App privacy policy

AEIOU privacy policy

For AEIOU on iPhone and iPad. Effective from 1 January 2026. Last updated 4 October 2026.

AEIOU is an intelligent AAC (augmentative and alternative communication) keyboard for iPhone and iPad, built by Chardie. This page explains exactly what AEIOU does, and does not do, with your data. It is written to match the app's actual technical behaviour, and serves as the privacy policy submitted to Apple's App Store.

Who operates AEIOU

AEIOU is built and operated by Chardie, based in Manchester, United Kingdom. Chardie is the data controller for any personal data processed in connection with the app. As set out below, though, that processing is intentionally minimal.

Data we collect: none

Chardie does not collect any personal data through AEIOU. We have no servers that AEIOU contacts. We do not have a Chardie account system. We do not track you, identify you, or build any profile of your behaviour.

In Apple's App Store privacy taxonomy, the relevant declaration is "Data Not Collected".

What's stored on your device

AEIOU stores the following on your device, in standard iOS storage (UserDefaults) provided by Apple, scoped to the AEIOU app:

• App settings: your preferences for theme, voice, rate, pitch, scanning behaviour, and so on.
• Pinned phrases: phrases you have explicitly chosen to keep one tap away.
• Word and phrase learning: small frequency counts that let predictions improve as you type. Capped to keep storage bounded.
• Recents: the most recent sentences you have spoken, so you can repeat them with one tap.
• Blink calibration: the threshold and timing parameters AEIOU has learned for your blink, so the feature works accurately for you.
• Habits: which phrases you chose in which situation (for example "when a drink arrived" or "at Home"), and a small score for how useful each kind of suggestion has proved. See Language model and what the app learns.
• Saved places: the names and coordinates of places you or a carer chose to save, if you use location-aware suggestions.
• Carer profile and setup answers: optional facts a carer entered (such as names of people in your life) and your answers to the setup questions.
• Taught and learned replies: replies a carer typed in ("when someone says X, reply Y") and, only if you switch it on, replies the app has learned from you.

All of this is on your device. None of it is transmitted to Chardie. Deleting AEIOU removes it. Resetting it inside the app's settings removes it.

Face data and the TrueDepth camera

AEIOU is an accessibility keyboard where the user can make a selection in one of two ways: by tapping the screen, or, optionally, by blinking. Blink selection is an optional input method offered as an alternative for users who cannot reliably tap the screen. Granting camera access is not required to use the app; you can use AEIOU entirely with screen taps and never enable the camera.

When you turn on blink selection, AEIOU uses the TrueDepth front camera via Apple's ARKit ARFaceTrackingConfiguration for the sole purpose of detecting deliberate eye blinks. From each camera frame the app reads only two numeric values: the left-eye and right-eye blendShape closure values produced by ARKit (eyeBlinkLeft and eyeBlinkRight, each a number between 0.0 and 1.0).

AEIOU does not access, store, transmit, or share the camera image, the face mesh, the depth map, the face pose, or any other facial feature or blendshape. The two eye-closure values are used in memory in real time and are then discarded. They are not logged, persisted, accumulated, profiled, or used to identify the user.

Retention of face and camera data: none. The camera frames, and the two eye-closure values ARKit derives from them, exist only in volatile memory for the instant they are processed, and are released frame by frame. AEIOU writes no camera image, depth map, face mesh, face pose, or blendshape to storage at any point, so there is no TrueDepth or face data to retain, expire, or delete, on your device or anywhere else. This data is never used for advertising, analytics, profiling, or any purpose other than detecting the blink you are making in that moment, and it is never shared with Chardie or any third party. The camera is active only while blink selection is switched on.

No face data leaves the device. AEIOU contains no analytics, advertising, or crash-reporting SDKs and makes no network requests of any kind. iOS shows the green dot in the status bar whenever the camera is active, which lets you verify for yourself that the camera is only on when blink selection is in use.

