.
You can block anyone. Blocking stays on your own devices, and the person isn’t told.
1. Who we are
“Hollr”, “we” and “us” mean the independent developer of the Hollr app, the seller named on Hollr’s App Store page. This policy covers the Hollr app for iPhone, the Hollr app for Apple Watch, the Hollr app for Android, Hollr’s widgets and controls, and this website.
Hollr uses Apple’s services for almost everything:
iCloud (CloudKit) to store and share messages
Apple Push Notification service to deliver alerts
Apple’s speech recognition for transcripts
the App Store for purchases
Apple’s Privacy Policy (apple.com/legal/privacy) describes how Apple handles data in those services. There are two exceptions, both small servers we run on Cloudflare: the Hollr relay, which wakes iPhones for Lock Screen talk (see section 6), and Hollr’s server for spaces Android phones can join (see section 2). For those spaces, Google’s Firebase Cloud Messaging delivers alerts to Android phones (firebase.google.com/support/privacy), and Slack tells us when a report comes in. That Slack alert holds only the report’s reason and a reference number. Cloudflare’s privacy policy (cloudflare.com/privacypolicy) describes how Cloudflare handles the data it processes for us.
2. What Hollr handles, and where it lives
On your iPhone and Apple Watch
Each device you use Hollr on keeps its own copy of:
Your profile: the name you type, your avatar colour and your role (Parent, Kid, Grown-up or Partner). On an Apple Watch that runs on its own, you only type a name: Hollr sets the role to Kid and picks the colour.
Your spaces: the people in them, their invite codes and each space’s iCloud link.
Messages: voice messages (audio files), their transcripts and reactions, and whether you’ve played them.
Your settings: Listening, Auto-play, Transcripts, Haptics, quiet hours and Lock Screen talk.
People you’ve blocked: each one’s name, colour and Hollr ID, their iCloud user ID if Hollr has it (see below), and when you blocked them. Your iPhone also sends this list to its paired Apple Watch. If someone new in a space uses the same iCloud account as a person you blocked, Hollr keeps them on a short list until you’ve said whether to block them too. It never blocks them on its own. Messages you’ve reported are marked as hidden on that device.
Your suspension check: your iCloud user ID (see below), so Hollr can check whether we’ve suspended your Apple Account. If we have, Hollr keeps that too, with its end date if it has one, so it applies from the moment Hollr opens. For a suspension with an end date, Hollr also keeps a reading of iCloud’s time, so changing your device’s clock can’t end it early. A suspension is kept separately for each Apple Account used on the device.
The Activity tab’s weekly numbers are worked out on your device from the messages already there.
Each time Hollr opens, it removes messages older than 30 days from that device. They stay in iCloud until they are deleted or the space is closed (see section 11).
Hollr saves the date your free week started in your keychain (iCloud Keychain, if you have it on), so reinstalling Hollr doesn’t start a new free week. Deleting the app doesn’t remove this date from your keychain.
Like other app data, what Hollr keeps on your iPhone is included in your iCloud Backup or computer backup, if you use one.
In iCloud: your spaces
A space is stored in the iCloud account of the person who started it, in their CloudKit private database, and uses their iCloud storage. iCloud sharing makes it available to the people who join, through their CloudKit shared database. Inside a space, Hollr keeps:
People: each person’s name, avatar colour and role, whether they use an iPhone or an Apple Watch, whether they’re listening, when they were last active, and a short status such as “Quiet hours”.
Messages: the audio, its length, a simple waveform, when it was sent, who sent it, who it’s for, and its transcript if one was made.
Reactions: who reacted to which message, and with which reaction.
The space itself: its name, its current invite code and when that code expires, and how many people the space can hold.
Everyone in a space can see its people, its messages to everyone and its reactions. When someone joins, Hollr gives them the space’s earlier messages to everyone too, so they can hear and read what was said before they joined.
Messages sent to one person are stored in the same shared space. Other people’s devices download them as part of syncing, but Hollr doesn’t keep, show or play them there. Only the two people in that conversation see them.
