Privacy Policy

Introduction

Halim Öztürk ("we," "our," or "us") builds Dictation Pro with privacy as a first principle. This policy explains what we collect, how we use it, and the choices you have. By using Dictation Pro, you agree to the practices described here.

Information We Collect

We deliberately collect as little as possible:

• Audio recordings. Recorded with your microphone permission. They stay on your device and are saved to the app's sandbox so you can replay them. Transcription is performed by Apple's Speech framework — on your iPhone whenever an on-device model exists for your language; for a language without one, Apple may process the speech on its own servers under Apple's privacy policy. We never receive your audio.
• Transcripts and metadata. Titles, tags, folders, bookmarks, and timing data are stored locally with CoreData. We have no copy of your library.
• AI enhancement requests. When you tap a cloud feature (AI title, AI cleanup, AI summary, Ask AI), the transcript text — and, for Ask AI, the question you type — is sent to our AI Gateway (Vercel) and forwarded to OpenAI for processing. From version 1.1.2 nothing is sent until you tap Allow on the in-app AI data-sharing screen. Your audio is never uploaded. See the AI Processing section below.
• Anonymous analytics. Mixpanel events for feature usage and navigation — counts, lengths and durations only, never your transcript content. Each install is identified by a pseudonymous, per-install identifier, not by you.
• Crash and performance diagnostics (from version 1.1.2). Apple's MetricKit hands the app a daily summary of crashes, hangs, launch time, memory and disk use; the app sends a compact summary to Mixpanel — exception type, termination reason, counts and timings, app build and iOS version. No transcript text, no file names, no audio. The raw reports stay on your iPhone.
• Approximate location. Our analytics provider derives an approximate city/region/country from your IP address when an event is received. The app never asks for or reads your device location, and contains no location code at all.
• Subscription status. Managed by Apple and RevenueCat. We receive an anonymous subscriber/non-subscriber flag.

On-Device Processing

The following run locally on your iPhone:

• Speech recognition — Apple Speech framework, on-device whenever your language has an on-device model (see Audio recordings above).
• Translation — Apple Translation Framework on iOS 18+ (29 languages).
• Library, search, folders, tags, bookmarks — CoreData, fully local.
• Audio file playback & waveform — local AVAudioEngine.

AI Processing (Optional, Opt-In)

Dictation Pro includes optional AI features. They are off by default and require an explicit tap to invoke. From version 1.1.2, the first time you use one the app shows what is sent, to whom and why, and sends nothing unless you tap Allow; Not Now cancels the action. You can withdraw that permission at any time in Settings → AI Data Sharing.

• What is sent. Transcript text only — plus your typed question when you use Ask AI — to dictation-ai-gateway.vercel.app, a serverless endpoint we operate. The gateway forwards the request to OpenAI's API.
• What is never sent. Your audio. There is no code path in the app that uploads an audio file to us or to OpenAI.
• What we never send. Your library, your contacts, your device location, or any data not directly required for the requested AI operation.
• What the gateway stores. No audio or transcript content. We log only request metadata (timestamp, response time, status code, and short one-way hashes of identifiers and IP addresses) for abuse prevention; logs are retained for 30 days. To enforce fair-use limits it also keeps usage counters per install, per IP address and per anonymous subscriber ID (from one minute to about a month), a cached subscription check (10 minutes), and — from version 1.1.2 — a device-bound Apple App Attest public key that proves requests come from the genuine app (about 400 days).
• What OpenAI does. Per OpenAI's API terms, content sent to the API is not used to train their models. See OpenAI's API Data Usage Policy.
• Authentication. Requests carry a device-scoped identifier, the anonymous RevenueCat subscriber ID and, from version 1.1.2, an App Attest signature — never your name, email, or Apple ID. Nothing sent to the gateway is used for advertising.
• Fair use. Cloud usage has a generous daily limit. We never count usage for the same recording twice (cached by content hash).

How We Use Information

We use the limited information we collect to:

• Provide and maintain the transcription, translation, and AI features.
• Process subscription purchases via Apple and RevenueCat.
• Detect abuse and enforce rate limits on the AI Gateway.
• Improve app performance based on aggregated, anonymous analytics.
• Respond to support requests you send us.

Data Sharing

We do not sell or rent your personal information. We share strictly limited data with the following sub-processors:

• Apple — App Store distribution, in-app purchases, on-device frameworks.
• RevenueCat — Subscription state management.
• Mixpanel — Pseudonymous usage analytics and, from version 1.1.2, crash and performance summaries. It also derives an approximate city/region/country from the request IP address.
• Vercel — Hosting for the AI Gateway serverless functions, and storage (Upstash Redis) for its usage counters.
• OpenAI — Third-party AI processing of opt-in AI requests on transcript text (titles, cleanup, summaries, note templates, Ask AI), only after you allow it. It never receives audio.

What the App Store Privacy Label Says

Apple asks every app to declare the data it collects. This page and that label are written from the same measurement of the app's source code, and they agree. Our declaration lists five data types, all marked not linked to your identity and not used for tracking (from version 1.1.2 it adds two more, listed last):

• Coarse Location — Analytics. IP-derived by our analytics provider; the app has no location code.
• Identifiers → Device ID — App Functionality, Analytics. A pseudonymous per-install identifier for analytics, subscription state, and rate limiting on the AI Gateway.
• Purchases → Purchase History — App Functionality, Analytics.
• Usage Data → Product Interaction — Analytics.
• User Content → Other User Content — App Functionality. The transcript text and typed questions sent to OpenAI when you use an AI feature.
• Diagnostics → Crash Data — Analytics. From version 1.1.2.
• Diagnostics → Performance Data — Analytics. From version 1.1.2.

Audio Data is deliberately not on that list, and that is a fact about the code, not a wording choice: the app has no code path that uploads a recording to us or to any third party. We collect no name, e-mail or account; there is no login. There is no advertising SDK, no advertising identifier, and no App Tracking Transparency prompt, because there is nothing to track you with.

Data Security

• All data is encrypted in transit using TLS 1.2+.
• The AI Gateway holds no API keys in the iOS app — secrets live only in Vercel environment variables.
• Local data inherits the iPhone's hardware encryption.
• We follow industry best practices and review our security posture regularly.

Your Rights

Depending on your jurisdiction (GDPR, CCPA, and similar), you have the right to:

• Access the data we hold about you (it is essentially limited to subscription and anonymous analytics).
• Delete your data — uninstall the app to erase all local data; contact us to remove anonymous identifiers from analytics.
• Object to analytics processing — contact us at the address below and we will suppress the identifier associated with your install. The app does not currently offer an in-app analytics switch; we say so here rather than point you at a control that does not exist.
• Withdraw AI consent — from version 1.1.2, Settings → AI Data Sharing turns it off; the AI features then ask again before sending anything.
• Portability — export your transcripts as PDF, DOCX, or plain text from within the app.

Children's Privacy

Dictation Pro is not directed at children under 13 (16 in the EU). We do not knowingly collect personal information from children. If you believe a child has used the app, contact us and we will delete any associated data.

International Transfers

The AI Gateway and its sub-processors operate primarily in the United States. By using AI features you consent to the transfer and processing of the relevant content in those jurisdictions, with safeguards equivalent to those required by GDPR.

Changes to This Policy

We may update this Privacy Policy as the app evolves. Material changes will be announced in the app release notes and via the "Effective" date at the top of this page. Continued use after an update constitutes acceptance.

Contact Us

Questions, requests, or concerns about this policy? Email us at halimozturk@windowslive.com. We aim to respond within 7 business days.