Privacy Policy

Last updated: June 15, 2026

This Privacy Policy explains what information SpeakMic ("the Service", "we", "us") processes when you create or join a room, and why. SpeakMic is designed to be a minimal, privacy-respecting tool: it does not use advertising trackers and does not record or store audio. We use a small amount of cookieless, privacy-friendly analytics to understand site usage and performance, as described below.

TL;DR

  • Audio is never recorded or stored on our servers – it streams directly between devices (peer-to-peer, WebRTC).
  • We use cookieless, privacy-friendly analytics (Vercel Web Analytics & Speed Insights) to see aggregate visit and performance stats – no ads, no cross-site trackers, so no cookie consent banner is needed.
  • Rooms and chat messages are automatically deleted after a period of inactivity (1 day by default).
  • We only process the minimum needed to run a room (e.g. its name, access tokens/PIN hashes, and your IP address transiently via Cloudflare) – full details below.

1. Who is responsible for your data (data controller)

The Service is operated by:
Mateusz Barniak
Poland
Contact: mateusz@barniak.net

2. How SpeakMic works (technical overview)

In a Broadcast room, audio is sent directly from the broadcaster's device to each listener's device using WebRTC, a peer-to-peer (P2P) technology built into web browsers. In a Walkie-Talkie room, the same P2P approach is used, but the "speaker" role rotates: whoever presses the talk button streams audio directly to every other participant for the duration of their turn. A small "signalling" server is used only to help devices find each other (exchanging connection details) and to relay short text chat messages. The signalling server never receives, processes, or stores the audio stream itself, and audio is never recorded.

3. Information we process

The signalling server temporarily processes the following information while a room exists:

  • Room name – the name you choose when creating a room, shown to listeners.
  • Room access tokens / PIN hashes – random tokens used to identify the room's broadcaster or admin and authorise actions such as deleting the room. If you set a PIN (for example an admin PIN, or a PIN required to join the room), only a cryptographic hash of the PIN is stored, never the PIN itself.
  • Text chat messages – messages sent through the in-room chat are relayed to connected participants and kept only in the server's temporary in-memory/edge storage for the lifetime of the room. They are not written to a database or log file, and are deleted when the room expires or is deleted.
  • Walkie-Talkie nicknames – in a Walkie-Talkie room, the nickname you choose when joining is shared with other participants (shown in the participant list and alongside your chat messages) and is processed the same way as chat messages above. It is not linked to any account and is discarded when you leave or the room is deleted. If a room admin removes ("kicks") a participant, that participant's nickname is additionally stored (in lowercase) as part of the room's settings for as long as the room exists, so the same nickname cannot rejoin that room. The random per-room device identifier described in Section 5 is stored alongside it, so the same device cannot rejoin under a different nickname either.
  • Connection metadata – your device's IP address and WebSocket connection information are processed transiently by our edge network (Cloudflare) to deliver the connection and to apply basic rate-limiting/abuse protection. When you create a room, your IP address is additionally used to enforce a short-term limit on how many rooms can be created from the same address; this is stored briefly (up to about an hour) in Cloudflare's key-value store and then automatically deleted. This data is handled by Cloudflare as our infrastructure provider and is not stored by us beyond what is needed for that purpose.
  • Room registry (for administrative purposes) – when a room is created, its token, type (Broadcast / Walkie-Talkie), and creation timestamp are recorded in a lightweight internal registry in our key-value store. This registry is used only for: (a) the aggregate statistics shown in the admin panel (the number of currently existing rooms of each type, and the creation time of the most recently created one), and (b) an optional bulk-delete-all-rooms action (e.g. to clean up a test environment or respond to abuse), with an option to exclude rooms featured on landing pages. The admin panel does not provide a list of individual rooms based on this registry. The entry is removed from the registry when a room is deleted (individually or via bulk deletion by the Service's administrators), and in any case it expires automatically after at most 3 months from the room's creation (the same period as the permanent-room inactivity limit described in Section 7).
  • Frontend hosting logs and analytics – the SpeakMic web app itself (this website) is hosted on Vercel. Like any web host, Vercel's edge network processes your IP address and basic request metadata (e.g. browser user-agent) to serve the pages and for security and operational purposes (e.g. abuse prevention). We also use Vercel Web Analytics and Speed Insights to see aggregate, anonymised statistics about site usage (e.g. which pages are visited, referrers, country/region, device and browser type) and performance (Core Web Vitals such as load times). These tools are cookieless, do not use any persistent identifier, and do not track you across other websites.

We do not process audio content on our servers. Microphone audio is captured by your browser and streamed directly, peer-to-peer, to listeners' browsers.

