Privacy Policy
This Privacy Policy explains what personal data Jun Whisper collects, how it is used, and what rights you have under the EU General Data Protection Regulation (GDPR) and similar laws.
1. Who we are
Controller:
Dennis Hellwig (sole proprietor)
Potsdamer Straße 21
14548 Schwielowsee, Germany
Email: hello@junwhisper.com
We are based in Germany. The competent supervisory authority for data protection complaints is the data protection authority of the federal state where the controller is established.
2. The product
Jun Whisper is a macOS dictation application. When you press a hotkey and speak, the app captures audio from your microphone, sends it to our cloud backend for speech-to-text and language-model post-processing, and inserts the resulting text into the application you are using.
The app captures audio only during an active dictation — while you hold the hotkey, or until you stop a continuous session you started. No audio is recorded at any other time.
Your audio is sent to our speech-to-text provider to be transcribed. It is processed and discarded — neither we nor the provider keep it as part of normal operation. See section 6 for which provider, and section 7 for the exceptions where audio is retained temporarily.
3. What personal data we process
| Data | Source | Why we have it |
|---|---|---|
| Email address, name, profile photo URL | Google / Apple sign-in | Authentication, account identification |
| Audio recordings (PCM) | Your microphone | To produce a transcript via speech-to-text |
| Transcripts (raw text, polished text) | Generated from your audio | The product output. Kept in a database on your Mac; stored on our servers only if you switch on server-side storage |
| Application context (active window title, application bundle ID, recipient/subject for email composition) | Your operating system | To improve transcript accuracy by giving the language model context (e.g., a different tone for code editors vs. emails) — used in the moment to produce your text, then discarded; stored only if you switch on server-side storage |
| Custom dictionary words | You add them in app settings | Improves speech-to-text accuracy for your vocabulary — sent to our language-model provider so likely mishearings can be derived automatically |
| Style profiles | You configure them | Lets you switch between dictation styles |
| Billing data (Stripe customer ID, plan, word usage counters) | Generated from your usage | Subscription management and metered billing |
| Session tokens | Generated at sign-in | Authenticates your client to our backend |
| Product analytics events (feature usage: counts, durations, enums, booleans; no content, no email) | Generated as you use the app | To understand which features are used and prioritize improvements |
We do not train AI models on your dictations. We do not process audio content or transcripts for advertising. We do not sell or rent personal data.
4. Legal bases (GDPR Art. 6)
- Performance of a contract (Art. 6(1)(b)) — to deliver the dictation service you signed up for, including audio transcription, text refinement, and billing.
- Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and improve quality (e.g., aggregated usage analytics, debugging telemetry, product analytics via PostHog — see section 6).
- Consent (Art. 6(1)(a)) — for any processing that is not strictly necessary for the service. You can withdraw consent at any time.
5. Where your data is stored
Your data is hosted in the European Union. Specific destinations:
- Backend application — Railway, europe-west4 (Amsterdam, Netherlands)
- PostgreSQL database (account, settings) — Railway, europe-west4 (Amsterdam, Netherlands). Transcripts and audio are not stored by default. When you switch on server-side storage, transcripts go to that same Railway database and crash-recovery audio to Cloudflare R2 (EU jurisdiction).
- Dictation history — a local database on your Mac, not on our servers
- LLM tracing / debugging — Langfuse (Germany)
6. Sub-processors
We rely on the following sub-processors. Each has a Data Processing Agreement (or equivalent contractual terms) with us:
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Railway Corp. | Application hosting, PostgreSQL database | EU (europe-west4) | Standard Contractual Clauses |
| Cloudflare, Inc. | Storage of crash-recovery audio and consented feedback recordings (R2), bot protection on the withdrawal form (Turnstile) | Global edge / EU | Standard Contractual Clauses |
| Groq Inc. | Speech-to-text and language-model inference | USA | Standard Contractual Clauses |
| OpenAI, L.L.C. | Speech-to-text and language-model inference (fallback) | USA | Standard Contractual Clauses |
| Anthropic PBC | Quality evaluation, alert reconciliation, and custom-dictionary variant derivation | USA | Standard Contractual Clauses |
| Google LLC | Sign-in (OAuth) | USA | Standard Contractual Clauses |
| Apple Inc. | Sign-in | USA | Standard Contractual Clauses |
| Stripe, Inc. / Stripe Payments Europe Ltd. | Subscription billing | USA / Ireland | Standard Contractual Clauses (US) |
| Google Ireland Limited / Google LLC | Email delivery for contract and withdrawal confirmations (Google Workspace) | Ireland / USA | EU-U.S. Data Privacy Framework + SCCs |
| Langfuse GmbH | LLM observability and debugging | Germany | Within EU |
| Functional Software, Inc. (Sentry) | Error monitoring and crash reports | EU (European Union data region) | EU-U.S. Data Privacy Framework + SCCs |
| PostHog, Inc. | Product analytics and feature-flag evaluation | EU (eu-central-1, Frankfurt) | Standard Contractual Clauses |
When data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and additional safeguards as required by the Schrems II ruling.
