This policy describes how the operator of Spellwind ("Spellwind", "we", "us") handles personal data when you use the Spellwind app for macOS (the "App"), the website at spellwind.ai (the "Site"), and related services (together, the "Service"). We are the data controller for the processing described here.
Privacy questions and requests: privacy@spellwind.ai.
In short
- The microphone is active only while you are dictating. When you are not dictating, nothing is heard.
- Dictation audio is processed in memory and is not stored — not by us and not by our providers.
- Your transcripts and dictation history stay on your Mac. We keep no copy.
- Nothing you dictate is used to train machine-learning models — ours or anyone else's.
- We do not sell personal information.
- What we do keep is limited: your account details, usage metering (minutes, not content), diagnostics, and Site analytics.
1. Information we collect
Account data. Email address, authentication credentials/tokens, plan and subscription status. An account is required to use the Service, including the free plan.
Usage metering. How many minutes of dictation you have used in the billing month — duration and counts only, never the content of what you said.
Dictation audio and text. Handled as described in Section 2. Not retained.
Diagnostics and app analytics. Crash reports and basic usage events from the App (device model, macOS version, App version, performance metrics, feature-usage events). These never include your dictation audio or its content.
Site analytics. On spellwind.ai we use PostHog to understand how the Site is used: pages viewed, referrer, browser and device type, and approximate location derived from your IP address. See our Cookie Policy for details and choices.
Payment data. Purchases are processed by Polar (polar.sh) as merchant of record. Polar collects and processes your payment details under its own privacy policy; we receive purchase status, plan, country, and a customer reference — never full card numbers.
Support. If you email us, we keep the correspondence.
2. Dictation audio and transcripts
This is the heart of the product, so here is exactly what happens:
- While you hold the dictation control, audio streams from your Mac to our servers over an encrypted connection (TLS).
- Our servers process the audio in memory and pass it to third-party AI speech and language providers to produce text. Audio is not written to disk, not logged, and not retained by us once processing completes.
- Our providers process audio under zero-data-retention and no-training terms: they may not store your audio or transcripts beyond transient processing and may not use them to train their models.
- The finished text is returned to your Mac and inserted where you are typing. Transcripts and dictation history are stored only on your device. If you delete them there, they are gone — we hold no copy.
We do not use your dictation audio or transcripts to train any models, and we contractually prohibit our providers from doing so.
3. Purposes and legal bases (GDPR/UK GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Service: accounts, transcription, inserting text, metering plan limits | Account data, usage metering, dictation audio/text (transient) | Performance of a contract |
| Billing and purchase management | Payment data (via Polar) | Performance of a contract; legal obligation |
| Keeping the Service secure and fixing problems | Diagnostics, account data | Legitimate interests |
| Understanding and improving the App and the Site | App analytics, Site analytics | Legitimate interests; consent where required (Site cookies/analytics in the EEA/UK) |
| Responding to support requests | Support correspondence | Legitimate interests; performance of a contract |
| Complying with law | As required | Legal obligation |
4. Sharing
We share personal data only with service providers acting on our behalf, and only what each needs:
- AI speech and language providers — transient processing of dictation audio to produce text, under zero-retention, no-training terms (Section 2).
- Cloud infrastructure providers — hosting for our servers and account systems.
- Polar (polar.sh) — merchant of record for purchases.
- PostHog — Site analytics.
- Email and support tooling — to run our mailbox and support.
We may also disclose data where required by law, or as part of a corporate transaction such as incorporation of the operating company or a merger or acquisition — in which case this policy continues to apply to the transferred data.
We do not sell personal information and do not share it for cross-context behavioral advertising.
5. International transfers
Our servers and providers may be located outside your country, including in the United States and the EEA. Where data protected by the GDPR or UK GDPR is transferred internationally, we rely on appropriate safeguards: adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified), Standard Contractual Clauses, and the UK Addendum or IDTA.
6. Retention
| Data | Retention |
|---|---|
| Dictation audio | Not retained — processed in memory only |
| Transcripts / history | On your device only; we hold no copy |
| Account data | While your account is active; deleted within 30 days of account deletion, except where law requires longer |
| Usage metering | Current and recent billing periods; aggregated or deleted after |
| Diagnostics and app analytics | Up to 12 months |
| Site analytics | Up to 12 months |
| Purchase records | As required by tax and accounting law (held by Polar; our copy kept for the same statutory periods) |
| Support correspondence | Up to 24 months after the last message |
7. Security
Audio and text travel over TLS; account data is encrypted at rest; access to production systems is limited to those who need it. The strongest protection is architectural: because audio is not stored and transcripts never leave your Mac, there is no server-side archive of your dictations to breach. No system is perfectly secure, and we cannot guarantee absolute security.
8. Your rights
Depending on where you live, you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time where processing is based on consent.
To exercise any of these, email privacy@spellwind.ai. We will verify your request and respond within one month (extendable as the law allows). You can also delete your account directly in the App or by contacting support.
If you are in the EEA or the UK, you may lodge a complaint with your data-protection authority (in the UK, the ICO).
9. California residents (CCPA/CPRA)
In the last 12 months we have collected these categories of personal information: identifiers (email, customer reference, IP address); commercial information (purchases and plan); internet or network activity (App diagnostics, Site analytics); audio information (dictation audio — processed transiently, not retained); and inferences limited to product analytics.
We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We use and disclose it only for the business purposes described above.
You have the right to know, access, correct, and delete your personal information, and the right not to be discriminated against for exercising these rights. We treat opt-out preference signals such as Global Privacy Control as an opt-out where they apply. Submit requests to privacy@spellwind.ai; authorized agents may submit requests on your behalf with proof of authorization.
10. Children
The Service is not directed to children under 13 (or under 16 where local law sets that age for consent to data processing), and we do not knowingly collect their data. If you believe a child has provided us personal data, contact privacy@spellwind.ai and we will delete it.
11. Changes to this policy
We will post updates here and revise the date above. For material changes we will give notice by email, in the App, or on the Site before they take effect.
12. Contact
Privacy requests: privacy@spellwind.ai General support: support@spellwind.ai