Void for Android and iOS
Last updated 5 October 2026 · ai.voidapp.app
Your conversations are stored on your device, not on our servers. To answer your messages, the text you send goes to the AI provider you have chosen. We hold a small amount of technical data needed to issue and protect access credentials. Some of that technical data, including IP addresses and installation identifiers, may be personal data.
Void is operated by Daniel Carr. You can contact us at void@dehpi.com.
Void is intended for adults aged 18 and over because third-party models may produce material unsuitable for minors. The app does not currently perform age verification or present an in-app age gate. The iOS listing is configured as 17+; distribution platforms may also apply account or parental controls. This policy describes the intended audience, not a verified-age control.
Void contacts our provisioning service at void.dehpi.com only after you explicitly
agree to use hosted AI with built-in access. You may decline and configure a local provider
without creating an installation record. Supplying your own OpenRouter key does not use our
provisioning service.
| Data | Why we need it | Where it is held |
|---|---|---|
| Install identifier — a random UUID generated on your device | Identifies the credential | A per-install record on our service |
| Google Play Integrity token | Confirms the request comes from a genuine copy of the app installed through Google Play | Verified with Google, then discarded. Never stored |
| Apple App Attest key identifier, attestation receipt, public key, and assertion counter | Confirms iOS built-in-access requests come from this app and prevents replay | The per-install App Attest record; attestation challenges expire after five minutes |
| Device key hash | Links an acknowledged credential to the install | The per-install record |
| App version and platform | Minimum-version enforcement and diagnostics | Operational logs |
| IP address | Rate limiting only, to stop one source exhausting the free allowance | A UTC-day counter, separate from your install record. It expires at day end and cleanup runs hourly, so it is removed within one hour after expiry |
| Request outcome, status, timing, and a random request ID | Operational logging | Operational logs |
The install identifier is a random UUID generated on your device. It is not your Android ID, not an advertising ID, and not derived from any hardware or account identifier. We do not add your name, email address, or advertising identifier to it.
We never receive the content of your conversations. Our service has no route that accepts message content, and it does not log request bodies, tokens, or keys.
We also send operational events to Cloudflare Analytics Engine recording route, outcome, status code, platform, app version, and latency. These events do not contain prompts, attachments, API keys, installation identifiers, IP addresses, or request bodies. Worker logs may also contain request IDs and error diagnostics. Cloudflare documents Analytics Engine retention as three months. If persistent Workers Logs are enabled, Cloudflare retains them for three days on its Free plan or seven days on a Paid plan. The applicable plan and any dashboard-only log exports must be verified in the live Cloudflare account.
When you send a message, its full content — the conversation history in that branch, any images you attach, and your chosen model and settings — is transmitted to the provider you have selected.
Used for all hosted models, whether you are using the built-in allowance or your own key. OpenRouter's handling of that data is governed by their privacy policy at openrouter.ai/privacy. OpenRouter routes requests onward to the underlying model provider — Anthropic, Google, Meta, DeepSeek, and others — each with their own terms and retention practices. We have no control over, and no visibility into, how long those parties keep your messages.
When you use the built-in allowance, the credential we issue is registered with OpenRouter under a name containing your install identifier. OpenRouter can therefore associate requests made with that credential to that identifier. The identifier remains random and is never linked to your identity by us.
If you sign in with your own OpenRouter account, the credential is created on your account, and OpenRouter can associate that usage with you.
If you point Void at Ollama, LM Studio, vLLM, or any other endpoint you control, your messages go directly there. They reach neither us nor OpenRouter.
You can withdraw your agreement at any time with Stop using hosted AI in Settings → Data & Privacy. After that, the app sends no new messages to OpenRouter through the built-in allowance and contacts our provisioning service no further; a reply that is already streaming may finish. Your chats and settings stay on your device. The built-in credential also stays on your device, unused, so that Use hosted AI can turn access back on without issuing a new one. Your own OpenRouter key and any server you run yourself keep working. Withdrawing does not delete the records we hold; see Deleting your data.
| Data | How it is stored |
|---|---|
| Conversations, messages, image attachments, drafts, usage history, settings | A local database in the app sandbox. Not separately encrypted by the app in current builds; it relies on the operating system's device protection and sandboxing |
| Text and document attachments | Plain files in the app's private storage |
| API keys, device credential, install identifier | Platform secure storage (Android Keystore-backed storage or the iOS Keychain). iOS Keychain items may persist after uninstall and be available after reinstall on the same device, subject to Apple's Keychain behaviour |
Void can optionally require biometric authentication to open. Biometric data never leaves your device and is never available to us — the operating system performs the check and reports only success or failure.
On Android, conversations, attachments, and stored credentials are excluded from automatic backup and device transfer. On iOS, credentials use the Keychain and local app data is subject to Apple's platform backup behaviour.
| Permission | Used for |
|---|---|
| Camera | Only when you choose to take or attach a photo |
| Biometric / Fingerprint | The optional app lock |
Standard networking and system permissions required by the app framework are also present. Void requests no microphone, location, contacts, or storage access.
Void permits unencrypted HTTP connections so that it can reach AI servers on your own local network, which typically do not use TLS. All connections to our service and to OpenRouter use HTTPS.
Void provides access to third-party AI models. We do not generate, filter, curate, or endorse what those models produce. Output may be inaccurate, offensive, or unsuitable for some users, and is not a substitute for professional advice. You are responsible for how you use it, and for complying with the terms of the providers you route through.
To report objectionable output, email void@dehpi.com with a description of what happened and the model involved. We review every report and may restrict access to a model in response.
You can also report a reply from inside the app. A report is sent only when you tap Send. It contains the category you choose, an optional note, the model identifier, app version, and platform, plus the reply's text only if you switch on Include this reply's text. Your own messages are never sent. Your IP address is used only as a one-way hash for daily rate limiting and is not stored with the report. Reports are kept for 90 days and then deleted, and are used only to review model output and enforce our policies.
Settings includes Delete all chats and Reset all local data, which clears every local record. If a built-in credential exists, Reset also asks our service to revoke it and issue a replacement, which stays unused on your device unless you agree to hosted AI again. Uninstalling removes the app database and files, but iOS Keychain items may remain as described above. Deleted chats are not recoverable — we hold no copy.
We keep your installation and App Attest records until you ask us to delete them. Day-scoped rate-limit counters expire at the end of their UTC day and are deleted by hourly cleanup; five-minute App Attest challenges are deleted within one hour after expiry.
To request deletion, email void@dehpi.com with your install identifier, which you can find in Settings → About. We will delete the associated installation record, App Attest record, outstanding challenges, purchase records, and reset reservations, and revoke the associated OpenRouter credential within 30 days. You can also simply uninstall the app — though the server-side record remains until you request its removal.
Operational logs and aggregate events cannot be located by installation identifier because those datasets do not contain it. Analytics Engine events age out after Cloudflare's documented three-month retention period. Persistent Workers Logs, if enabled, age out after the plan-dependent three- or seven-day period described above; any external log export requires separate live-dashboard verification.
If you are in the EEA or the UK, you have rights of access, rectification, erasure, restriction, and portability under the GDPR. If you are in California, you have rights under the CCPA.
Because we hold only a random identifier and technical logs, with nothing tying them to you as a person, the scope of what such a request can return is limited. We will respond to any request sent to void@dehpi.com within 30 days.
We will update this policy when the app's behaviour changes, and revise the date at the top. Material changes will be noted in the app or in the release notes.