Product analytics (PostHog). We use PostHog for product analytics and feature-flag evaluation, to understand which features are used and to safely roll out new features. Analytics events are sent from our backend, keyed to your opaque internal account ID — never your email address or name. IP address capture is disabled. We never send dictation content, transcripts, or any personal data beyond feature-usage signals (counts, durations, categories) to PostHog. These events are retained on PostHog's platform for a configured 7-year baseline; because deletion at that boundary is not separately enforced, section 7 states the retention criterion rather than a guaranteed period. The legal basis is legitimate interests (Art. 6(1)(f)) — see section 4. You can opt out of product analytics at any time from your account settings; see section 8 for your right to object.
Speech-to-text and language-model providers (Groq, OpenAI). Your dictation is processed by Groq (speech-to-text and language-model refinement), with OpenAI as an automatic fallback. Neither uses your dictations to train or improve their models — their agreements with us prohibit it. Retention is a matter of our own configuration, not a contractual guarantee from either vendor: we have enabled zero data retention on our Groq account, and OpenAI's transcription endpoint retains nothing by default. A last-resort fallback model may keep short-term abuse-monitoring logs, deleted within 30 days.
Feedback recordings (consented). If you submit feedback and choose to attach a recording, it is processed automatically only — no human listens to it. It is deleted no later than 30 days after your most recent submission for that dictation — see section 7.
Custom-dictionary variant derivation (Anthropic). When you add a custom dictionary word, we send that word (and recent speech-to-text output, for context) to Anthropic so it can automatically derive likely mishearing variants. This happens for every custom word you add, independent of whether you have switched on server-side storage for transcripts.
7. How long we keep data
| Data | Retention |
|---|---|
| Account (email, name) | Until you delete your account |
| Transcripts | Not stored on our servers by default. Your dictation history is kept in a database on your Mac. If you switch on "Allow storing my dictation content on the server", transcripts are stored on our servers and deleted after 30 days. |
| Audio recordings | Dictation audio is sent to our speech-to-text provider to be transcribed, then discarded — we do not store it. If a dictation fails and you have switched on server-side storage, the recording is kept for 30 days so you can recover it in the app, then deleted. If local audio saving is on, a copy stays on your Mac. |
| Dictation history on your Mac | Kept on your device, not on our servers. Unless you are on Pro, entries older than 30 days are removed automatically; on Pro they are kept until you delete them. |
| Feedback reports (transcript, context, and audio if you consented) | Deleted no later than 30 days after your most recent submission for that dictation, together with any audio you consented to attach. |
| Session receipts (word counts, timestamps, no content) | Kept for billing and abuse prevention until you delete your account. |
| Billing records | 10 years (German tax law: § 147 AO) |
| Session tokens | 30 days, auto-extended on use |
| Server logs (request metadata, errors) | Contain no dictation content; retained for our hosting provider's platform log window. |
| LLM debugging traces (Langfuse) | 30 days, enforced by a daily sweep. Traces for users who have not switched on server-side storage contain no dictation text. |
| Error monitoring (Sentry) | Crash and error reports are scrubbed of dictation content before they are sent; retained for our error-monitoring provider's platform retention window. |
| Product analytics events (PostHog) | PostHog platform retention (7-year configured baseline; deletion not separately enforced) |
When you delete your account, we delete account-linked data within 30 days. Billing records are retained for the period required by German tax law in pseudonymized form.
8. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify incorrect data (Art. 16)
- Erasure ("right to be forgotten") (Art. 17)
- Restrict processing (Art. 18)
- Data portability — receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, where consent is the legal basis (Art. 7(3))
You can exercise these rights from your account settings or by emailing hello@junwhisper.com. We respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. In Germany, that is the data protection authority of your federal state (Bundesländer DPAs) or the federal commissioner (BfDI).
9. Security
- All traffic between your device and our backend uses TLS 1.2 or higher.
- Audio we hold temporarily — crash-recovery audio for users who opted in, and feedback recordings you consented to — is encrypted at rest in Cloudflare R2.
- The PostgreSQL database is encrypted at rest by Railway.
- Authentication uses opaque session tokens (not JWTs); tokens expire after 30 days of inactivity.
- API keys for sub-processors are rotated on a regular schedule and stored in a secrets manager (Doppler), never in source code.
No system is perfectly secure; if we discover a personal data breach affecting you, we notify you and the supervisory authority as required by Art. 33–34 GDPR.
10. Children
Jun Whisper is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.
11. Changes to this policy
We may update this policy. Material changes will be communicated by email and a notice in the app at least 14 days before they take effect.
12. Contact
Questions or data requests: