Privacy Policy
This Privacy Policy explains what personal data Jun Whisper collects, how it is used, and what rights you have under the EU General Data Protection Regulation (GDPR) and similar laws.
1. Who we are
Controller:
Dennis Hellwig (sole proprietor)
Potsdamer Straße 21
14548 Schwielowsee, Germany
Email: hello@junwhisper.com
We are based in Germany. The competent supervisory authority for data protection complaints is the data protection authority of the federal state where the controller is established.
2. The product
Jun Whisper is a macOS dictation application. When you press a hotkey and speak, the app captures audio from your microphone, sends it to our cloud backend for speech-to-text and language-model post-processing, and inserts the resulting text into the application you are using.
The app captures audio only during an active dictation — while you hold the hotkey, or until you stop a continuous session you started. No audio is recorded at any other time.
Your audio is sent to our speech-to-text provider to be transcribed. It is processed and discarded — neither we nor the provider keep it as part of normal operation. See section 6 for which provider, and section 7 for the exceptions where audio is retained temporarily.
3. What personal data we process
| Data | Source | Why we have it |
|---|---|---|
| Email address, name, profile photo URL | Google / Apple sign-in | Authentication, account identification |
| Audio recordings (PCM) | Your microphone | To produce a transcript via speech-to-text |
| Transcripts (raw text, polished text) | Generated from your audio | The product output. Kept in a database on your Mac; stored on our servers only if you switch on server-side storage |
| Application context (active window title, the host of the active browser tab (host only — never the path or query), in a terminal whether an AI coding tool (such as Codex or Claude Code) is running in the active tab (only yes or no — never which tool, the command, its arguments, folder or process details), application bundle ID, the recipient's name and the subject when you compose an email in Mail or in Gmail in your browser (never the recipient's email address: if only the address is shown and it clearly reads as a first and last name, such as sarah.quen@…, that name (“Sarah Quen”) is worked out from it on your Mac and only the name is sent; otherwise no recipient is sent), when you reply in Gmail in your browser the newest messages of that conversation (at most three, with each sender's name, never an address, and nothing from any other conversation), and the text before and after your cursor in the field you are dictating into — never from password fields) | Your operating system | To improve transcript accuracy by giving the language model context (e.g., a different tone for code editors vs. emails, and the names and terms in the text around your cursor) — used in the moment to produce your text, then discarded; stored only if you switch on server-side storage. Context Awareness is on by default. When you switch it off in the app's settings, only the application bundle ID is sent with your dictation: no window title, no browser tab host, no terminal yes/no, no input-field details, no text around your cursor, no conversation text and no email recipient or subject, and none of it is read from the screen in the first place |
| Custom dictionary words | You add them in app settings | Improves speech-to-text accuracy for your vocabulary — sent to our language-model provider with your dictations. A word you add to a workspace's shared dictionary is sent to our speech-to-text and language-model providers on every member's dictation, not only on your own |
| Workspace membership (which workspace, your role, when you joined, and whether you hold a seat: since when, and which owner or admin gave it to you) | Created when you create a workspace or accept an invitation to one; the seat when an owner or admin gives you one or buys one for you | To run the workspace you joined — it is what lets its members share a dictionary, and what makes your name, your role and your dictation volume visible to the other members. Whether you hold a seat decides whether the workspace gives you Pro; the workspace's owners and admins see it, together with whether you pay for your own Pro (section 4) |
| Invitations you send or receive (the invited email address, the workspace, the role, the status) | You invite someone, or someone invites you | To deliver and manage the invitation. An invited address may belong to someone who has no account with us. For an invite link, which member created or last reset the link; it is never shown to other members and is cleared when that member's account is deleted, and it is used to credit that member with the invite-gated 14-day trial when someone joins through the link |
| Terms added to your workspace's shared dictionary by other members | Other members of your workspace add them | They improve speech-to-text accuracy for everyone in the workspace, including you — which also means they reach our speech-to-text and language-model providers on your dictation |
| Style profiles | You configure them | Lets you switch between dictation styles |
| Billing data (Stripe customer ID, plan, word usage counters, the time an invite trial was granted, and — while a renewal payment is open — when it first failed, cleared once it is paid or the subscription ends) | Generated from your usage | Subscription management and metered billing |
