Privacy policy

In short

• There is no account, no analytics, no tracking and no advertising, in the app or on this site.
• Recording and transcription happen on your Mac. Audio and transcripts are never sent anywhere.
• The app connects to the internet for two things only: downloading the speech model you choose from Hugging Face, and checking GitHub for updates. Those companies see your IP address. I don't.
• This website sets no cookies. It is served by Cloudflare, which handles your IP address to deliver the pages.
• I only get personal data if you send it to me, for example by email or in a GitHub issue.

Who is responsible

OpenVocally is made by Mateusz Romek, a private individual in Poland. For this policy and the GDPR, I am the controller of the personal data described here. You can reach me at privacy@openvocally.com.

The app

What stays on your Mac

The following is stored only on your Mac, in your user account. I cannot see it, and the app never uploads it.

• Recordings. Audio is kept only while it is being transcribed, then deleted. If a transcription fails, the recording is kept for 7 days so you can retry, then deleted.
• Transcripts. Your history holds the text, the language, the time and length of each dictation, and the name of the app you dictated into. You choose how long it is kept (forever, or 7, 30 or 90 days), and you can delete all of it in Settings.
• Settings and speech models. Your preferences and the models you downloaded.
• Your clipboard. To paste a transcript, the app puts it on the clipboard, presses ⌘V, then puts back what you had before. The transcript is marked as local to this Mac, so Universal Clipboard does not send it to your other devices.

The app has no analytics, no automatic crash reporting and no telemetry. Nothing about how you use it is sent to me.

Speech model downloads

When you pick a speech model, the app downloads it from Hugging Face. Like any website, Hugging Face receives your IP address and the standard request details macOS adds, such as the app's name and version. The app sends nothing else: no account, no audio, no text. After the download, the model works offline.

Update checks

Copies downloaded from the official releases check for updates about once a day. The app fetches a small update list from GitHub and, when a new version exists, downloads it from GitHub Releases. GitHub receives your IP address and a User-Agent like OpenVocally/1.2 Sparkle/2.10.0, which names the app version and the version of Sparkle, the update library. No system profile or other data is attached.

By default, updates also install on their own. You can turn off automatic checks and automatic installs in Settings, and check by hand from the menu instead. Copies you build yourself from the source code have no update checker and never contact GitHub.

Why and on what legal basis. Both connections exist so the app can do what you installed it for: get the model you picked and stay secure and up to date. To the extent I am responsible for these connections, the legal basis is my legitimate interest in delivering a working, secure app (GDPR Art. 6(1)(f)). You can object at any time by turning off update checks, and you decide when to download a model. GitHub and Hugging Face decide what they do with the request data under their own privacy policies, linked below. I receive none of it.

Diagnostics file

If something goes wrong, you can export a diagnostics file in Settings, under Support. The app creates it on your Mac and never sends it. It reaches me only if you choose to send it. It contains:

• the app version, your macOS version and your Mac model (for example, "Mac14,2");
• your OpenVocally settings, the installed models and the state of the microphone and Accessibility permissions;
• the type of each audio device (built-in, USB or Bluetooth), but not its name;
• the app's own log messages from the last 3 days, with private values removed and your user name and home folder replaced;
• the most recent OpenVocally crash report from the last 30 days, if there is one, with device identifiers removed.

It contains no audio and no transcript text. You can open it in any text editor and read it before you share it. If you attach it to a GitHub issue, it becomes public.

This website

openvocally.com is a static site served by Cloudflare. To deliver a page, Cloudflare's servers handle your IP address and the usual request details, such as your browser and the address of the page. Cloudflare processes this on my behalf, as my processor. I have not turned on request logging or visitor analytics, so I don't receive or keep a record of your visit.

Legal basis. My legitimate interest in running a site that works and stays secure (GDPR Art. 6(1)(f)).

Cookies. The site sets no cookies and uses no tracking, ads or third-party scripts. Fonts are served from this site. If you use the light/dark switch, your browser remembers your choice in its local storage under the key theme. It is saved only when you press the switch, never leaves your device, and you can clear it in your browser settings.

When you contact me

If you email me or open an issue on GitHub, I receive what you send: your email address or GitHub user name, your message, and any file you attach. I use it only to answer you and fix the problem. The legal basis is my legitimate interest in answering questions and supporting the app (GDPR Art. 6(1)(f)). Sending me anything is optional. GitHub issues are public and are also governed by GitHub's privacy policy, so please don't post anything there that you want to keep private. Email me instead.

Who else receives data

I don't sell, rent or share personal data. These companies are involved:

You can check a company's certification on the official Data Privacy Framework list. I may also share data if the law requires it, for example on a valid request from a court or an authority.

How long data is kept

• Data on your Mac: as long as you keep it. Transcripts follow the retention you set in Settings. Moving the app to the Trash does not delete its data; remove ~/Library/Application Support/com.openvocally.app for that.
• Website requests: I keep nothing. Cloudflare keeps its own technical data under its policy.
• Emails and issues: as long as needed to handle your request. I delete emails once the matter is closed and no longer needed, unless I must keep them to meet a legal obligation or defend a legal claim. Public GitHub issues stay until you or I delete them.

Your rights

Under the GDPR, you can ask me for access to your personal data, and for its correction, deletion, restriction or transfer to you or someone else (portability). You can also object to processing based on my legitimate interest. Email me at privacy@openvocally.com. I will answer within one month. In practice I hold data about you only if you contacted me, because the app sends me nothing.

You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland,uodo.gov.pl, or to the authority in the EU country where you live or work.

Automated decisions

There is no profiling and no automated decision-making. The app and this site work fully without you giving me any personal data.

Children

OpenVocally is a general-purpose tool and not aimed at children. Because neither the app nor the site collects personal data for me, I don't knowingly hold data about children. If you believe a child has sent me personal data, email me and I will delete it.

Changes

If the app or this site changes how it handles data, I will update this page before the change ships and change the date at the top.