When you run the in-app calibration, AEIOU derives a small set of numeric thresholds tuned to your natural blink: a closure threshold, a minimum hold time, a maximum blink duration, an open-eye baseline, a peak amplitude floor, and a minimum peak dwell time. These thresholds are stored locally in the iOS UserDefaults container on your device. They are not face data: they are detector settings, do not describe your face, and cannot be used to identify you. They are removed when you delete the app.

You can disable blink selection at any time from inside AEIOU. You can also revoke camera access entirely in iOS Settings → Privacy & Security → Camera.

The back camera: "What's around me"

A frame is looked at every few seconds, not continuously, and only while this feature is on. If Listen is also on and the other person asks something like "which one do you want?", AEIOU takes one extra look to work out what might be meant. To protect the battery and keep the phone cool, AEIOU looks less often, or pauses, when the phone is warm, the battery is low, Low Power Mode is on or the app has been idle. The blink camera and this camera cannot run at the same time; blink selection takes priority.

The back camera does not change anything said above about blink selection: the front camera still reads only two eye-closure numbers. iOS shows its green dot whenever either camera is active.

Microphone and conversation listening

AEIOU includes an optional Listen feature. It is off by default and only runs while you have explicitly switched it on. Its purpose is to help you reply faster: it listens to what the other person in the conversation is saying and suggests possible replies you can select with a blink, instead of spelling every word out.

While Listen is switched on, AEIOU uses the microphone together with Apple's on-device Speech framework (SFSpeechRecognizer, with requiresOnDeviceRecognition enabled) to turn the other person's speech into text. This happens entirely on your device. AEIOU does not use any server-based or cloud-based speech recognition, and the app makes no network requests of any kind — this is true of every feature in AEIOU, including Listen.

Audio is never recorded to a file, saved, or transmitted anywhere. The transcribed text is held in memory only, for the sole purpose of suggesting replies, and is discarded shortly after. Where the app briefly needs the general shape of the conversation to suggest a relevant next reply (for example, a topic mentioned a moment ago), that context is also kept in memory on the device and is not written to persistent storage or sent off the device.

Reply suggestions, including those generated while Listen is on, are produced using Apple's on-device Foundation Models framework, which runs locally on the device. No transcript, suggestion, or conversation content is sent to Apple, to Chardie, or to any other party.

The microphone is active only while Listen is switched on and is released the moment you switch it off. Listen is entirely optional — AEIOU is fully usable for typing and speaking your own words without ever enabling it. You can revoke microphone or speech recognition access at any time in iOS Settings → Privacy & Security.

Noticing sounds (optional, inside Listen). A further switch lets AEIOU recognise general kinds of sound, such as a doorbell, a ringing phone or an alarm, so it can offer a matching suggestion. It uses Apple's on-device SoundAnalysis framework on the same microphone stream Listen already has open (it never opens a second one), classifies only the category of sound, and does not transcribe or analyse speech for this purpose. It has effect only while Listen is on, stores nothing, and sends nothing anywhere.

Learned replies (off by default). If you or a carer switch on "Learn my replies", then while Listen is running AEIOU keeps a short note of a question that was just heard (as brief text, never audio) with the reply you then chose, so the same answer can be offered first next time. This is the one case where heard text is kept after the session. Every note is listed in Settings → Reply memory, can be deleted one at a time or all at once, is stored only on the device, and nothing new is recorded while the setting is off.

Location and saved places

AEIOU has an optional "Location-aware suggestions" feature, off by default, so that suggestions fit where you actually are (for example, not offering "I want to go home" when you are already at home). This is not live tracking and AEIOU never looks up an address. You or a carer save a few named places by standing at the spot once and capturing it using Apple's Core Location. AEIOU then checks only whether you are near one of those saved spots, entirely on the device. No map, address or reverse-geocoding service is used, and nothing is sent anywhere.

Saved places (names and coordinates) stay on the device where you saved them. They are never synced to iCloud, never shared, and are removed when you delete them in the app or delete AEIOU. Location permission is asked for only when you switch the feature on.

Calendar

AEIOU has an optional "Calendar-aware suggestions" feature, off by default. It reads your calendar (Apple's EventKit, read-only, on the device) to offer general phrases such as "I have something on today". AEIOU deliberately never reads out, stores, or passes to the on-device AI the title of any event, because titles can carry clinical or personal detail you never chose to make speakable. Only the general timing (today, tomorrow, later this week) is used. Nothing is sent anywhere.

Reminders, contacts, movement, phone state and battery

Four more optional features make suggestions fit the moment. Each is off until you switch it on, asks for its own permission only then, works entirely on the device, and sends nothing anywhere.

• Reminders (EventKit, read-only): checks whether a reminder is due and whether it looks like a medication reminder, so AEIOU can offer "Is it time for my medication?". The reminder's title is used only for that on-device check; it is never displayed, spoken, stored or included in any prompt.
• Contacts: reads first names and nicknames, held in memory only, so AEIOU can recognise and complete the names of people in your life. Phone numbers, email addresses and notes are never read.
• Movement (Motion & Fitness): tells whether you are still or travelling in a vehicle. Nothing is recorded.
• Phone state (no permission needed): whether the phone is charging overnight or connected to car audio, to guess that it may be bedtime or that you are travelling.

Battery and temperature. To avoid overheating the phone or draining the battery, AEIOU reads the battery level, whether Low Power Mode is on, how warm iOS reports the phone to be, and how long since the app was last used, and uses these to slow down or pause the optional camera and sound features. These readings are used in memory only and are never stored or sent anywhere. You can switch this behaviour off in Settings → Battery & performance.

Apple Watch body signals (Health)

Where available, an optional "Apple Watch body signals" feature reads heart-rate and active-energy data from Apple Health (HealthKit, read-only). It uses your heart rate as one more hint when suggesting phrases: if it is well above your own usual for that time of day while you have been resting, AEIOU may offer a short check-in phrase. It is off by default and asks for Health access only when you switch it on.

Health data is never written to Health, stored by AEIOU, transmitted, used for advertising or shared with anyone. It is processed on your device and is not collected by Chardie. This is not a medical feature: it does not measure your health, diagnose anything, give health advice or raise alerts, and it must not be relied on for safety or in an emergency.

Language model and what the app learns

Word prediction model. To choose better next words, AEIOU contains a small language model (SmolLM2-135M by Hugging Face, Apache Licence 2.0) stored inside the app. It runs entirely on the device using Apple's Core ML, reading the words typed so far in the current sentence, in memory, to rank likely next words. The model is fixed: it is never downloaded, updated or queried over a network, and it is not trained or changed by anything you type. It can be switched off in Settings → Battery & performance.

What the app learns about you. Three kinds of note are kept on the device, as counts and short text, never audio or images:

• Words and phrases you use: which words follow which, how often, and at what time of day.
• Habits by situation: which phrase you chose when something was true, such as "when a drink arrived", "when the doorbell rang" or "at Home", so it can be offered first next time. Only a general label of the situation is kept, never a photo, recording or coordinates.
• Which suggestions you pick: a small score for each kind of signal (for example calendar or sound), so the ones that prove useful count for more.

These stay on the device and are not synced. Settings → Personalisation → "Reset everything learned" erases all of them, together with learned replies, at once.

Setup questions and other people

The guided setup asks things like the main reason for using AEIOU, how the person selects things, a few optional facts about them, and which optional features they want. The answers only configure the app, are stored on the device as ordinary settings, and are never sent to us. Setup can be skipped and run again from Settings.

Listen can hear, and "What's around me" can see, people other than the user. Both work only on the device and keep nothing beyond the moment (apart from the optional learned replies described above, which keep the text of a question, never a voice). We suggest telling people nearby when either is switched on.

Speech and Personal Voice

AEIOU speaks the text you compose using Apple's AVSpeechSynthesizer. Speech happens locally on your device using the system voices installed by iOS. AEIOU does not send your text to any speech service operated by Chardie or any third party.

On iOS 17 and later, AEIOU can read text in your Personal Voice, an Apple feature that lets you record a model of your own voice. Personal Voice is recorded by you in iOS Settings → Accessibility → Personal Voice, not in AEIOU. Apple stores the voice model on your device and protects it under your device authentication. AEIOU only requests access to use voices you have already created, and that access can be granted or revoked at any time in iOS Settings.

iCloud sync (optional)

If you enable iCloud sync, AEIOU stores a small portable subset of your data (your pinned phrases, your most recent spoken sentences, and your app settings) using Apple's NSUbiquitousKeyValueStore. This places the data in your own iCloud account, encrypted by Apple, so that a paired iPhone or iPad signed in to the same iCloud account can pick it up. Word and phrase learning, habits, saved places, the carer profile, taught and learned replies, blink calibration, and every camera, microphone, location, calendar and Health setting never sync. They stay local to each device. This copying is carried out by iOS and iCloud, not by any server of Chardie's; AEIOU's own code makes no network requests.

Chardie cannot see this data. It is your iCloud, your encryption keys, and entirely under your control. You can disable iCloud sync inside AEIOU at any time, and you can revoke iCloud access for AEIOU in iOS Settings → [your name] → iCloud.

Data retention and deletion

Because AEIOU keeps everything on your device and sends nothing to Chardie, retention is entirely in your hands. Chardie holds no copy of any of it, because Chardie receives none of it. Here is how long each kind of data exists, and how it is removed:

• TrueDepth camera frames and face data: not retained. Processed live in memory by Apple's ARKit and released frame by frame. No camera image, depth map, face mesh, face pose, or blendshape is ever written to storage. Retention period: none. Real-time, in-memory only.
• Microphone audio and conversation transcripts (Listen, optional): not retained. Processed live, on-device, by Apple's Speech framework. Audio is never recorded to a file; transcribed text and reply suggestions are held in memory only and discarded shortly after use. Retention period: none.
• Blink calibration settings: kept until you remove them. The small set of numeric thresholds produced by calibration is stored in on-device UserDefaults so blink selection keeps working accurately for you. These are detector settings, not face data. They remain until you recalibrate, reset them in the app's settings, or delete AEIOU.
• Typed text: not retained as a log. AEIOU keeps no running record of everything you type. Text you compose exists only until it is spoken or cleared.
• Word and phrase learning: kept until you reset or delete. Small, size-capped frequency counts held on your device. Removed when you reset learning in the app's settings or delete AEIOU.
• Back-camera frames and sounds: not retained. Frames and audio are analysed live on the device and discarded; only a short label is held in memory for a moment. Retention period: none.
• Habits, saved places, carer profile and replies: kept until you remove them. Habits and learned replies are erased by Settings → Personalisation → "Reset everything learned" (learned replies and taught replies can also be deleted one by one in Reply memory); saved places and the carer profile are deleted where they are edited. Deleting AEIOU removes them all.
• Reminders, contacts, calendar and Health readings: not retained. Read on demand on the device and held in memory only; reminder and event titles are never stored.
• Pinned phrases and Recents: kept until you remove them. Stored on your device so they stay one tap away. Deleted individually inside the app, or all at once by deleting AEIOU.
• App settings: kept until reset or delete. Your preferences stay on your device until you reset them or remove AEIOU.
• iCloud sync data (only if you enable it): kept until you disable it. A small subset (your pinned phrases, recent spoken sentences, and app settings) lives in your own iCloud account, encrypted by Apple, until you turn sync off or delete AEIOU. Chardie cannot see it.

Deleting AEIOU removes every piece of on-device data listed above. There is no Chardie-side copy to request, export, or erase, because none is ever created. The one exception is any support email you choose to send us, which lives in our mailbox. See Contact and the Chardie privacy policy.

