Back to homepage

Privacy Policy

Last updated: October 23, 2026

1. Data Controller

Kai Detmers
Nell-Breuning-Straße 26, 60596 Frankfurt am Main
Email: t3mr0i@gmail.com

2. Our Privacy Principle

Whisperflow is designed with privacy as a core principle. Speech recognition runs entirely on your Mac using Whisper.cpp. Audio is processed in memory and immediately discarded. No audio is ever transmitted to any server.

AI features are optional and disabled by default. When enabled, only transcribed text (not audio) is sent to Anthropic's API over encrypted connections.

3. What Data We Collect

On-Device Only (never transmitted)

  • Audio recordings — processed in memory, discarded after transcription
  • Transcribed text — inserted into your active application
  • Screen captures — used for AI screen actions, discarded after processing
  • App settings and preferences — stored locally in macOS UserDefaults

Cloud Services (only when you opt in)

  • Anthropic Claude API — Transcribed text and screen context sent for AI processing. Not stored by Anthropic per their API data policy.
  • Firebase Authentication — Email address and display name for account management.
  • Stripe — Payment information for subscription billing. We do not store your payment details.

Website

  • Standard server logs (IP address, browser type, pages visited) — retained for 30 days
  • Vercel Web Analytics measures visits to public website pages and visits to the download page. Download-page visits indicate download starts, not completed downloads or installations.
  • Analytics uses no cookies or persistent cross-day visitor identifier. We remove query parameters and fragments from page URLs and exclude account pages. We do not add account details, recordings or transcribed text to analytics.
  • Analytics is disabled when your browser sends Do Not Track or Global Privacy Control. Downloads continue to work when analytics is disabled or blocked.

4. Purpose of Data Processing

  • Providing voice-to-text transcription (on-device)
  • Enabling optional AI features (email replies, web search, screen actions)
  • Account management and subscription billing
  • Security and fraud prevention
  • Understanding public website usage and download starts

5. Legal Basis (GDPR)

Art. 6(1)(b) GDPR — Performance of contract: providing Whisperflow services and processing subscriptions.

Art. 6(1)(a) GDPR — Consent: optional AI features that transmit data to third-party APIs.

Art. 6(1)(f) GDPR — Legitimate interest: security measures, fraud prevention and aggregate measurement of public website usage and download starts. You can object to website analytics using your browser’s Do Not Track or Global Privacy Control setting.

6. Data Sharing

We share data only with these service providers, and only when you use the respective features:

Transfers to the US are covered by Standard Contractual Clauses (SCCs) where applicable. We never sell, rent, or share your data with third parties for marketing purposes.

7. Data Retention

  • Audio: Immediately discarded after transcription (never stored)
  • Screen captures: Immediately discarded after AI processing (never stored)
  • Account data: Retained until you delete your account
  • Payment records: Retained as required by tax law (up to 10 years)
  • Server logs: 30 days

8. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

  • Access — Request information about your stored data
  • Rectification — Correct inaccurate data
  • Erasure — Request deletion of your data
  • Restriction — Limit processing of your data
  • Portability — Receive your data in a machine-readable format
  • Objection — Object to processing based on legitimate interest
  • Withdraw consent — Revoke consent at any time (disable AI features in settings)

To exercise your rights, email t3mr0i@gmail.com with subject "Privacy Request". We respond within 72 hours.

9. Data Security

  • All API communication uses TLS 1.3 encryption
  • Authentication tokens are stored securely in macOS Keychain
  • The macOS app has no usage analytics. Website analytics is separate and described above.
  • The application makes zero network requests unless you enable AI features

10. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence. The competent authority in Germany is:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
bfdi.bund.de

11. Changes

We may update this privacy policy. Material changes will be communicated via email or in-app notification. The current version is always available at whisperflow.app/privacy.

Questions? Contact us at t3mr0i@gmail.com