Apple encrypts iCloud data in transit and when it’s stored on Apple’s servers. Hollr doesn’t add end-to-end encryption of its own.
Who can join a space. Each space has an iCloud link. Anyone with that link, or with a valid invite code, can join the space if it has room, using any Apple Account signed in to iCloud. The link is part of the invite message Hollr shares, and it keeps working for as long as the space exists. Anyone in a space can share its code and link, not only the person who started it. Only share them with people you want in your space.
What we can see. We don’t run servers that handle your messages, and we, the developer, don’t access your spaces. The invite records described below include each space’s iCloud link, and we can read those records, so we commit never to use them to join or open a space.
When you join a space, iCloud adds you to that space’s share. Apple keeps that list. Hollr uses it only so the person who started the space can remove someone. iCloud may show the name on the Apple Account of the person who started a space to people who open its link.
In iCloud: Hollr’s public database
Some information can’t live inside a private space. Someone needs it before they’ve joined, or while their copy of Hollr is closed. Hollr keeps that information in the CloudKit public database for the Hollr app. The Hollr app on any device can read records there, and so can we through Apple’s CloudKit tools, so they hold as little as possible. iCloud also attaches to each record a random ID for the iCloud account that created it (the same ID across Hollr, but different from the one other apps see), and the times it was created and changed.
Invite codes. When someone in a space makes a code (when the space starts, when someone taps Make a new code, or after someone is removed), Hollr saves:
the six-character code
the space’s name
the iCloud link to the space
when the code expires
Each code works for seven days, even after a newer one is made. When the person who started a space closes it or removes someone, Hollr deletes the space’s current code, if they made it. Other codes, including earlier ones and codes made by other people in the space, can stay in the public database, with the space’s name and link, until we delete them. Hollr won’t let anyone join with an expired code, but the link stored with it keeps working while the space exists.
Alert pings. iOS doesn’t reliably wake an app that’s closed. So after you send a message, and its five-second Undo window has passed, Hollr saves a small “ping” record that lets iOS alert the people the message is for. A ping holds:
your first name (the first word of the name you typed) and your Hollr ID, so the app of someone who has blocked you can hide the alert
the space’s name, and whether the message went to everyone or only to that person
the message’s length, for example “Voice message · 0:12”
the IDs Hollr uses for the message, the conversation and the space (a one-to-one conversation’s ID is made from the two people’s Hollr IDs)
the Hollr IDs of the people to alert, and whether each alert should make a sound
When someone reacts to your message, a separate ping tells you about it. It holds their first name and Hollr ID, the space’s name, a line such as “Reacted ❤️ to your 0:05 message” or “Heard you, can’t talk right now”, the same IDs, and your Hollr ID.
A ping never holds audio or anything said in a message. Unsending a message deletes its message ping straight away, but not pings about reactions to it. Otherwise, the sender’s app deletes its pings once they’re ten minutes old, the next time it sends a message or reaction. If it never does, for example because the sender stops using Hollr, a ping can stay in the public database until we remove it.
Alert subscriptions. Each iPhone, and each Apple Watch that runs on its own, saves alert subscriptions in the public database. They contain your Hollr ID and tell iOS which pings to show you. Hollr removes them when you leave your last space yourself. If you’re removed from your last space, the space is closed, or you delete Hollr without leaving, they can stay in iCloud. Hollr also saves subscriptions in your own iCloud databases so that iCloud can tell it when a space changes. We can’t see those.
Reports. When you report a message or a person in Hollr, it saves a report record with:
the reason you picked, and your note if you wrote one
the space’s name, and whether it’s the demo family
the reported person’s name and Hollr ID, and their iCloud user ID if Hollr has it (the random ID described above, from the records they created in the space)
your Hollr ID
for a message: its ID and when it was sent, and its transcript only if you chose to include it
A report never holds audio. A report sent from an Apple Watch that runs on its own holds the reason but no note, and never what was said. Unlike the other records here, other people’s Hollr apps can’t read reports: only we can, through Apple’s CloudKit tools (iCloud may also let the person who sent a report read it back). The person you report isn’t told. We use reports only to look into misuse of Hollr, and to suspend an account if we need to (see below). We delete each report once we’ve dealt with it, keeping only a short private note about it (see section 11).
Suspensions. If reports show that someone broke our Terms of Use, we can suspend their Apple Account in Hollr. The Terms of Use explain what that means. We do it by adding a suspension record to the public database ourselves. It holds:
the account’s iCloud user ID (the random ID described above, taken from a report)
when the suspension ends, if it has an end date
It holds no name, no reason and nothing else from the report. Only we can make, change or delete suspension records. Like invite codes, they can be read by the Hollr app on any device: that’s how your Hollr checks whether your own account is suspended. It looks up only your own account: when Hollr opens, wakes in the background or sends something (at most about every 10 minutes), every 10 minutes while it’s open, when your iCloud account changes, when a suspension is due to end, and before you start or join a space. Hollr doesn’t tell the people in your spaces. The record isn’t secret, though: someone who knows your iCloud user ID could look it up outside Hollr.
While there’s a suspension record with an end date for your account, and only then, Hollr also asks Apple’s CloudKit server (api.apple-cloudkit.com) for the time. That way, changing your device’s clock can’t end the suspension early. The request holds nothing about you or your account, not even your iCloud user ID. Like any web request, it reaches Apple with your device’s IP address and the app and system version. Hollr reads only the time from Apple’s reply.
We delete a suspension record when we lift the suspension, and once its end date has passed.
On Hollr’s server: spaces Android phones can join
When you start a space with “Android phones can join” turned on, or join one with its code, Hollr creates a Hollr account for you on its server. There’s no email, phone number or password: the account is a random ID, and your phone keeps a secret key for it (in the keychain on iPhone, and in the app’s private storage on Android). The server keeps only a scrambled form of that key.
For these spaces, the server keeps:
Your account: the name you type, your avatar colour and role, whether you use iPhone or Android, whether you’re listening, a short status such as “Quiet hours”, when you were last active, the IDs of people you’ve blocked, and whether we’ve suspended the account.
Spaces: each space’s name, who started it, who’s in it and when they joined, how many people it can hold, and its invite codes and when they expire.
Messages: the audio, its length, a simple waveform, when it was sent, who sent it, who it’s for, and its transcript if one was made. Audio is stored with Cloudflare.
Reactions: who reacted to which message, and with which reaction.
Alert tokens: the push tokens Apple or Google give your phone, so the server can alert you, and, if you use Lock Screen talk, its Push to Talk token for each space.
Reports: the reason, your note if you wrote one, who you reported and which message, and its transcript only if you chose to include it. Never audio.
Everyone in a space can see its people, its messages to everyone and its reactions. Messages sent to one person can be fetched only by the two people in that conversation.
Alerts. When you send a message, the server asks Apple or Google to alert the people it’s for. An alert holds your first name, the space’s name, whether the message went to everyone or just to them, its length (for example “Voice message · 0:12”) and the IDs Hollr uses for it. A reaction alert holds the reaction instead. Alerts never hold audio or anything said. People who have blocked you aren’t alerted.
What we can see. Unlike an iCloud space, these spaces are on a server we run, so we, the developer, could technically access what’s stored there. We look at a space’s content only to deal with a report, and then only the reported message. Like any web service, Cloudflare receives your phone’s IP address with each request, and the server may keep brief technical logs of errors. We don’t use them to identify or track you.
Data on the server is encrypted in transit (HTTPS), and Cloudflare encrypts it at rest. Hollr doesn’t add end-to-end encryption of its own. Cloudflare may store it in data centres outside your country.
Moderation. If reports show that someone broke our Terms of Use, we can delete a reported message for everyone, remove the person from the space, or suspend their Hollr account, so they can still listen, leave or delete their account, but can’t send, react, or start or join spaces.
Between your iPhone and Apple Watch
Your iPhone uses Apple’s WatchConnectivity to send your paired Apple Watch your profile, your current space, its people and their status, its invite code and iCloud link, and the people you’ve blocked, so the watch needs no setup. In the demo family, messages also travel between the two this way. In a real space, your iPhone and your Apple Watch each connect to iCloud directly.
A watch that runs on its own, such as a child’s watch set up with Family Setup, joins with a code and keeps its own copy, just like an iPhone.
Widgets
Hollr’s widgets and its Talk control read a small summary that the app saves on your iPhone. It’s kept in a container shared only by Hollr and its widgets (an App Group) and includes:
the space’s name
the first names, initials and colours of the people in it, and who’s listening
the last four messages, with their senders, lengths, times and transcripts
Apart from your device backups, this summary stays on your iPhone.
3. Microphone
Hollr asks to use the microphone so your family can hear you. It records only while you’re sending a message: while you hold the talk button, between two taps when you use VoiceOver, or while Lock Screen talk is sending. Each message is at most 60 seconds. Hollr never listens unless you’ve started a message. You can turn off microphone access at any time in Settings › Privacy & Security › Microphone.
4. Speech recognition and transcripts
If you allow it, Hollr uses Apple’s speech recognition to turn voice messages into text, so you can read them when you can’t listen.
Hollr asks for this to happen on the device itself. If the device or your language doesn’t support that, Apple’s speech recognition may process the audio on Apple’s servers, under Apple’s privacy policy. If your language isn’t supported at all, Hollr uses US English recognition. We never receive the audio. We see a transcript only if someone reports that message and chooses to include it (see section 2).
Messages you send from iPhone with Transcripts on: the transcript is saved with the message in your space, so everyone the message is for can read it.
Messages sent from Apple Watch, or with Transcripts off: they’re sent without a transcript. Each listener’s iPhone may then make its own, using that iPhone’s speech recognition, which can include Apple’s servers. That transcript stays on the listener’s iPhone.
Messages you receive without a transcript: if you have Transcripts on, your iPhone makes one, and it stays there.
Turning off Transcripts in Hollr’s Settings affects only your own device. You can also turn off speech recognition for Hollr in your iPhone’s Settings.
5. Notifications
With your permission, Hollr alerts you to new messages and reactions:
Apple Push Notification service delivers alerts from pings, even when Hollr is closed.
If Hollr is running, it may swap that alert for its own. The app’s own alert can include the transcript and, on iPhone, the audio. Alerts stay in Notification Center until you clear them.
Alerts appear on your Lock Screen and Apple Watch according to your notification settings.
When you’re Muted, alerts arrive silently. During quiet hours, Hollr’s own alerts are silent. An alert delivered straight from iCloud follows the status you had the last time you opened Hollr, so it can still make a sound if your quiet hours began after that.
If you tap a reaction button on an alert, Hollr sends that reaction in the background without opening.
While Hollr is open, alerts from people you’ve blocked and about messages you’ve reported don’t show. One that arrives while Hollr is in the background or closed can still show, and Hollr removes it the next time it runs.
Silent background pushes from iCloud tell Hollr that a space has changed, so it can sync.
If notifications are on, Hollr also sends one reminder, the day before your free week ends.
6. Lock Screen talk
Lock Screen talk is part of Hollr Family. It uses Apple’s Push to Talk feature to put a talk button on your Lock Screen and in the Dynamic Island, and iOS shows the name of your current space there. It also lets new messages play out loud on your iPhone while it’s locked, even when Hollr is closed. To do that, iOS gives Hollr a push token, and Hollr sends it to the Hollr relay, a small server we run on Cloudflare, together with your random Hollr ID, your current space’s ID and the Hollr IDs of the people you’ve blocked. When someone in your space sends a message, their Hollr tells the relay the message’s ID. The relay reads that message’s alert record from iCloud (see section 2), and asks Apple to wake the iPhones of the people who are listening, skipping anyone who has blocked the sender. The wake-up carries only the sender’s first name and the message’s ID: your iPhone then fetches the audio from iCloud as usual. The relay never receives audio or transcripts. It keeps one record per iPhone, deletes it when you turn Lock Screen talk off or leave the space, and drops any it hasn’t heard from in 30 days. It keeps the IDs of messages it has passed on for one day, so each is sent only once. We can see these records, and we use them for nothing else. In a space Android phones can join, Hollr sends the push token to Hollr’s server instead (see section 2), which wakes your iPhone the same way, never with audio or words. Without Lock Screen talk, messages arrive as regular notifications.
7. Siri and Shortcuts
“Talk in Hollr” and the Talk control only open Hollr on the talk button. Hollr doesn’t receive anything you say to Siri.
8. Purchases and the free week
You buy and manage Hollr Family through your Apple Account, and Apple handles the payment. We never see your payment details, your name or your email address.
Hollr checks with the App Store whether you have an active plan, and when you first downloaded Hollr, so it knows when your free week started.
Apple gives developers sales reports. If you’ve chosen to share analytics with app developers in your device’s settings, Apple also shares crash reports and app usage data, in a form that doesn’t identify you to us.
9. Children and families
Hollr is made for families, and children use it, often on an Apple Watch set up with Family Setup. A child can only join a space with a code or invite link from someone already in it, usually a parent.
We don’t build profiles, show ads or track anyone, children included, and children’s audio is never sent to us. To deliver invite codes and alerts, Hollr stores a first name, a space’s name and link, and random Hollr IDs in its public iCloud database, as section 2 describes. We can see those records, and we use them for nothing else. A child’s words reach us only if someone reports one of their messages and chooses to include its transcript, or if the child reports someone and writes a note. If we suspend an account after reports, including a child’s, our record holds only that account’s random iCloud user ID and, if it has one, an end date.
A child’s name, colour, role, messages and reactions are stored like everyone else’s: in iCloud for an iCloud space, or on Hollr’s server for a space Android phones can join (section 2), and shared with the people in their space.
Anyone in a space can invite people by sharing its code or link. Only the person who started it can remove people or close it, and closing the space deletes its messages for everyone.
Anyone can block a person, or report a message or a person to us, from the iPhone app or from a watch that runs on its own. We can suspend someone’s Apple Account in Hollr if they broke our Terms of Use, so they can still listen but can’t talk, react, invite anyone, or start or join spaces.
Deleting messages and leaving a space are done in the iPhone app. On a watch that runs on its own, ask the person who started the space to remove the child.
Children should use Hollr with the permission of a parent or guardian. If you’re a parent with a question, send us a message.
10. What we don’t do
No sign-up. You type a name, and pick a colour and a role. A space Android phones can join gives you a Hollr account, but it’s only a random ID: no email, phone number or password.
No ads and no ad networks.
No analytics and no tracking. Hollr for iPhone and Apple Watch is built only with Apple’s frameworks and contains no third-party SDKs. Hollr for Android uses Google’s Firebase Cloud Messaging only to receive alerts, without Firebase Analytics.
No tracking across other companies’ apps and websites, so Hollr never asks for tracking permission.
No selling or sharing of your information, with anyone.
11. How long things are kept, and how to delete them
A message you sent: stays in iCloud until you delete it or the space is closed. Hollr sends a message as soon as you let go. To take it back, tap Undo on the “Sent to…” banner right after sending. Later, long-press the message in the iPhone app and choose Delete for everyone. Deleting a message also removes its reactions and the alert about it. You can delete a message only while it’s still in Hollr on your iPhone (the last 30 days), and not from Apple Watch. Older messages stay in the space until it’s closed. Anyone who already listened has heard it.
Your reactions: kept until you take them back or the message is deleted.
On your devices: messages older than 30 days are removed when Hollr opens, and a space’s messages are removed when you leave it. Leaving your last space deletes your messages, people and settings from that device. A few small items can remain: the free-week date in your keychain, alerts already in Notification Center, the people you’ve blocked (so they stay blocked if you meet them in a new space), your suspension check (see section 2), and some internal preferences. Deleting Hollr removes its data from that device, except the keychain date.
Leaving a space: takes you off its list of people and off its iCloud share. The messages you sent stay in the space under your name, so delete any you want gone before you leave.
Being removed from a space: works the same way as leaving. Your messages stay in the space under your name. Someone who was removed can rejoin with the space’s link (see section 13).
Closing a space you started: deletes the space and every message in it from iCloud. Everyone’s devices remove it on their next sync. Its current invite code is deleted too, if you made it.
Invite codes, pings and alert subscriptions: see section 2.
Reports: in an iCloud space, kept only while we look into them, then deleted. On Hollr’s server, a report is kept with a note of what we did, and deleted 12 months after we dealt with it.
Suspensions: a suspension record stays in the public database until we lift the suspension or its end date passes, and then we delete it. Leaving your spaces or deleting Hollr doesn’t end a suspension, because Hollr looks it up in iCloud again.
Our notes on reports: when we deal with a report, we keep a short private note: the date, the reported person’s iCloud user ID, their name and the space’s name from the report, the iCloud user ID of the person who sent it, and what we did, including any suspension’s end date. It lets us weigh later reports about the same person and answer appeals. We delete each note 12 months after the report, or 12 months after the suspension it led to ends, whichever is later.
People you’ve blocked: kept on your device until you unblock them in Settings › Blocked people, or delete Hollr.
Messages you send us through the Support form: kept only as long as we need them to help you, and deleted if you ask.
Your Hollr account (spaces Android phones can join): kept until you delete it. Settings › Delete my account, on iPhone or Android, closes the spaces you started (deleting their messages for everyone), takes you out of the rest, deletes every message you sent through the server and its audio, takes back your reactions, deletes your alert tokens, and replaces your name on the server with “Former member”. It can’t be undone. Deleting Hollr from your phone without doing this leaves your account on the server, and we can delete it if you ask.
On Hollr’s server: messages and reactions stay until they’re deleted, the space is closed, or the sender deletes their account. Expired invite codes are deleted 30 days after they expire. Alert tokens from a phone that hasn’t opened Hollr for 180 days are deleted, and Lock Screen talk tokens after 30 days without use.
We don’t open your spaces, so please use the controls above to delete messages. If you ask, we can delete invite codes, pings and reports from the public database. We can’t delete alert subscriptions, because iCloud keeps them under your own account: Hollr removes them when you leave your last space yourself.
12. Your choices and rights
Turn microphone, speech recognition and notification access on or off in your iPhone’s Settings.
Turn Transcripts, Listening and quiet hours on or off in Hollr’s Settings.
Depending on where you live (for example the EU, the UK or California), you may have the right to access, correct or delete your personal information, or to object to how it’s used. Most of your data stays under your own control, in Hollr and in iCloud. For anything we can reach, such as records in the public database, your Hollr account or a support message, contact us and we’ll help.
If your Apple Account is suspended and you think it’s a mistake, tell us through the Send us a message form on our Support page.
13. Security
Spaces are shared through iCloud sharing. Anyone with a space’s link, or a valid code, can join it if it has room. When the person who started a space removes someone, Hollr takes them off the share and replaces the invite code. The space’s link doesn’t change, though, so someone who was removed can rejoin with the link from their original invite. To keep them out, close the space and start a new one. Apple protects iCloud data as described in section 2.
14. This website
Framer hosts this website. If you send us a message through the Support form, we receive your name, email address, topic, the device you pick (if any) and your message, and use them only to reply. We don’t run ads or tracking on this site. To deliver and protect the site, Framer may process technical data such as IP addresses.
15. Changes to this policy
If Hollr changes what it handles, we’ll update this page and the effective date at the top. For significant changes, we’ll also tell you on this website, or in the app where that makes sense.
16. Contact us
For questions or requests about privacy, the quickest way to reach us is the Send us a message form on our Support page.
Also read