Zero-Knowledge Architecture

At ModVoice, we operate on a fundamental principle: We cannot sell, lose, or leak data that we do not have.Unlike traditional platforms that act as central intermediaries, ModVoice is engineered as a trustless, cryptographic transport layer.

Peer-to-Peer Routing

Voice and video data are transmitted directly between participants using Mesh WebRTC architecture. Our servers facilitate the initial handshake, but the actual media streams never traverse our backend infrastructure.

DTLS-SRTP & AES-GCM

All real-time media streams are mandatory-encrypted using DTLS-SRTP. Direct messages and file attachments utilize AES-GCM 256-bit encryption with ECDH key derivation, securely locked on your local device.

01. Information Collection & Volatility

ModVoice strictly abides by the principle of data minimization. We only collect the absolute minimum data required to facilitate your connection:

A. Persistent Data (Account & Social Connections)

If you choose to authenticate or link third-party social connections (Google, YouTube, GitHub, Twitter, Twitch, Bluesky), we securely store basic profile identifiers required to verify your identity. Specifically for YouTube, we request the youtube.readonly scope to fetch your YouTube Channel ID, Custom URL, and Display Name. For Bluesky, we request basic profile data to fetch your DID, handle, and display name. This data is exclusively used to display a verified link to your channel or profile on your public ModVoice profile. We do not access, manage, or modify your accounts, videos, or subscriptions. You may delete any linked connection at any time from your user settings, which permanently wipes the linked data from our databases. ModVoice's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace or YouTube data to develop, improve, or train generalized or third-party AI/ML models.

B. Volatile Data (Signaling Data)

To establish a P2P connection, your device generates ICE candidates and Session Description Protocol (SDP) offers. This metadata is transmitted through our signaling server, held in memory solely for the duration of the handshake, and instantly purged once a connection is established.

C. Friendships & Relationships

To manage who can contact you, we store a list of your established "Friends" and pending "Friend Requests". This data maps your user ID to others and is used solely to enforce your Direct Message privacy settings (e.g., blocking non-friends from messaging you). We do not perform social graphing or suggest connections based on your friend list.

D. Uploaded Assets

Static assets that you explicitly choose to make public, such as custom server banners, guild icons, or custom emojis, are hosted on secure Cloudflare R2 object storage. These assets are public by nature and do not contain cryptographic material.

E. Anti-Abuse & Security Logging

While we prioritize privacy, we aggressively defend our infrastructure. We automatically collect and indefinitely retain non-cryptographic network metadata (such as IP addresses, device fingerprints, and raw API transaction logs) for accounts that engage in fraudulent marketplace activity, API abuse, or malicious server boosting. This data is exclusively used for issuing permanent bans, mitigating DDoS attacks, and cooperating with law enforcement when legally required.

F. Supporter & Creator Tipping Data

When sending a voluntary contribution through a ModVC Support page (modvc.org/donate/[handle]), we process the supporter's provided display name, optional accompanying message note, contribution amount, selected currency, and the transaction identifier returned by Whop Inc. (provider_payment_id). ModVoice never receives, processes, or stores raw payment card numbers, bank account numbers, or CVV security codes; all payment transactions are hosted and executed exclusively by Whop Inc.

G. Bio & Support Page Analytics

To provide creators with essential profile insights, we compute aggregated, privacy-preserving visitor counts (bio_stats_daily). We do not deploy cross-site tracking cookies, fingerprinting pixels, or behavioral advertising trackers to collect this data.

02. Data Processing for Trust & Safety

Crucial Distinction: Our automated reporting and AI moderation pipeline applies exclusively to Public Server Channels. Personal 1-on-1 Direct Messages (DMs) are strictly End-to-End Encrypted (E2EE). We do not—and mathematically cannot—scan, process, read, or moderate your private DMs.

To maintain a safe community in public spaces, we utilize an automated reporting and moderation pipeline. This pipeline involves strict privacy constraints regarding how your data is handled when flagged:

✓ AI Text Analysis: When a text message is reported by at least three unique users, its content and the report reason are transmitted to Mistral AI for semantic evaluation. This data is strictly used for real-time safety evaluation and is never used to train our AI models or third-party models.
✓ Media and Server Reports: AI models do not evaluate your media (images, videos, zips) or full server reports. These are encrypted at rest and escalated to a secure human moderation panel where authorized administrators manually review the reported content.
✓ Creator Support & Stream Overlay Moderation: Supporter messages submitted with voluntary contributions and displayed on public tip jars and live OBS stream overlays (modvc.org/overlay/[token]) are evaluated in real time via OpenAI's multimodal moderation API (omni-moderation-latest). Messages flagged for hate speech, harassment, sexually explicit content, violence, or self-harm are automatically suppressed or blurred on live stream overlays. OpenAI processes this data ephemerally, and messages are never used to train artificial intelligence or machine learning models.
✓ False Report Logging: If an AI determines a report is malicious or false, the reporter's ID is logged internally to apply a "false report strike." This metadata is retained solely to prevent targeted harassment and spam.
✓ Censored Data: Once a reported message is confirmed as a violation, its contents are permanently overwritten with a tombstone string (`[This message is hidden pending manual review]`) in our databases. The original text is irrecoverably wiped from our active clusters.

03. End-to-End Encryption (E2EE) for Text & Media

We deploy a zero-knowledge architecture for all Direct Messages (DMs) and direct file transfers. ModVoice employees, administrators, and automated systems are mathematically incapable of reading your messages or viewing your private media.

