Privacy Policy

Last updated: October 16, 2026

The short version

• The app works on your computer. Your speech is turned into text on your own Mac or PC, by a speech engine running on it. Apart from that, the app asks GitHub whether a newer version exists (see Update checks), tells us once that it was installed (see What we receive from the app), and contacts OpenAI or Anthropic only if you add your own API key. We don't receive your audio, your text or your usage stats.
• The app has no accounts and doesn't track how you use it. The first time it runs, it tells us once so we can count installs. talkflow puts no ID, no device information and no usage data in that request, and we store only a total number. It checks GitHub for updates, and an update installs only when you click. Audio is never saved to disk.
• The website has no cookies and no forms, and uses only basic, cookieless analytics. Like every website, it can't be delivered without your browser sending some technical information, such as your IP address, to our hosting provider.
• We don't sell or share your personal information, and we don't use it for advertising.
• Questions? Email samir@talkflow.live.

This policy has two main parts: The website and The app. They work very differently, so we describe them separately.

Who we are

talkflow is run by Samir Kharel, an individual developer ("we", "us", "our"). You can contact us at samir@talkflow.live.

For the website information described in Part 1, and for any emails you send us, we decide how that information is used. Under data protection laws such as the GDPR and UK GDPR, that makes us the "controller" of that information.

What this policy covers, and what it doesn't

This policy covers:

• this website;
• official releases of the talkflow app for Mac and Windows, downloaded from this website or from https://github.com/saamirkhrl/talkflow;
• emails you send us.

It doesn't cover:

• Other websites we link to, such as GitHub. Their own privacy policies apply.
• The apps you dictate into. Once talkflow types your words into another app, such as a chat app, an email client or a document, that text is handled by that app and its provider under their own privacy policies.
• Modified versions of talkflow. talkflow is open source, so anyone can build and share their own version. Those versions may work differently, and this policy doesn't describe them.

Part 1: The website

What information is collected

When you visit the site, your browser sends our hosting provider the technical information that every website needs in order to respond. This typically includes:

• your IP address, and the approximate location that can be worked out from it;
• your browser type and operating system (the "user agent");
• the page you asked for, the page that linked you to us (the "referrer"), and the date and time of the request.

Our hosting provider is Vercel Inc.

What the site doesn't do

• It doesn't set cookies.
• It doesn't use advertising, tracking pixels or session recording. It does use Vercel Web Analytics to count page views and visits in aggregate (pages viewed, referrer, country, browser and device type). It doesn't use cookies for this, doesn't build a profile of you and doesn't follow you across other websites.
• It doesn't ask you for any personal information. There are no sign-up, contact or email forms.
• Its fonts are served from our own site, not from Google, so your browser doesn't contact Google Fonts.
• To show the right download button, the page checks in your browser which operating system you're using. That check happens on your device, and the result isn't sent to us.

The GitHub star count

The page shows how many people have starred the project on GitHub. Our server fetches this public number from GitHub's API, at most once an hour. Your browser does not contact GitHub for this, and GitHub does not receive your IP address from it.

Why we use it, and our legal basis

This information is used only to deliver the site to you, keep it running, and protect it from abuse such as attacks and excessive traffic.

Under the GDPR and UK GDPR, our legal basis is our legitimate interests in running a working and secure website (Article 6(1)(f)). You have the right to object to this. See "Your rights" below.

Who handles it for us

Our hosting provider (Vercel Inc.) handles this information in order to serve the site. See Vercel's Privacy Notice.

The app's one-time install request (see What we receive from the app) reaches us the same way, through Vercel. The total it adds to is kept in a database hosted by Neon, which receives only that number.

We don't share website information with anyone else, except where the law requires it.

How long it's kept

Vercel keeps request logs for a limited time under its own policies. We don't copy or export them.

Downloads

If you download or view talkflow on GitHub, GitHub receives your request, including your IP address, and handles it under the GitHub Privacy Statement.

"Do Not Track" and Global Privacy Control

We don't track visitors across other websites, and we don't allow other companies to do so through our site. Our aggregate analytics don't use cookies or build a profile of you. So there's nothing for a "Do Not Track" or Global Privacy Control signal to switch off. The site works the same way whether or not your browser sends one.

Part 2: The app

talkflow has a Mac app and a Windows app. They handle your information the same way; where they differ, this part says so.

How dictation works

When you hold the talkflow shortcut (fn on a Mac and Ctrl + Win on Windows, unless you change it), the app:

1. records sound from your microphone and keeps it in your computer's memory;
2. sends that audio to a speech engine (whisper.cpp), which is included with talkflow and runs as a separate program on your own computer, at the address 127.0.0.1 (also called "localhost"), which always means your own computer;
3. turns the speech into text using OpenAI's Whisper speech model, running on your computer: the English-only "small.en" version and, on computers fast enough for it, the larger "large-v3-turbo" version for the final text;
4. types the text into the app you're using.

