Avenkin Privacy Policy

Effective 27 October 2026

1. Who we are

Avenkin is an iPhone app: a private AI assistant you use on your phone, from your watch, or with compatible smart glasses. It is made by Skunkworks NZ Ltd, a company in New Zealand ("we", "us"). Avenkin is source-available software, licensed under the Business Source License 1.1. This policy explains what the app does with personal information, and it applies to the iPhone app together with its Apple Watch app, widgets and share extension.

We don't run an account system and we don't have a server that collects your conversations or usage data. Section 3 describes the services the app can talk to.

2. What stays on your device

The following is stored in the app's own storage on your iPhone. None of it is sent to us.

• Conversation history with the assistant. You can lock it behind Face ID or your passcode (Settings, "Encrypt Conversations").
• Memories and knowledge: things you ask the assistant to remember, the people and topics it links together, and documents you add for it to search.
• Notes, saved places, location reminders, voice skills, playbooks, teleprompter scripts and study decks, plus any meeting summaries you ask it to save.
• Faces you teach it. Face recognition is off unless you turn it on, in Settings, "Devices & Privacy", "Glasses", "Enrolled Faces". It only ever names people you have enrolled, and the app asks you to approve each enrolment before it is saved. The person you enrol isn't told. For each one it keeps a numerical description of the face, with the name you gave it. It never stores a photo. Matching happens on your phone using Apple's Vision framework, and the face descriptions are never uploaded.
• Memory rewind audio. When you turn memory rewind on, the app keeps a rolling buffer of up to the last 10 minutes of audio. The buffer is held in memory and is never saved to storage. If you ask for a recap, the requested minutes are transcribed. The temporary audio file used for that is deleted straight afterwards.
• Captions. Captions only run once you start them. Recent captions are held in memory while the session runs.
• Recordings and meeting records that you choose to make, and their transcripts.
• Knowledge vaults, and Field Assist session logs if you use Field Assist.
• AI turn records: for each request to the AI, which model answered, how large each part of its instructions was, which manual pages and whether a photo went with it, which tools it used, how long it took and whether it failed. When the assistant searched the web, they also keep the search query and the text the search returned to the AI, shortened and with keys and tokens masked. Those can contain names, places or other personal details. Apart from searches, they contain no words from the conversation. They are kept for up to 14 days, or less once they reach their storage limit. They stay on the phone unless you put them in a support report, and you can delete them in Settings, "Diagnostics & Support".
• Usage and cost estimates worked out from each provider's reported token counts, and a log of the app's own network activity that you can view. Both stay on the phone.
• Settings, and the API keys and sign-in tokens you enter. See Security.

The app's diagnostic logging records only event names, counts, timings and one-way fingerprints. It is built so that it has nowhere to put what you said, what the camera saw, or your keys.

A few stores are excluded from iCloud and device backups so that deleting them really deletes them: conversation history, memories, the knowledge graph, documents and the face database. Your own writing (notes, places, scripts and similar) is included in your normal device backup so it survives moving to a new phone.

You can also pick on-device AI models and on-device speech recognition or voices. When you do, those steps run on your phone and don't use a cloud service.

3. What is sent to services you choose

Avenkin connects your glasses and phone to outside services. Each one receives only what its feature needs, and only when you use that feature. You deal with these services under their own terms and privacy policies. Most need you to enter your own API key or sign in to your own account with them. We don't receive a copy of what you send.

Diagnostics reports are only created when you ask for one in Settings, "Diagnostics & Support". You see the whole report before anything leaves the phone, and it's only sent if you share it yourself: by emailing it to us, through the share sheet, or as a pre-filled public GitHub issue that you choose to submit. An emailed report reaches us like any other email you send us, and you can add to it or change it before you send it.

Support reports are fuller, and are made the same way: in "Diagnostics & Support", from the Job tab, or from the offer the app shows when an AI request fails. Unlike a diagnostics report, a support report contains your conversations from the day or job you choose (what was said, as transcribed, and what the assistant replied), together with the AI turn records, the Field Assist job log, your phone and glasses details and the app's event log. Keys and tokens are masked. Nothing is created until you tap to make one, you see it before anything leaves the phone, and it's only sent if you send it yourself, through the share sheet or by email to the support address shown on the screen. On a personal phone that address is ours unless you enter another one in "Diagnostics & Support". On a phone set up by an organisation, or running on an organisation's licence, it is always the organisation's own address and never ours: the support address it set, or else the office that receives its job reports.

TestFlight. If you test a pre-release build through Apple's TestFlight, Apple may share crash reports and any feedback you submit with us, under Apple's TestFlight terms. The app itself sends no crash reports.

