A cloned voice is precious and sensitive. We’ve built LullaVoice so that a voice and its recordings stay private by default — never public, never exposed.
How your audio is protected
- Private at rest. Every voice sample and every story we generate is stored privately. There is no public link to your audio.
- Signed, expiring access. Audio is only ever served through short-lived, cryptographically-signed links, or through your authenticated session. The underlying file cannot be reached directly.
- Encrypted in transit. All traffic uses HTTPS/TLS.
- Consent-gated cloning. A voice can only be created with the speaker’s recorded consent. See our Voice Consent Policy.
Accounts & payments
- Sign-in works with secure magic links (passwordless) or, if you prefer, an email and password. Passwords are never stored directly — only a salted scrypt hash that can’t be reversed.
- Access tokens are signed and expiring. Recipient links grant access only to the one gift they belong to — nothing more.
- Payments are processed by Stripe; we never store card details.
Reporting a vulnerability
If you believe you’ve found a security issue, please email security@lullavoice.app. We appreciate responsible disclosure and will respond quickly.