Third parties

AEIOU does not embed any third-party analytics, advertising, attribution, crash-reporting, A/B-testing, or feature-flagging SDKs. The only external code in the app is Apple's own iOS frameworks (SwiftUI, UIKit, Foundation, ARKit, AVFoundation, Vision, SoundAnalysis, Speech, CoreLocation, EventKit, Contacts, CoreMotion, HealthKit, CoreML, NaturalLanguage, FoundationModels, Combine) and one bundled data file, the SmolLM2-135M language model (Apache Licence 2.0), which runs offline inside the app and contacts nothing.

Use by children and vulnerable users

AEIOU is designed to be safe to use for people of any age, including children, and for users who may rely on a carer to set the app up. Because AEIOU collects no personal data, there is no Chardie-side profile that could be built about a child or vulnerable user. Carers and parents are responsible for any iOS Family Sharing controls they wish to apply at the device level.

Permissions AEIOU requests

• Camera: only if you choose blink detection (front camera, two eye-closure numbers) or "What's around me" (back camera, objects and printed text). Used live, in memory, on-device.
• Microphone and speech recognition: only if you switch on the optional Listen feature. Used to turn the other person's speech into text, and (if you also switch on "Notice sounds") to recognise kinds of sound, entirely on-device. Released the moment Listen is switched off.
• Location (when in use): only if you switch on location-aware suggestions. Compared with places you saved yourself; never tracked or looked up.
• Calendars and Reminders: only if you switch on those features. Read-only, on-device; event and reminder titles are never read out or stored.
• Contacts: only if you switch on "Names from Contacts". First names and nicknames only, held in memory.
• Motion & Fitness: only if you switch on movement awareness.
• Health (heart rate and active energy, read-only): only if you switch on Apple Watch body signals. Never stored or sent.
• Speech audio output: to play synthesised speech aloud through the device.
• Personal Voice (iOS 17+): only if you have created a Personal Voice and choose to use it for AEIOU's speech.
• iCloud: only if you turn on AEIOU's iCloud sync. Uses your existing iCloud account.

Every permission above is optional and asked for only at the moment you switch on the matching feature; you can refuse or revoke any of them in iOS Settings and AEIOU keeps working. AEIOU does not request access to your photos, Bluetooth devices, or local network.

Apple privacy manifest

AEIOU ships with an Apple PrivacyInfo.xcprivacy manifest declaring exactly which Apple "required reason" APIs it touches and why. Today that manifest declares:

• NSPrivacyTracking: false. AEIOU does not track users across apps or websites.
• NSPrivacyTrackingDomains: empty. AEIOU does not contact any tracking domains.
• NSPrivacyCollectedDataTypes: empty. AEIOU collects no data types.
• NSPrivacyAccessedAPITypes: UserDefaults under reason CA92.1 (access info from same app, per Apple documentation), used for word/phrase learning history, blink calibration parameters, and the user's app settings.

Camera, microphone, speech recognition, location, calendar, reminders, contacts, motion and Health access are not "required reason" API categories under Apple's privacy manifest system; they are governed by the usage descriptions iOS shows you the first time each is used, and by the permission toggles in iOS Settings. All of the data they touch is processed on the device and not collected by Chardie.

Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have the right to ask whether we hold personal data about you, to ask us to correct it, to ask us to delete it, and to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled it.

Because Chardie does not collect personal data through AEIOU (including the Health and location information the optional features use, which stays on your device), there is nothing on Chardie's side to disclose, correct, or delete. Your data is on your device. To remove the on-device data, delete AEIOU from your device, or use the reset controls inside the app.

Changes to this policy

If we materially change how AEIOU handles data, we will update this page, change the "last updated" date at the top, and submit the updated policy to the App Store. Where appropriate we will also surface the change inside AEIOU itself the next time you open it.

Contact

Questions, concerns, or requests under UK GDPR: please email contact@chardie.co.uk. We aim to reply within five working days.

Data controller: Chardie · Manchester, United Kingdom · chardie.co.uk