Audio is never saved to disk. It stays in memory only, until your next dictation or until you quit talkflow.

The speech engine is a program on your computer. It is not a cloud server, and your audio doesn't travel over the internet.

What we receive from the app

One thing: the first time a newly installed copy of talkflow runs while online, it tells us once, so we can count how many times talkflow has been installed. This applies to versions 0.1.6 and later; earlier versions send us nothing.

• The app sends one empty request to our website. talkflow puts nothing in it: no ID, no information about your device or operating system, and no usage data, audio or text.
• We store only a running total. We don't store your IP address or anything else from the request, so we can't tell installs apart or link the count to you.
• Like any web request, it reaches our hosting provider (Vercel) with your IP address and the standard technical details your operating system adds to web requests. Vercel's ordinary request logs apply to it, as they do to the website (see How long it's kept). The total is stored in a database hosted by Neon.
• Once our site confirms it received the request, the app remembers that (a yes/no flag on your computer) and doesn't send it again. If the request fails, the app tries again the next time it starts. Reinstalling talkflow may count again.
• Copies of talkflow built from the source code don't send this request at all.

Apart from that, the app doesn't send your audio, your text, your stats or any other information to us. There are no accounts, no usage analytics and no crash reports sent to us. Besides the speech engine on your own computer and this one-time request, the app connects only to GitHub to check for updates (below), and to OpenAI or Anthropic if you add your own API key in Settings.

Update checks

When it is online, the app asks GitHub whether a newer version exists: shortly after it starts, every few hours while it runs, and when you open the dashboard. It downloads a small public file listing the latest release (if that file is missing, it asks GitHub's release API instead). The request sends nothing about you or your dictation. Like any web request, it reaches GitHub with your IP address, and it names the app and its version (for example "talkflow/0.1.5"). GitHub's privacy statement covers that request; we don't receive it.

When a newer version exists, the app says so. Nothing is downloaded or installed until you click to update, and the download is checked against the release's published checksum before it is installed. Without an internet connection, the app works the same and simply checks again later.

Apart from the one-time install count, which can't be linked to you, we don't receive anything from the app, so we can't see, recover or delete anything on your computer for you. You are in control of it.

Setting up the app

The whisper.cpp speech engine comes inside the talkflow download, so nothing else needs to be installed. The Whisper speech models are downloaded from Hugging Face: small.en (English only) during setup, and large-v3-turbo in the background on computers that use it. Hugging Face sees your IP address when you download them and handles it under the Hugging Face privacy policy.

What stays on your computer

The app keeps a small amount of information on your own computer. On a Mac, your data is in ~/Library/Application Support/talkflow/. On Windows, it is in %APPDATA%\talkflow\, and the models and logs are in %LOCALAPPDATA%\talkflow\.

• Usage stats (stats.json). Totals of words dictated, number of dictations and speaking time, and words per day. These power the stats you see in the app. They contain no text and no audio.
• Settings and learned words (settings.json). Your settings, and the words talkflow has learned from corrections you made by hand (see What the app reads while you dictate).
• A technical log. On a Mac, at ~/Library/Logs/talkflow/talkflow.log, which grows until you delete it. On Windows, at %LOCALAPPDATA%\talkflow\logs\talkflow.log, which starts over at 2 MB. For each dictation it records technical details, such as its length and timing and the name of the app you dictated into. It does not record your words.
• Whether this copy has been counted. A yes/no flag (in the app's preferences on a Mac, and in windows.json on Windows), so the install count described above is sent only once.
• On Windows, speed measurements. How fast your PC runs each speech model, so talkflow can choose the right settings (device.json).
• Your own API keys, if you add any: in the macOS Keychain on a Mac, and in Windows Credential Manager on Windows, never in a plain file.
• The speech engine's own log. The speech engine may keep its own log next to talkflow's. Delete it with the others if you want it gone.

talkflow doesn't encrypt these files itself. They are protected by your user account, and by disk encryption (FileVault on a Mac, BitLocker or device encryption on Windows) if you have it turned on.

Deleting them. You can delete these files at any time. On a Mac, deleting the talkflow app may not delete them. On Windows, uninstalling removes the models and logs but keeps your data folder, so remove %APPDATA%\talkflow\ too if you want it gone.

What the app reads while you dictate

When you start a dictation, talkflow reads what is around your cursor, through macOS Accessibility on a Mac or UI Automation on Windows: up to 300 characters before the cursor, up to the last 4,000 characters of the text field, and names visible on screen, such as an email's recipients. It uses this to get spacing and capitals right, to spell names correctly and, a little later, to notice when you corrected a word it got wrong, so it can learn that word. It never reads password fields, and it never reads whole documents beyond those limits. This happens in memory. It isn't logged or sent anywhere, and it is kept only for that dictation, except a corrected word, which is saved to your learned words.

