Last updated: September 30, 2026
Penny is a personal, independent voice assistant app. This page explains what data the app accesses, why, and what happens to it. Penny is built around one rule: it only ever acts when you directly ask it to — nothing runs, listens further, or sends data anywhere on its own initiative.
Penny is developed and operated by an independent developer as a personal project. For GDPR purposes, this individual is the data controller for the data Penny processes — the contact below is also the contact for the controller (info@pennyvoice.com).
Penny processes your data on the basis of your consent — given when you connect a Google or Spotify account, grant Penny permission to use the microphone, contacts, location, or camera on your phone, or simply use the app. You can withdraw consent at any time (see "Your rights under GDPR" below) - Penny then immediately stops processing the relevant data.
If you choose to connect a Google account, Penny requests the following permissions:
Penny never requests broader access to your Google account than this.
If you connect Spotify, Penny can control playback (play, pause, skip, search, volume) on your behalf. It does not access your listening history, saved library, or any personal data beyond what's needed to control playback.
Account sign-in tokens are stored encrypted on your device (Android's secure keystore) and are used only to talk directly to Google's or Spotify's own servers on your behalf — Penny does not run its own backend server, and tokens are never sent anywhere else. App preferences (language, app color, saved parking location, etc.) are stored as plain files on your device only.
All communication between Penny and Google's or Spotify's servers uses HTTPS/TLS encryption in transit. Sign-in tokens are stored using Android's secure keystore (hardware-backed encryption where the device supports it), never as plain text. Penny has no backend server of its own — your calendar events, tasks, and Drive files are never copied to or stored on any server the developer operates; they pass directly between your device and Google's own APIs (and, to fulfil your specific request, Google's Gemini API) for the sole purpose of answering that request, and are not retained afterward. Access to this data is limited to the app instance running on your own device, authenticated using your own Google sign-in — no other party, including the developer, has a separate channel to it.
Sign-in tokens and app preferences stay on your device until you disconnect the app or uninstall it. Penny also gradually builds a short list of facts about you (e.g. names of people close to you, preferences) to help it answer more accurately - this also stays on your device only. Diagnostic logs that Penny backs up to your own Drive at your request are not removed by the app itself - they stay there until you delete them.
To understand and respond to what you say, your requests are sent to Google's Gemini API. Speech recognition and voice output use Google Cloud's speech APIs. These providers process the request text/audio needed to answer you; Penny does not share your data with advertisers, data brokers, or anyone else, and nothing is sold.
Limited Use compliance: Penny's use and transfer of information received from Google Workspace APIs (Calendar, Tasks, Drive) adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to fulfil the specific request you made in the moment - it is never used, transferred, or sold to develop, train, or improve any generalized or foundational AI/ML model, including Google's Gemini, which Penny calls only to answer that one request.
Penny uses Firebase Crashlytics to automatically detect and report app crashes and errors, so problems can be found and fixed. What's sent is strictly technical: the exception type and stack trace, and basic device information (phone model, Android version, app version). Crashlytics never receives your conversation content, calendar entries, notes, messages, or anything else from Penny's own detailed activity log - that stays on your device (and, only when you explicitly ask for a backup, in your own Google Drive) regardless of whether a crash occurs. Crashlytics is operated by Google/Firebase under its own privacy terms.
Speech recognition, Gemini's responses, and voice output are provided through Google's cloud services, which may process your request on servers outside the European Union/EEA. This processing takes place under Google's own standard contractual clauses and certifications for transferring data outside the EU.
You have the right to access, rectify, erase, restrict the processing of, port, and object to the processing of your data. Because Penny doesn't run its own server and keeps your data directly on your phone and in your own Drive, you already have direct access to it:
If you need help with any of this, contact the email below. You also have the right to lodge a complaint with a supervisory authority - in the Czech Republic this is the Office for Personal Data Protection, or the equivalent authority in your own EU member state.
Penny relies on speech recognition and AI (Google Gemini) to understand and act on your requests, and can trigger automated actions on your behalf - alarms, timers, reminders, calendar entries, navigation, and more. Like any software, these can occasionally fail: a command can be misunderstood, a network or third-party service can be unavailable, or an underlying bug can prevent an action from completing as expected (for example, an alarm not ringing). Penny is provided "as is," without warranty that any automated action will always succeed, and the developer is not liable for consequences arising from a failed or incorrectly executed automated action. For anything time-critical or important, verify the result yourself rather than relying on Penny alone.
Questions about this policy or your data? Contact info@pennyvoice.com.
If Penny's features change in a way that changes what data it accesses, this page will be updated accordingly.