✓ Cryptographic Key Generation: Your browser utilizes the Web Crypto API to generate a secure ECDH key pair. The private key never leaves your device and is optionally stored in IndexedDB, encrypted by a passcode only you know.
✓ Media Encryption: Before an image, video, or file is uploaded to our servers, your browser generates a single-use AES-GCM key to encrypt the raw binary data.
✓ Opaque Blob Storage: Our servers only receive and store the resulting mathematically scrambled blob. We do not possess the decryption key.
✓ Secure Key Exchange: The single-use decryption key is sent to your recipient over an established E2EE WebRTC tunnel. If our database is compromised, attackers retrieve nothing but useless cryptographic noise.

04. Zero-Retention Audio & Video Policy

ModVoice operates strictly as a real-time communications layer. We do not record, intercept, transcribe, or store your voice calls or video feeds.

Direct Message (DM) Calls: These rely on a pure Peer-to-Peer (P2P) WebRTC architecture. The actual audio/video streams flow directly between the network interfaces of the participants and are End-to-End Encrypted via DTLS-SRTP. We store basic call history logs (timestamps, call status, and duration) to display call records in your chat logs; crucially, these logs are fully End-to-End Encrypted (E2EE) locally on your device before transmission, meaning they are only readable by you and the recipient. ModVoice administrators have zero visibility into your call records. The media contents are strictly P2P and encrypted.
Server Voice Rooms: To support large groups without crashing your network connection, Server Voice Rooms route media through a Selective Forwarding Unit (SFU). The traffic is encrypted hop-by-hop between you and our SFU infrastructure. It is processed in memory solely to mix and route the streams to other participants, and is instantly discarded. It is never written to disk or recorded.

06. Monetization Architectures: Server BYOG Stripe vs. ModVC Creator Support

ModVoice operates two distinct financial architectures depending on the service utilized:

A. Server Communities: Bring Your Own Gateway (BYOG)

For community server storefronts, digital goods, and server boosts, ModVoice operates a decentralized "Bring Your Own Gateway" (BYOG) model. We do not process funds, hold balances, or take platform fees. Transactions route directly to the respective Server Owner's integrated Stripe account.

Server Owners act as sole Merchant of Record. ModVoice never touches fiat currency.
API keys use Zero-Trust Edge encryption (server-side AES-256 in memory) and are never exposed to clients.
No credit card numbers or banking credentials are ever collected or stored on our servers.

B. ModVC Support Pages & Bio Lifetime Pro (Whop Merchant of Record)

For voluntary creator tips via ModVC Support (modvc.org/donate/[handle]) and Bio Lifetime Pro upgrades, payment checkout and compliance are hosted and executed by Whop Inc. as the authorized Merchant of Record (PCI-DSS Level 1 certified).

Whop processes all payments, handles fraud detection, and remits applicable state and international sales taxes and VAT.
Under our 0-day security hold policy, the creator's 95% net share is transferred automatically to their connected Whop sub-merchant payout balance upon payment settlement.
ModVoice records transaction settlement metadata and platform splits in an append-only cryptographic ledger (ledger_entries) in our secure cloud database for financial accounting and anti-fraud verification.

07. Third-Party Subprocessors

To deliver a global, low-latency, and secure creative ecosystem, we utilize highly vetted third-party subprocessors under strict data processing agreements:

Google Firebase

Authentication & Real-time Database (Signaling). ISO 27001 & SOC 3 Compliant.

Cloudflare

Edge Routing, DDoS Protection, and R2 Object Storage for public static assets.

STUN/TURN Relays

Global relays for NAT traversal. Relays transmit opaque encrypted packets and cannot decrypt media.

Whop Inc.

Merchant of Record, payment gateway, and automated sub-merchant payouts for Creator Support & Bio Lifetime Pro. PCI-DSS Level 1 certified.

OpenAI

Real-time safety moderation (omni-moderation-latest) for supporter messages and live stream overlays. Zero retention for AI model training.

Turso / LibSQL

Encrypted cloud database hosting profile configurations, creator consents, and immutable financial ledger entries.

08. Global Data Rights (GDPR & CCPA)

Regardless of where you reside, we grant all our users the rights afforded by the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):

Right to Access: You may request an export of the account data we hold about you.
Right to Erasure (Right to be Forgotten): You can initiate the deletion of your account at any time via your user settings. To prevent unauthorized deletions, this requires verification via a one-time password (OTP) sent to your email. Once verified, your account enters a 14-day grace period. During this grace period, your account is securely locked—you will be unable to send messages, join servers, create developer applications, or make purchases—but you can cancel the deletion at any time by logging in and navigating to your settings. After 14 days, your profile data (email, name, IPs), server memberships, and developer bots are permanently purged, and your past messages are anonymized to "Deleted User" to maintain conversation flow for others.
Note on Financial & Ledger Records: In compliance with statutory financial reporting, taxation, and anti-money-laundering regulations, immutable transaction records (ledger_entries) and payment transaction references associated with processed donations are retained for the legally mandated statutory period and are exempt from instant erasure.
Right to Rectification: You can update your display name, email, or avatar at any time.
Right against Profiling: We do not run algorithmic profiling, nor do we sell your data to advertising brokers.

09. Cookies and Local Storage

ModVoice is free of third-party advertising trackers, analytical pixels, and invasive marketing cookies. We use browser localStorage, cookies, and IndexedDB for functional purposes (login sessions, custom themes, volume, and cryptographic key caching) and basic performance metrics via Google Analytics to track stability.

You can manage, disable, or clear any of these cookies and storage items at any time through our storage preferences panel. Declining or turning off a preference will instantly delete the corresponding data from your browser storage.

Privacy Policy