Privacy Policy

Last updated: November 9, 2026

This privacy policy explains how the SpeechDone app for iPhone, iPad, Mac and Apple Watch, the SpeechDone keyboard and the speechdone.com website (“we”, “us”) process personal data.

1. Controller

via now UG (haftungsbeschränkt), address see Imprint. Email: [email protected]

2. Where your speech is processed: in the EU or on your device

Speech recognition and text processing through our server run exclusively in the European Union, with no fallback to the USA. In the settings you choose whether your dictations are processed on your device or through our server. For every result, the app shows which route was used.

When recognition runs through our server, only Mistral AI (Paris, France) hears your recording, on EU servers (endpoint api.eu.mistral.ai): Voxtral Realtime provides the text you see while you speak; Voxtral Batch recognizes the recording again, section by section, and serves as the fallback. No other provider recognizes speech. Mistral receives the recording only for recognition. This also applies to meetings; recordings with the voices of everyone involved are sent to Mistral.

If recognition fails, SpeechDone does not fall back to another provider outside the EU: the app keeps the recording and tries again later.

Voice notes from the Apple Watch are always processed through our server, so in the EU, even if “On this device” is selected on the iPhone.

Training of the providers’ own models and retention by the providers:

• Mistral AI: Use for training is switched off in our Mistral account. To detect abuse, Mistral keeps requests under its terms for at most 30 days and then deletes them.

3. What data we process, for what purpose, and for how long

Recordings

• Your voice recording is captured in the SpeechDone app, even if you dictate through the keyboard.
• On our server: only in working memory during recognition, then discarded. During dictation we do not store recordings; for meetings the recording is kept on the server during processing (see Meetings).
• On your device: the app keeps each recording in its protected storage area so that an interrupted upload can be retried and so that you can play it back in your history, and deletes it after 30 days. The recording stays on the device where it was made; it is not synced through your iCloud. If you delete an entry in the history, the app also deletes its recording.
• Purpose: performance of the usage contract (Art. 6(1)(b) GDPR).

Meetings (meeting transcripts, only with an account)

• You start a meeting only after confirming that everyone involved knows and agrees. You are responsible for informing the others and obtaining their consent; the app gives you a notice for this. The app stores the time of your confirmation with the meeting on your device.
• On your device: The recording stays in the app (not in iCloud, not in backups) until the transcript is saved, and for 30 days afterwards. A part that has not yet been processed because of your budget stays until 30 days after the start of the next billing period, or until 30 days after the trial result. On Apple Watch, the recording stays only until your iPhone has taken it over.
• On our server: The recording is stored as a file on our server until processing finishes or fails, for at most 6 hours, and is then deleted. We keep the result (transcript, summary, tasks) encrypted until your app has collected it, for at most 1 hour. A meeting you revoke will not be processed any further.
• At Mistral AI (EU and EEA): Recognition, speaker separation and summarisation. Mistral keeps the input for up to 30 days for abuse monitoring and does not use it for training.
• Billing: For each meeting we keep a record without content (identifier, duration, timestamps, status) for 40 days, or until you delete your account for the free trial. We keep identifiers of revoked meetings until account deletion so that they can never be processed again. Both are included in your data export; the content is not, because we no longer have it after at most one hour.
• Speakers: Speaker separation assigns anonymous labels (“Speaker 1”) for each meeting. You enter names yourself, only on your device. We do not create voice profiles or analyse mood, performance or talk time.
• Transcript and summary are stored on your device and, depending on your history setting, in your iCloud. We have no access to them. If you delete a meeting, a deletion marker without content stays in your iCloud (the meeting’s ID, your account ID, its start and the time of deletion), so that your other devices also delete the meeting and its recording, even if they only come online later. It disappears with “Delete everything” and with your account. “Delete automatically” leaves it in place, because that setting only applies to the device you set it on.
• Purpose and legal basis for our processing: performance of the usage contract (Art. 6(1)(b) GDPR). You are the controller for the data of other participants (consent under Art. 6(1)(a) or legitimate interest under (f)); we process it on your behalf. If a conversation contains special categories of data (health, legal matters, trade union membership), you need explicit consent (Art. 9(2)(a)).