| Workspace billing data (the workspace's own Stripe customer ID, subscription ID, the price bought, the number of seats bought, the workspace's plan, when a renewal payment first failed — kept only while that payment is open, and cleared once it is paid or the subscription ends — and the billing contact: the owner or admin who bought the subscription, by account and email address; after a change of billing contact, until the new one adds their own card, also who added the card still on file, when the role last passed, and that card's brand and last four digits, which we use only to tell that person and let them remove it) | Created when an owner or admin of a workspace buys a workspace subscription, and kept current by Stripe's subscription updates | To bill the workspace and give Pro to the members who hold a seat. The billing contact's email address is the only address our withdrawal and cancellation notices for the workspace's contract go to; when the billing contact leaves the workspace or deletes their account, it moves to the workspace's longest-standing owner — except while a subscription is ending because a member's ownership claim moved the role: then the previous owner stays the billing contact until it ends, and deleting their account ends it at once. Kept while the workspace exists; the subscription ID and seat count are cleared when the subscription ends |
| Seat history (who held a paid seat and when: the member's account ID, when a seat was given or released and how — given at purchase or by an owner or admin; released when taken back, on removal, on leaving, on account deletion or when the subscription ended — and, for a seat given or taken back, which owner or admin did it; each change in the number of seats bought, with who made it in the app and its invoice), plus the country evidence recorded when the subscription was bought | Written while a workspace is on a paid plan, when a seat is given or released and when the number of seats changes | To show which seats were billed in which period, and to decide a withdrawal declaration for the workspace's contract. It is a billing record, kept for 10 years under § 147 AO (section 7) — also after you leave the workspace, after the workspace is deleted and after you delete your account, which is the Art. 17(3)(b) GDPR exception described in section 8 |
| Seat requests (that you asked your workspace for a paid seat or a team plan, when, and whether an owner or admin gave you a seat or declined, and who) | Created when you ask for a seat or a team plan in the app | To pass your request to the people who decide it. The workspace’s owners and admins see it with your name in the app, and each of them gets one email naming you and the workspace; so does the billing contact’s address when it is not one of theirs. Other members do not see it. Only your latest request is kept |
| Team purchase selection (who started the purchase, the members chosen for a seat, the number of seats, the billing period and the Stripe checkout session) | Created when an owner or admin starts a purchase for the team | To give the chosen members their seats once the payment has gone through. Deleted within 30 days after the checkout is completed, expires or is replaced by a newer one (section 7) |
| Pause of your own Pro (that we paused your own subscription because you got a seat, when, the amount refunded and the credit notes it was refunded with; once the seat ends, the offer to resume it — price, billing period, deadline, reminder — and your answer) | Created when you get a seat while you pay for your own Pro | To pause your subscription and refund its unused time, to offer you the resume, and to carry out your answer (Terms, section 6). Kept while your account exists (section 7) |
| VAT details (a VAT identification number, and the name and billing address you enter on Stripe's checkout page or in Stripe's customer portal) | You enter them when you buy Pro for yourself or for a workspace | To charge VAT correctly: Stripe calculates it from the billing address, and a valid VAT identification number from another EU member state means reverse charge. A number that fails Stripe's check is removed. Stripe holds these details for us, and they appear on the invoices, which are billing records kept for 10 years under § 147 AO (section 7). For a workspace bought at the former business price before 2 October 2026, we also keep the buyer's declaration that they bought as a business: its wording and time |
| Session tokens | Generated at sign-in | Authenticates your client to our backend |
| Product analytics events (feature usage: counts, durations, enums, booleans; no content, no email) | Generated as you use the app | To understand which features are used and prioritize improvements |
We do not train AI models on your dictations. We do not process audio content or transcripts for advertising. We do not sell or rent personal data.
4. Legal bases (GDPR Art. 6)
- Performance of a contract (Art. 6(1)(b)) — to deliver the dictation service you signed up for, including audio transcription, text refinement, and billing.
- Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and improve quality (e.g., aggregated usage analytics, debugging telemetry, product analytics via PostHog — see section 6).