4. STUN / TURN servers

To establish a direct P2P connection, WebRTC uses "STUN" servers to help devices discover how to reach each other across the internet. By default, SpeakMic uses public STUN servers operated by Google (stun.l.google.com). Establishing a connection via these servers can reveal your public IP address to that provider, which is normal and required for any WebRTC application. A deployment of SpeakMic may optionally configure an additional TURN relay server for users on restrictive networks; if so, audio may be relayed (but never stored) through that server.

5. Cookies and local storage

SpeakMic does not use cookies, and does not use any advertising or cross-site tracking technologies. We use Vercel Web Analytics and Speed Insights for aggregate site-usage and performance statistics; these are cookieless and do not use any tracking identifier or track you across other websites - see Section 3 for details.

The app stores a small amount of data in your browser's local storage (not a cookie) for purely functional purposes:

  • Broadcaster access token – if you create a room, a private token is saved on your device so you remain recognised as the broadcaster (e.g. after reloading the page). This is strictly necessary for the Service to function and is never sent anywhere except to our signalling server to authenticate your requests for that room.
  • "Install app" prompt dismissal – if you dismiss the prompt to install SpeakMic as an app, we remember that choice locally so it isn't shown again. This is a UI preference only.
  • Recent rooms – a list of rooms you have created or joined on this device (room link/token, name, and when you last joined) is kept in local storage so the "Recent rooms" list on the home screen can show them to you. This list is never sent to our servers and stays only on your device until you remove an entry or clear your browser's site data.
  • Walkie-Talkie device identifier – when you join a Walkie-Talkie room, a random identifier (not linked to your name or any account) is generated and stored on your device for that room. It is sent to the signalling server only so that, if a room admin removes you, the same device can be recognised and prevented from rejoining that room under a different nickname. It is discarded when the room is deleted or when you clear your browser's site data.

Because this data is strictly necessary for the Service to operate (or is a simple, non-tracking UI preference stored only on your own device), and because no cookies or cross-site tracking technologies are used, a cookie consent banner is not required under the ePrivacy Directive / GDPR for this Service. You can clear this data at any time by clearing your browser's site data for this site.

6. Browser notifications

While you are broadcasting, SpeakMic can show a persistent browser/system notification ("Still broadcasting") so you know your microphone is live even if the app is in the background, with a tap-to-return action. This requires your explicit permission via your browser's notification prompt, which you can grant, deny, or revoke at any time in your browser settings. Notifications are shown locally by your device while you broadcast — we do not operate a push notification server and do not send marketing notifications.

7. How long we keep data

Rooms (and any chat messages within them) are automatically deleted after a period of inactivity. By default, a room is deleted after 1 day with no active participants. When creating a Broadcast room, its creator can choose to make it "permanent" (this requires setting an admin PIN). Walkie-Talkie rooms created by users are always temporary; permanent Walkie-Talkie rooms can only be set up by the Service's administrators, for example as part of curated landing pages. A permanent room persists indefinitely, but will still be automatically deleted if it has had no activity for 3 months, or if its creator deletes it manually at any time.

Separately, the lightweight room-token registry described in Section 3 (a room's token, type, and creation date, used only for the admin panel's aggregate statistics and the optional bulk-deletion feature) is retained for at most 3 months from the room's creation and then automatically expires, regardless of the room's own lifecycle; it is removed earlier if the room itself is deleted.

8. Your rights

Depending on your location, you may have rights under data protection laws such as the GDPR, including the right to: access the personal data we hold about you; request correction or erasure; restrict or object to processing; and data portability. Because SpeakMic processes almost no persistent personal data (rooms and chat are deleted automatically and audio is never stored), most of these requests can be satisfied immediately without contacting us: a room's broadcaster or admin can delete the room (and its chat history) at any time directly from the app, which removes this data from our systems straight away. For any other request, contact us using the details in Section 1. You also have the right to lodge a complaint with your local data protection supervisory authority.

9. Children's privacy

SpeakMic is not directed at children under the age of 16 and we do not knowingly collect personal data from children. If you believe a child has used the Service in a way that raises privacy concerns, please contact us so we can address it.

10. International data transfers

The Service runs on a global edge network (Cloudflare) and its frontend is hosted on Vercel. As a result, the transient connection data described above may be processed in data centres located in different countries, including outside your own. Cloudflare and Vercel provide appropriate safeguards for such transfers under applicable data protection law.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

12. Contact

If you have questions about this Privacy Policy or how your data is handled, contact us at mateusz@barniak.net.

Back to SpeakMic