Texts

• Recognized text and the result are returned to you. So that an interrupted connection does not lead to duplicate processing, we keep the result in a cache for 24 hours and then delete it automatically.
• History: by default, the app stores your dictations in your own iCloud (Apple) so that they are the same on your devices. You can choose “only on this device” or “no history”. We have no access to your iCloud. An entry also records which words the matching against your dictionary adjusted and what was heard; this information is stored in the same place as the entry and deleted with it. Under “Delete automatically” on your iPhone you choose whether the app deletes the history after 30 days, 90 days or 1 year (default: never). “Delete everything” removes history and recordings on every device on your iCloud and on your Apple Watch. With an account, it also removes the items in your inbox and the results in the 24-hour cache on our server.
• Purpose: contract (Art. 6(1)(b) GDPR).

Style profile (only when signed in with Apple)

• We keep your last 100 revised texts for up to 30 days each and derive a style profile from them so that results sound like you. The analysis runs through Mistral AI on EU servers, like rewriting.
• The feature is off until you turn it on in the settings. You can turn it off again at any time and delete the profile together with the texts; both are included in the data export.
• Legal basis: your consent by turning it on (Art. 6(1)(a) GDPR), which you can withdraw at any time with the same switch.

Report answer (“Ask” mode)

• When you report an AI answer in “Ask” mode (in the keyboard or in the app’s history), you send the question and the answer to our server in Germany. The report is kept there for at most 30 days and then expires on its own. It goes to no third party; only we read it, to review the reported answer.
• The report is deleted together with your account and is included in the data export.
• Legal basis: legitimate interest in reviewing reported AI answers (Art. 6(1)(f) GDPR).

Dictionary and text snippets (when signed in)

• Stored on our server in Germany so that iPhone, iPad and Mac use the same ones. For each term we store up to three heard forms (“sounds like”), so that a word heard that way becomes the term. For deleted entries we keep only the word as a deletion marker for up to 90 days, so that the deletion reaches all devices.
• The terms are passed on as a hint to recognition and rewriting.
• So that the keyboard can recognize corrections and suggest the word for your dictionary, it keeps the inserted text of the last 5 fields (up to 300 words each), on the device only, and for “Speak” also the original before tidying up. It uses both for at most 30 minutes; after that the keyboard or the app removes them at the next cleanup. “Delete everything” includes them. Under Settings › Your text › Learn from corrections you can turn this off for this device; the keyboard then keeps nothing after inserting.
• Without signing in, both lists stay on the device.

Account (optional)

• Sign in with Apple or by email link. We store: email address, name (if Apple provides it), the Apple identifier or email address as the sign-in identifier, your settings (region, style profile on/off) and your plan. Until the account is deleted.
• Purpose: contract (Art. 6(1)(b) GDPR).

Devices

• A random device identifier assigned by Apple, device name, platform, app version, time of last use and, if you allow notifications, a push token.
• Without an account: only the device identifier as an access key, deleted 90 days after last use. With an account: until you remove the device or delete the account.
• Purpose: sign-in, protection against abuse, display of your devices (Art. 6(1)(b) and (f) GDPR).

Inbox (memos from the Apple Watch, “Send to Mac”)

• Text and originating device are kept on our server until your devices have picked them up and are deleted automatically after 7 days. The notification to your device contains no text.

Subscription

• Purchases run through Apple. We receive signed information from Apple (transaction identifier, product, expiry date) and verify the signature on our server. We never see payment data. Until the account is deleted.

Emails

• We send sign-in links, new-device notices, data exports and deletion confirmations through Resend. We keep the content only until it is sent, encrypted. After that, a log without content (type of email, time, delivery status) remains for 30 days.