- Consent (Art. 6(1)(a)) — for any processing that is not strictly necessary for the service. You can withdraw consent at any time.
Workspaces — Art. 6(1)(b), and deliberately not consent. If you join a workspace, the processing that makes the workspace work rests on Art. 6(1)(b): performance of the workspace you joined. That covers showing the other members your name, your role and how many words and sessions you dictate, showing your email address, and whether you are on Free, pay for your own Pro or hold a seat the workspace pays for, to the workspace's admins and owner, and adding your name to the workspace's shared dictionary.
We state the basis as contract rather than consent on purpose, because the honest version of a consent basis is one we could not honour: consent must be withdrawable at any time, and there is no version of a shared workspace in which we could keep you a member while switching off what membership means. What we can do instead is keep the processing to what the workspace actually needs — section 6 sets out exactly what other members see and what they never see — and give you two real exits. You can delete the dictionary entry holding your name at any time, and you can leave the workspace, which ends this processing.
5. Where your data is stored
Your data is hosted in the European Union. Specific destinations:
- Backend application — Scalingo, osc-fr1 (Paris area, France)
- Former backend host — Railway, europe-west4 (Amsterdam, Netherlands), on standby until its deletion; no longer in use
- PostgreSQL database (account, settings) — Scaleway, nl-ams (Amsterdam, Netherlands). Transcripts and audio are not stored by default. When you switch on server-side storage, transcripts go to that same Scaleway database and crash-recovery audio to Scaleway Object Storage, also nl-ams (Amsterdam, Netherlands).
- Database backups — Hetzner, Germany
- Dictation history — a local database on your Mac, not on our servers
6. Sub-processors
We rely on the following sub-processors. Each has a Data Processing Agreement (or equivalent contractual terms) with us:
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Scalingo SAS | Application hosting | France (osc-fr1, Paris area) | Within EU |
| Railway Corp. | Former application hosting, on standby until its deletion; no longer in use | EU (europe-west4) | Standard Contractual Clauses |
| Cloudflare, Inc. | Bot protection on the withdrawal form (Turnstile) | Global edge / EU | Standard Contractual Clauses |
| OVH SAS | Speech-to-text inference | France (Gravelines) | Within EU |
| Anthropic PBC | Quality evaluation and alert reconciliation, only for dictations from our own accounts, never for other users' dictations | USA | Standard Contractual Clauses |
| IONOS Cloud GmbH | Language-model inference: formatting of dictated text | Germany | Within EU |
| Google LLC | Sign-in (OAuth) | USA | Standard Contractual Clauses |
| Apple Inc. | Sign-in | USA | Standard Contractual Clauses |
| Stripe, Inc. / Stripe Payments Europe Ltd. | Subscription billing | USA / Ireland | Standard Contractual Clauses (US) |
| Google Ireland Limited / Google LLC | Email mailbox for hello@junwhisper.com, which receives a copy of the emails for withdrawal and cancellation declarations (Google Workspace) | Ireland / USA | EU-U.S. Data Privacy Framework + SCCs |
| Scaleway S.A.S. | PostgreSQL database (Managed Database for PostgreSQL); transactional email delivery: sign-up verification, existing-account notices, workspace invitations, welcome emails, seat requests, the notice that a seat paused or ended your own Pro, and the offer to resume your own Pro after a seat (with its reminder and lapse notice), and the receipt, confirmation and outcome emails for withdrawal and cancellation declarations (Transactional Email); Object Storage: crash-recovery audio and consented feedback recordings (nl-ams, #3444); Generative APIs: speech-to-text and language-model inference as the backup provider (fr-par, Paris) | EU (nl-ams, Amsterdam; fr-par, Paris) | Within EU |
| Hetzner Online GmbH | Storage of database backups | Germany (Nuremberg) | Within EU |
| Functional Software, Inc. (Sentry) | Error monitoring and crash reports | EU (European Union data region) | EU-U.S. Data Privacy Framework + SCCs |
| PostHog, Inc. | Product analytics and feature-flag evaluation | EU (eu-central-1, Frankfurt) | EU-U.S. Data Privacy Framework + SCCs |
When data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and additional safeguards as required by the Schrems II ruling.