The clipboard. On a Mac, talkflow types with keystrokes and doesn't use the clipboard, with one exception: if the text can't be typed (for example, because you switched to another app while speaking), it is put on the clipboard so your words aren't lost. On Windows, longer dictations are pasted: talkflow saves what is on your clipboard, puts the dictation there, pastes it, and then puts your clipboard back. That paste is kept out of Windows clipboard history and the cloud clipboard.

Permissions the app asks for

On a Mac. You can turn either of these off at any time in System Settings > Privacy & Security, but talkflow won't work without them.

• Microphone. macOS asks you to approve this, so talkflow can hear you.
• Accessibility. You grant this yourself in System Settings. talkflow uses it to type the text into the app you're using, to notice when you press and release the shortcut, and for the reading described above. While you hold the shortcut, it also notices whether another key is pressed (then you're using an app shortcut, such as Command + C, not dictating), without looking at which key it was. It doesn't record, store or send what you type. Because Accessibility covers this, talkflow doesn't ask for Input Monitoring.

On Windows. Windows doesn't ask desktop apps for permissions. Instead:

• Microphone. The switches in Settings > Privacy & security > Microphone must allow desktop apps to use it. talkflow checks them and, if one is off, tells you which.
• The shortcut. To notice when you hold the shortcut, talkflow watches key presses, as Windows lets any desktop app do. It keeps track only of which keys are held down at that moment, to tell whether the shortcut is held. It doesn't record, store or send what you type.

Things outside talkflow's control

Some things that happen on your computer are up to you, your organization or other companies, not us:

• Backups and sync. Tools like Time Machine, OneDrive, or other backup and sync software you use, may copy the files listed above. Those copies are governed by the tool you use.
• Your operating system. macOS and Windows may make their own network connections, for example to check a newly downloaded app or installer before it first opens. If you have chosen to share analytics or diagnostic data with Apple or Microsoft, your operating system may also send them crash reports that involve talkflow. Apple's and Microsoft's privacy policies cover those.
• Work computers. If you use talkflow on a computer managed by your employer or school, their security and monitoring tools and policies may also apply.

Future versions

This part describes the app as of the "Last updated" date above. The one-time install count starts with version 0.1.6. If we ever add a feature that sends any other information off your computer, such as crash reports, we will update this policy before releasing that version and describe the change in the release notes.

Emails you send us

If you email us, we receive your email address, your name if you include it, and whatever you write. We use it only to reply and to deal with your request. Our legal basis is our legitimate interest in answering you.

Our address forwards to a Gmail inbox. Google, and the email service that forwards the messages, process them on our behalf. We keep emails only as long as needed to handle your request.

Selling and sharing

We don't sell your personal information. We don't "share" it for cross-context behavioral advertising, as California law defines those terms, and we don't use it for targeted advertising. We haven't done any of these things in the past 12 months.

Children

The site and the app are not aimed at children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child under 13 has sent us personal information, for example by email, contact us and we'll delete it.

Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal information we hold about you (access);
• ask us to correct it (rectification);
• ask us to delete it (erasure);
• ask us to limit how we use it (restriction);
• object to our use of it based on our legitimate interests (objection);
• receive it in a portable format (portability);
• not be treated differently for using any of these rights.

In practice we hold very little. We have no app data about you at all (the install count is a single total that can't be linked to anyone), and we don't keep copies of website request logs. If you contact us about website logs, we may not be able to find them, because they are held by our hosting provider.

How to make a request. Email samir@talkflow.live. We'll reply within one month. If we need to confirm who you are, we'll ask only for what we need.

Complaints. If you have a concern about how we handle your information, please tell us first at samir@talkflow.live. You also have the right to complain to a data protection authority:

• in the UK, the Information Commissioner's Office (ICO);
• in the EU or EEA, the data protection authority in your country (list of EU authorities).

If you live in California or another US state with a privacy law, you can make the same requests by email. We'll handle them in the same way, whether or not that law applies to us.

Keeping information safe

• The website is served over encrypted HTTPS connections.
• The app talks to its speech engine at 127.0.0.1, your own computer. talkflow starts the speech engine so that it listens only on your own computer, not on your network.
• The app's other connections (update checks, the one-time install count, and OpenAI or Anthropic if you add a key) use encrypted HTTPS.

No system is perfectly secure, but we keep the information we hold to a minimum, which is itself a protection.

International transfers

Vercel is based in the United States and serves the site from data centers around the world, so website request information may be processed outside your country, including in the United States. Vercel handles this under its own policies.

Changes to this policy

We may update this policy. When we do, we'll post the new version on this page and change the "Last updated" date at the top. Significant changes to the app's data handling are also noted in the release notes.

The app tells you when a new version is available, but not when this policy changes. Please check this page or the release notes when you update. See also our Terms of Use.

Contact

Samir Kharel
Email: samir@talkflow.live