Waitlist (website, until SpeechDone is in the App Store)

• If you join the waitlist on speechdone.com, we store your email address, the language, the page on which you signed up, and the times of sign-up, confirmation email, confirmation and launch email, plus, as proof of your confirmation, the browser identifier (user agent) your browser sends with it. No account, no name, no IP address.
• You first receive an email with a confirmation link (double opt-in). Only after you confirm do we write to you, and exactly once: when SpeechDone is in the App Store. After that we delete your address. There are no further emails, no advertising and no disclosure to others.
• Retention periods: we delete unconfirmed entries after 7 days. After the launch email, we delete the entry as soon as it has been delivered or has finally failed to be delivered. Every entry is deleted after 12 months at the latest.
• Unsubscribing: at any time through the link in every email. The entry is deleted immediately, and any emails to you that have not yet been sent are cancelled.
• Sending runs through Resend (section 4), as with account emails: content encrypted until it is sent, then a log without content for 30 days.
• Protection against abuse: so that nobody signs up other people’s addresses in bulk, we count sign-ups per IP address and per email address. For this, an irreversible hash of the IP address is held in our cache for at most 1 hour and a hash of the email address for at most 24 hours. We do not store the IP address itself.
• On the confirmation and unsubscribe pages we set a technically necessary cookie that protects against forged requests (1 hour).
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing; for protection against abuse and as proof of your consent, our legitimate interest (Art. 6(1)(f) GDPR).

Errors, crashes, stability

• Crash and performance reports (App Store and TestFlight versions of the iPhone app only) through Sentry, data region Frankfurt. Name, email and IP address are removed before sending, as are email addresses, keys and phone numbers in message texts.
• App error logs sent to our server: technical messages with a random app identifier, app and system version. Dictation content is not included. Deleted after 30 days. The same identifier appears in your account's device list.
• Flow events (e.g. “recording started”, “result delivered”, error level) without content, with a shortened, irreversible checksum of this random identifier, deleted after 90 days.
• Purpose: legitimate interest in a stable app (Art. 6(1)(f) GDPR).
• Counting after inserting: The keyboard counts how many inserted words you change, delete or add by hand afterwards, and sends these numbers, without any words, with the same random app identifier to our server in Germany. Deleted after 30 days. The device adds up the same numbers per week so that the app can show them to you; they stay on the device for five weeks. Purpose: measuring whether the clean-up and “Learn from corrections” save you work. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). If “Learn from corrections” is off, the keyboard counts and sends nothing, and the weekly sums are deleted.

Word counter

• For the plan limit we count words per week. The counter contains no texts.

4. Server, network and service providers

Our server is hosted by Hetzner in Germany. Cloudflare sits in front of the server as a network and protection service: the connection between the app and the server runs through Cloudflare, where it is technically decrypted and encrypted again.

We have concluded contracts under Art. 28 GDPR with all processors.

In addition, the app uses services from Apple within your own relationship with Apple: Sign in with Apple, iCloud for history, notifications (APNs) and purchases (App Store).

For providers based in the USA, the transfer relies on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified. These are Cloudflare, Resend and Sentry. Resend and Sentry process on servers in the EU; the Data Privacy Framework covers possible access from the USA.

5. Cookies and tracking

The app contains no advertising, no tracking and no analytics services from advertising networks. We do not create usage profiles.

The website sets no cookies, with two exceptions: in the account area for the data export, three technically necessary cookies (sign-in for 30 minutes, protection against forged requests, Sign in with Apple), and on the pages for confirming and unsubscribing from the waitlist, the cookie that protects against forged requests. We count clicks on the App Store link per day and language, without any link to a person.

For protection against abuse, our server briefly processes your IP address to limit the rate of requests.

6. Data export and deletion

• Export: In the app under Account. You receive an email with a link to a ZIP file containing all account data (account, devices, subscription, usage, style profile, reported answers, dictionary with the heard forms, text snippets, inbox, log of account emails from the last 30 days). The file remains available for 7 days. For meetings, the export contains billing records and blocked identifiers, not the content. A result ready for collection at the time of export is in the app and is deleted from the server after one hour.
• Deletion: In the app under Account. Deletion takes place immediately and covers all account data on our server, including the 24-hour cache. Error logs and counts expire after 30 days, flow events after 90 days. You then receive a confirmation by email. What is in your iCloud and on your devices, you delete there.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object (Art. 21 GDPR). You can withdraw consent at any time. You can lodge a complaint with a data protection supervisory authority.

8. Contact

Questions about data protection: [email protected]