Product analytics (PostHog). We use PostHog for product analytics and feature-flag evaluation, to understand which features are used and to safely roll out new features. Analytics events are sent from our backend, keyed to your opaque internal account ID — never your email address or name. IP address capture is disabled. We never send dictation content, transcripts, or any personal data beyond feature-usage signals (counts, durations, categories) to PostHog. These events are retained on PostHog's platform for the period stated in section 7. The legal basis is legitimate interests (Art. 6(1)(f)) — see section 4. You can opt out of product analytics at any time from your account settings; see section 8 for your right to object.
Feedback recordings (consented). If you submit feedback and choose to attach a recording, it is processed automatically only — no human listens to it. It is deleted no later than 30 days after your most recent submission for that dictation — see section 7.
What your workspace's members see. The other members of your workspace are not sub-processors, and that distinction is the reason they are described here rather than in the table above. A sub-processor is a company processing data on our instructions under a contract with us; the people in your workspace are recipients in their own right, and no contract of ours governs what they do with what they see.
Wherever a workspace is offered to you — in the app before you create one, and on the page where you accept an invitation — we show a one-sentence summary of what the other members see, followed by a link to our Teams FAQ (junwhisper.com/teams-faq), which explains the rest. When you join a workspace, your name is added to its shared dictionary so teammates' dictation gets it right; you can remove it at any time. The word and session counts other members see start on the day you joined and cover completed calendar weeks only, never the current day.
What the other members see is a limit on what the product can do, not only a description of what it currently does: Everyone in a workspace sees every other member's name, role, and how many words and sessions they dictate; a workspace's admins and owner also see every member's email address and whether each member is on Free, pays for their own Pro or holds a seat the workspace pays for. Nobody in a workspace can see another member's dictated text, app names or audio, and no workspace setting can change what is stored about a member. An admin cannot switch server-side storage on for you, and cannot change where your dictation is sent.
One thing reaches the owners and admins only when you choose to send it: a request for a seat or a team plan. If you ask, they see the request with your name in the app, and each of them — and the workspace’s billing contact address — gets one email about it. Nothing else is sent about that request, and other members never see it.
If a member of your workspace asks to take over as its owner, we email the owner and the admins about it, naming that member by name and email address, so the owner can object before anything changes; the legal basis is Art. 6(1)(f) GDPR, our legitimate interest being that a workspace whose only owner can no longer be reached does not stay stuck, and that the owner is told first.
The shared dictionary has one consequence that is easy to miss, so we state it on its own: Terms in a workspace's shared dictionary — including the name added for you when you joined — are sent to our speech-to-text and language-model providers on every member's dictation, not only on your own. Deleting the entry stops that.
7. How long we keep data
| Data | Retention |
|---|---|
| Account (email, name) | Until you delete your account |
| Workspace membership (workspace, role, join date, seat) | Kept for as long as you are a member. Deleted when you leave the workspace, when an admin or the owner removes you, or when the workspace is deleted. |
| Seat request (your latest request for a seat or a team plan, and its answer) | Kept for as long as you are a member; a new request replaces it. Deleted when you leave the workspace, when an admin or the owner removes you, or when the workspace is deleted. |
| Team purchase selection (members chosen for a seat) | Deleted within 30 days after the checkout is completed, expires or is replaced by a newer one, or when the workspace is deleted. |
| Pause of your own Pro (pause, refund, resume offer and your answer) | Kept while your account exists, and deleted with it. The invoices and credit notes themselves are billing records (10 years, § 147 AO). |
| Invitations (invited email address, workspace, role, status) | Deleted 30 days after the invitation expires or is last acted on — accepted, declined or cancelled — whichever is later. |
| Transcripts | Not stored on our servers by default. Your dictation history is kept in a database on your Mac. If you switch on "Allow storing my dictation content on the server", transcripts are stored on our servers and deleted after 30 days. |
| Audio recordings | Dictation audio is sent to our speech-to-text provider to be transcribed, then discarded — we do not store it. If a dictation fails and you have switched on server-side storage, the recording is kept for 30 days so you can recover it in the app, then deleted. If local audio saving is on, a copy stays on your Mac. |
