Privacy Policy
This privacy policy explains how we process personal data when you visit voicedict.io, create an account, purchase a license, and use the VoiceDict app for macOS ("App").
1. Controller
Julian Blöchl – Sole Proprietor
Keferloherstraße 45
80809 Munich, Germany
Email: julian@bloechl.io
2. Website
2.1 Hosting (Vercel)
Our website is hosted by Vercel Inc., 650 California St, San Francisco, CA 94108, USA. When you visit the site, Vercel processes connection data that is technically required to deliver the pages (IP address, date and time of the request, browser and operating system information, referrer URL) in server log files. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in providing a secure and reliable website). Log data is deleted automatically after a short period. We have concluded a data processing agreement with Vercel; transfers to the USA are safeguarded by the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses.
2.2 Web analytics (Vercel Web Analytics)
We use Vercel Web Analytics (Vercel Inc., USA) to measure aggregated usage of our website (page views, referrers, country, device type). Vercel Web Analytics does not use cookies and does not track visitors across websites; visitors are counted using a short-lived, anonymized identifier that cannot be linked back to you. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding aggregate usage of our website). Because no cookies are set and no information is stored on your device, no consent banner is required (§ 25(2) TDDDG).
2.3 No tracking or advertising cookies
We do not use tracking pixels, advertising networks, or third-party fonts loaded from external servers. The website only uses technically necessary browser storage: your login session (managed by our authentication provider, see 3.1) and small first-party entries in localStorage/sessionStorage that remember your login state on this device. These are strictly functional (§ 25(2) TDDDG).
3. Account, Purchase, and License
3.1 Registration and authentication (Neon)
To start a trial or buy a license you create an account with your email address and a password. Authentication and our database are provided by Neon (Neon Inc., USA), with authentication handled through Neon Auth. Passwords are stored only in hashed form. We store your email address, its verification status, your account role, and timestamps. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Your account data is kept until you delete your account; backups are removed within 30 days thereafter.
3.2 Backend hosting (Railway)
Our application backend (accounts, trials, licenses) runs on infrastructure provided by Railway Corp., USA. Railway processes technical connection data of API requests on our behalf. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.3 Transactional emails (Resend)
Emails required to operate your account (email verification, sign-in links, password reset) are sent via Resend (Resend Inc., USA). Resend processes your email address and the message content for delivery. Legal basis: Art. 6(1)(b) GDPR. We do not send newsletters or marketing emails.
3.4 Payments (Stripe)
Purchases are processed by Stripe through Stripe Checkout (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland, and Stripe, Inc., USA). When you buy a license, Stripe processes the data required for the payment (email address, payment method details, transaction amount). Your full payment details (e.g. card number) are processed by Stripe only and never reach our servers; we receive a transaction reference, your email address, and the order details. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (statutory retention duties under German commercial and tax law, §§ 147 AO, 257 HGB — up to 10 years). Stripe's own privacy policy:stripe.com/privacy.
4. The VoiceDict App
4.1 Recording and speech recognition run on your device
VoiceDict converts speech to text using machine-learning models that run locally on your Mac. Your microphone audio and usage statistics (e.g. words dictated) stay on your device and are never transmitted to us or third parties. Transcripts also stay local unless you enable the optional OpenAI formatting described in section 4.4. We have no access to your audio, transcripts, or local history. You can delete the local history in the App at any time.
4.2 Trial and license activation
To enforce the seat limit (one seat per Mac) and prevent abuse of the free trial, the App contacts our licensing server when you activate and periodically to validate a trial or license. The following data is processed: your trial or license code, a device identifier derived from your Mac's hardware UUID (hashed — we cannot reverse it into your hardware serial), a device display name (e.g. "Julian's MacBook"), and activation timestamps. A purchased license keeps working offline; the trial requires periodic online validation. Legal basis: Art. 6(1)(b) GDPR (providing the licensed service) and Art. 6(1)(f) GDPR (preventing license fraud). This data is kept for as long as your account or the associated entitlement exists.
4.3 One-time speech-model download (Hugging Face)
On first launch, the App downloads the speech-recognition model from Hugging Face (Hugging Face, Inc., USA). During the download your IP address is transmitted to Hugging Face's servers, as with any internet download. No account data or dictation content is transmitted. After the download the speech model runs offline. Legal basis: Art. 6(1)(b) GDPR.
4.4 Optional transcript formatting (OpenAI)
You can optionally add your own OpenAI API key and enable Luna formatting. The key is stored in your Mac's Keychain. When this feature is enabled, the recognized transcript text and formatting instructions are sent directly from the App to the OpenAI API under your OpenAI account. Microphone audio, VoiceDict account data, and local usage history are not sent. The App asks the API not to store the generated response. OpenAI's processing, possible abuse-monitoring retention, and API charges remain governed by your OpenAI account settings and agreement. OpenAI states that API inputs and outputs are not used to train its models by default. Legal basis for the transfer initiated by you: Art. 6(1)(b) GDPR. You can stop future transfers at any time by disabling formatting or removing the API key.
4.5 Software updates and download delivery (GitHub)
The App download (DMG) and app updates are delivered via GitHub releases (GitHub, Inc., USA, a Microsoft company). The App periodically checks for updates against GitHub; this transmits your IP address and basic request metadata to GitHub. No account data or dictation content is transmitted. Legal basis: Art. 6(1)(f) GDPR (keeping the software secure and up to date).
4.6 No telemetry
The App contains no analytics, no crash reporting service, and no advertising SDKs.
5. Recipients and international transfers
We share personal data only with the processors and providers named in this policy: Vercel (website hosting), Railway (backend hosting), Neon (database and authentication), Resend (transactional email), Stripe (payments), GitHub (downloads and updates), and Hugging Face (model downloads). If you enable optional formatting, OpenAI receives transcript text directly under your own API account as described in section 4.4. Where these providers process data in the USA, transfers are safeguarded by the EU–US Data Privacy Framework (where the provider is certified) and/or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not sell personal data and do not share it for advertising.
6. Retention
| Data | Retention period |
|---|---|
| Account data (email, role) | Until account deletion, plus up to 30 days in backups |
| Trial and license activations | For the life of the account / entitlement |
| Payment and invoice records | Up to 10 years (statutory retention, §§ 147 AO, 257 HGB) |
| Server log files | Short-term, automatically rotated |
| Support emails | Deleted after the request is resolved, unless statutory duties require longer |
| Dictation audio and usage stats | Stored only locally on your Mac, under your control |
| Transcript text sent for optional formatting | Not stored by VoiceDict; OpenAI retention follows your API account, settings, and agreement |
7. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, emailjulian@bloechl.io.
You also have the right to lodge a complaint with a supervisory authority, in particular the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, poststelle@lda.bayern.de).
8. No automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
9. Changes to this policy
We will update this policy when we introduce new features or providers that affect the processing of personal data. The current version is always available on this page.