A voice you choose. If you paste an ElevenLabs voice ID into the app, or choose an OpenAI or xAI voice, which voice the assistant speaks with is your choice and your responsibility. Don't use a voice that imitates a real person without their permission.

You can see and switch off individual tools, check what context is sent to the assistant, and review recorded network requests in the app's settings.

4. Camera, microphone and people around you

The camera and microphone are used for the features you use. The app listens for its wake word. If you use Apple's speech recognition for this, the app asks for it to run on the device where your language supports it.

Bystander face blur. When you turn on "Blur Bystander Faces" in Settings (it's off by default), the app finds faces on your phone using Apple's Vision framework and blurs them before a camera image leaves the device. That covers images sent to an AI provider, video recordings, live broadcasts, browser streams and expert calls. Two exceptions are deliberate:

• Face recognition works on the unblurred image, because the blur would hide the very face being matched. That image stays on the phone.
• Photos you take yourself are saved without the blur.

In video, faces are detected several times a second and the blur follows them in between. Someone stepping into view can therefore be visible briefly before the next detection catches them.

If you record, broadcast or use face recognition around other people, you are responsible for doing so lawfully and with their consent where it is required. You can remove any face you enrolled at any time. See Retention and deletion.

Face recognition is off by default and only runs once you turn it on. It names only the people you have enrolled, after you approve each enrolment, and the people it recognises aren't told. If you used face recognition before this version, it stays on for you.

Social mode. Assistive Mode's Social mode looks at the person in front of you through the camera and describes what can be seen: their expression, where they're looking, their posture and what they're doing, so you can respond to them. It doesn't guess how they feel or what they intend. The app checks every answer before it is spoken and holds back any that names a feeling. The description comes from an AI model and can be wrong, and nothing about it is kept. You can turn it off in Settings, "Accessibility".

First-aid triage. First-aid coaching talks you through a protocol, and camera triage gives an AI assessment of an injury the camera can see. Both are advisory. They are not a medical device, and they don't replace a trained first aider or calling emergency services. Camera triage is for personal use: it isn't offered in Field Assist editions or on a phone managed by an organisation, where first-aid coaching still is. Triage results aren't saved. You can turn both off with "First-Aid Coaching and Triage" in Settings, "Devices & Privacy", "Hardware & Privacy".

The Clinical Assistant persona is a documentation aid for healthcare professionals. It can describe what the camera shows, suggest possibilities to consider and draft notes, but it does not make a diagnosis and it is not a medical device. The clinician using it remains responsible for every clinical decision.

Knowing you're talking to an AI. The assistant says it is an AI whenever it is asked, whatever name or voice you give it. The first time you talk to it, it introduces itself as Avenkin AI. After that, each time you open the app it says "Connecting to Avenkin AI" before its first answer or as a live session connects, and "Starting Avenkin AI translation" when a translation starts. You can turn those two lines off in Settings, under "Voice", unless your organisation has set them to always be said. When a live translation plays from the phone's loudspeaker, the person you are talking to is told once, in their language where the app has it, that it is a live AI translation. That line can't be turned off.

5. Health data

With your permission, Avenkin reads your heart rate, resting heart rate, sleep and steps from Apple Health to answer questions like "how did I sleep?", and the fitness coach reads your workouts and can save workouts you log to Apple Health. Avenkin never writes heart rate, sleep or steps. Step count and walking distance may also come from your phone's motion sensors.

"Share Health Data with AI" is off by default. While it's off, your Apple Health numbers stay on your phone: when you ask a health question with a cloud AI model, Avenkin speaks the answer to you itself with an on-device voice, and the AI provider learns only that you asked. If you turn it on, the summary and your workout history can be included in what is sent to your chosen AI provider so it can answer follow-up questions and discuss your progress. With an on-device model, nothing leaves your phone either way.

Because Apple Health can't be read while your phone is locked, Avenkin keeps the last summary numbers (never the underlying readings) encrypted on your phone for up to 24 hours, excluded from backups, so it can still answer from your glasses. You can clear them in Settings → Privacy → Health.

If you use the Personal Health Vault (part of the Medical Compliance subscription), the assistant can read the notes you keep there when you ask about them, and send them to your AI provider. You can turn off the assistant's access to the vault in Settings.

We never use health data for advertising, and none of it is sent to us.

6. Medical Compliance mode

Medical Compliance mode (called HIPAA mode in some places in the app) is a setting for people who handle clinical information. When it's on, the app:

• requires Face ID, Touch ID or your passcode to open the app
• protects recordings (audio and video), their transcripts, the list of recorded sessions, the audit log and clinical exports with iOS file protection, so they can't be read while the phone is locked, and keeps them out of backups. A recording that is still being written can finish while the phone is locked. Once it's closed, it can't be opened until you unlock. Protection applies from when you turn the mode on, including to the recordings and transcripts already in the app's own folders at that moment. Copies you save to Photos or to a folder you chose are outside this protection
• turns off web search, external messaging, cloud memory sync, cloud caption translation and cloud speaker diarization
• keeps an audit log of access to clinical data on the device
• deletes clinical data older than the retention period you choose

A further option, "Local LLM Only", sends requests to an on-device model instead of a cloud provider. If no on-device model is available, the request is refused.

This mode is a set of technical safeguards. It is not a certification, and using it does not by itself make an organisation compliant with any law. Organisational duties, such as agreements with any cloud provider you use, remain your responsibility.

7. Permissions

iOS asks for your permission before the app can use each of these. You can change your answer at any time in the iPhone Settings app.

• Bluetooth: to connect to your glasses.
• Camera and microphone: to capture photos and video and to hear the wake word and your requests.
• Speech recognition: to detect the wake word and transcribe what you say.
• Location: to give answers based on where you are. "Always" access is only used to alert you when you arrive at or leave a place you set a location reminder for.
• Contacts: to call, message or email people by name.
• Calendar and Reminders: to tell you about events and create events and reminders.
• Photos: to save glasses photos and keep them in their own album.
• Health and Motion: see Health data.
• HomeKit: to control your smart home.
• Apple Music: to play and control music, from your library or, with a subscription, from the Apple Music catalogue, and to add music to your library when you ask.
• Local network: to find AI servers on your own network and stream to a server on it.

Information from these sources is only sent to an AI provider when it is part of answering your request.

8. Children

Avenkin is not directed at children under 13, and we don't knowingly collect personal information from children. We don't collect personal information through the app from anyone. If you believe a child's information has reached us some other way, for example by email, contact us and we will delete it.

9. Retention and deletion

Because your data is on your phone, you control how long it's kept.

• Conversation history and memories are kept until you delete them, unless you choose a period in Settings, "History" (30 days, 90 days, 6 months or 1 year). Anything older is deleted, not hidden, the next time the app opens or returns to the foreground. You can delete conversations one at a time or all at once from the conversation list.
• Faces: remove someone in Settings, "Devices & Privacy", "Glasses", "Enrolled Faces", or say "forget [name]". "Forget Everyone" on the same screen removes them all. Face recognition can also be switched off there.
• Recordings, notes, places, documents and vaults can be deleted individually in the app. Notes are capped at the 50 most recent.
• Memory rewind audio is never saved, and it's cleared when you turn the feature off.
• Export files the app prepares for sharing are temporary, and it deletes them automatically.
• Deleting the app removes the data in the app's storage. iOS may keep Keychain items after an app is deleted, so remove your API keys and sign out in the app first if you want to be sure those are gone too.

Data you sent to a third-party service is kept under that service's policy. Contact the service to have it deleted.

10. Security

• API keys and sign-in tokens are stored in the iOS Keychain, on this device only. They are not synced to iCloud or included in backups. Each key is sent only to the service it belongs to.
• App data is protected by iOS Data Protection. The face database always uses the strongest protection class, which makes it unreadable while the phone is locked. Conversations stay encrypted until the phone is first unlocked after it starts, and can then be saved while it is locked, so a conversation held through the glasses with the phone in a pocket is not lost. In Medical Compliance mode, recordings, their transcripts, the list of recorded sessions, the audit log and clinical exports are also unreadable while the phone is locked, as described under Medical Compliance mode.
• "Encrypt Conversations" adds ChaCha20-Poly1305 encryption to saved conversations. The key is held by the Keychain, needs Face ID, Touch ID or your passcode to unlock, and the conversations lock again when the app goes to the background.
• Connections to cloud services use HTTPS. Plain, unencrypted HTTP is only allowed to addresses on your own local network and to your own Tailscale network (ts.net addresses), where Tailscale encrypts the traffic between your devices.
• You can lock the app's Settings behind Face ID or your passcode.

No system is perfectly secure. If you find a security problem, please report it privately to the contact address below rather than in public.

11. International transfers

The services in section 3 may process your data outside New Zealand, under their own privacy policies. Before you use a service, check where it processes data and read its policy:

• Anthropic
• OpenAI (AI models and the OpenAI voice)
• Google (Gemini, Vertex AI, Google News)
• Groq
• DeepSeek
• Mistral AI
• xAI (AI models and the xAI voice)
• OpenRouter
• Alibaba Cloud (Qwen)
• Z.ai (GLM)
• MiniMax
• ElevenLabs
• Deepgram
• Perplexity
• Tavily
• Brave Search
• DuckDuckGo
• Twitch
• Hugging Face
• GitHub
• Meta
• Apple

The aircraft, defibrillator and exchange-rate look-ups (adsb.fi, the Overpass API and Frankfurter) are public data services that receive only the look-up described in section 3. Servers you configure yourself (a self-hosted AI, an agent gateway, an MCP server, Home Assistant, a streaming server, a browser-streaming relay or your organisation's systems) are governed by whoever runs them.

12. Jurisdictions and legal basis

Skunkworks NZ Ltd is the company responsible for the personal information we handle (the "controller", in the words of the GDPR). The New Zealand Privacy Act 2020 applies to everyone who uses Avenkin. If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or the UK GDPR applies as well.

We handle very little ourselves, because most of what the app does happens on your phone or between your phone and a service you chose. Where the law asks what that rests on, these are the grounds we rely on:

• Your own decision. The app only uses a feature, and only sends anything to a service, because you turned the feature on, used it, or connected that service yourself. Nothing reaches us when you do.
• The subscription you bought. We provide what you paid for. Purchases are handled by Apple, and the app checks what you're entitled to on your phone.
• Our legitimate interest in fixing problems. When you choose to send us a diagnostics or support report, or email us, we use it to look into the problem and answer you, and for nothing else.

If your employer or another organisation gave you Avenkin, that organisation decides which job records, reports and transcripts its own systems receive, and it is responsible for what it does with them.

We have not appointed a representative in the EU or the UK. If you are there, contact us directly at the address under Contact.

If you are in the EU, the EEA or the UK, you have the GDPR rights listed under Your rights, as well as the New Zealand ones.

From 2 December 2027, face recognition will not be available in EU and EEA App Store regions, because the EU AI Act treats it as high-risk from that date. Faces you enrolled can still be forgotten there, one at a time or all at once.

AI-generated content is marked

When something the assistant wrote, or a recording that may contain its voice, is saved to a file that can leave your phone, the file says so in a form that both people and software can read:

• PDFs the assistant helped write (safety assessments, Field Assist job records, debrief notes and transcripts, and clinical transcripts) carry a title, the keyword "AI-generated" and standard document metadata naming the app, the model and when it was made, including the IPTC code that identifies content made by an AI model. A clinical transcript that is speech-to-text is labelled "Automatic transcription" instead.
• Clinical exports in Medical Compliance mode say in every format (PDF, FHIR, HL7 and plain text), and in what is sent to your organisation's record system, whether the text is an automatic transcription of what was said or was written by an AI model, and for model-written text, which model.
• Recordings made with "Include Assistant Voice" on carry a note in the file that they may contain synthetic speech from Avenkin AI. With it off, video and audio recordings are silenced while the assistant speaks from the phone's speaker, and no note is added.
• Saved text. Entries the assistant writes into a notes vault end with "Written by Avenkin AI from your dictation". A chat you share starts by saying the assistant's turns are AI-generated, and by which model where the app recorded it. An exported agent archive marks its documents as AI-generated and points to the file that records how they were made.

Some things are not marked: spoken answers, because no file is made; messages the assistant drafts, because you read, change and send them yourself; live broadcasts, because there is no file to carry a mark; and camera photos, because nothing in them was made by AI.

13. Your rights

Under the New Zealand Privacy Act 2020 you have the right to ask for access to personal information we hold about you and to ask us to correct it. We hold very little: usually just what's in any email you send us. Contact us at the address below. For information on your phone, you can view, change and delete it in the app. For information held by a service you chose, contact that service.

If you are in the EU, the EEA or the UK, you also have the right to ask us to delete the personal information we hold about you, to restrict how we use it, to have it in a portable form, and to object to our using it for our legitimate interest. Ask at the same address.

If you are not satisfied with how we handle a privacy concern, you can complain to the Office of the Privacy Commissioner at privacy.org.nz. In the EU or the EEA you can also complain to the data protection authority where you live or work, and in the UK to the Information Commissioner's Office.

14. Changes to this policy

If the app's handling of data changes, we will update this page and its effective date.

15. This website

avenkin.com is a static website. It sets no cookies, runs no analytics or advertising, and loads nothing from other sites: no hosted fonts, embedded video or social widgets.

The site is hosted on GitHub Pages. Like any web host, GitHub receives your IP address and browser details when you load a page and may keep them in its logs, under the GitHub privacy statement. We do not receive those logs.

16. Contact

Skunkworks NZ Ltd, New Zealand
Privacy enquiries: g@skunkworks.kiwi