| Dictation history on your Mac | Kept on your device, not on our servers. Unless you are on Pro, entries older than 30 days are removed automatically; on Pro they are kept until you delete them. |
| Feedback reports (transcript, context, and audio if you consented) | Deleted no later than 30 days after your most recent submission for that dictation, together with any audio you consented to attach. |
| Session receipts (word counts, timestamps, no content) | Kept for billing and abuse prevention until you delete your account. |
| Quality scores per dictation (scores only, no dictated text; if you have switched on server-side storage, also a generated comment that can quote your text) | Deleted after 90 days; the comment after 30 days. |
| Technical data per dictation (timings, word count, language, the type of app, which provider processed it and whether the text was inserted; no dictated text; if you have switched on server-side storage, also the bundle ID of the app) | Deleted after 90 days. |
| Billing records | 10 years (German tax law: § 147 AO) |
| Workspace seat history and purchase evidence (seats given and released, changes in the number of seats, and the country evidence or business declaration recorded at purchase) | 10 years (German tax law: § 147 AO), also after the workspace is deleted or you delete your account |
| Session tokens | 30 days, auto-extended on use |
| Server logs (request metadata, errors) | Contain no dictation content; kept by our hosting provider Scalingo for 12 months, and by our former host Railway until its deletion. |
| Error monitoring (Sentry) | Crash and error reports are scrubbed of dictation content before they are sent; kept by our error-monitoring provider for 30 days. |
| Product analytics events (PostHog) | 7 years on PostHog's platform, a period PostHog's plan fixes; deletion at that boundary is not separately enforced by us |
| Database backups | 30 days |
| Speech-to-text and language-model request data (Scaleway) | Up to 14 days, only to investigate abuse or errors. |
When you delete your account, we delete account-linked data within 30 days. Billing records are retained for the period required by German tax law in pseudonymized form.
8. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify incorrect data (Art. 16)
- Erasure ("right to be forgotten") (Art. 17)
- Restrict processing (Art. 18)
- Data portability — receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, where consent is the legal basis (Art. 7(3))
You can exercise these rights from your account settings or by emailing hello@junwhisper.com. We respond within 30 days.
Workspaces, and the one limit on erasure. An access request under Art. 15 covers your workspace data as well: which workspace you are a member of, your role, when you joined, the invitations you have sent or received, the shared-dictionary entries attributed to you, your seat and seat requests, and any pause of your own Pro. Art. 15(1)(c) also entitles you to know who receives your data, so we name them: besides the sub-processors in section 6, the other members of your workspace are a recipient category — they receive your name, your role, and how many words and sessions you dictate, and the workspace's admins and owner also receive your email address and whether you are on Free, pay for your own Pro or hold a seat the workspace pays for. We have no self-service export; an access request is answered by hand, by us, from hello@junwhisper.com, within 30 days. One thing we will not delete on request, with the reason in the same place: billing records are kept for ten years because German tax law (§ 147 AO) obliges us to keep them, and that legal obligation is what Art. 17(3)(b) GDPR excepts from the right to erasure. Everything else account-linked is deleted within 30 days — see section 7, which lists every retention period.
You also have the right to lodge a complaint with a supervisory authority. In Germany, that is the data protection authority of your federal state (Bundesländer DPAs) or the federal commissioner (BfDI).
9. Security
- All traffic between your device and our backend uses TLS 1.2 or higher.
- Audio we hold temporarily — crash-recovery audio for users who opted in, and feedback recordings you consented to — is stored in Scaleway Object Storage, encrypted at rest with Scaleway's server-side encryption (SSE-ONE, provider-managed keys).
- The PostgreSQL database is encrypted at rest by Scaleway, and our backend reaches it only over TLS that verifies the database's certificate.
- Authentication uses opaque session tokens (not JWTs); tokens expire after 30 days of inactivity.
- API keys for sub-processors are rotated on a regular schedule and stored in a secrets manager (Doppler), never in source code.
No system is perfectly secure; if we discover a personal data breach affecting you, we notify you and the supervisory authority as required by Art. 33–34 GDPR.
10. Children
Jun Whisper is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.
11. Changes to this policy
We may update this policy. We will email you at least 14 days before any material change takes effect.
12. Contact
Questions or data requests: