Privacy policy

In short: VoxaFlow processes your voice and your text only on your Mac. This website sets no cookies and embeds no tracking services; we count visits anonymously on our own server. We keep only shortened IP addresses and delete logs after 7 days. The app connects only to our own servers: to download models, to check for updates and, from version 0.8, to check the beta or license. The optional iCloud sync is encrypted on your Mac first; neither Apple nor we can read that data. This is a translation; theGerman version is legally binding.

1. Controller

Represented by the managing director Holger D. Erbe
Phone: +49 611 99 302-0 · Email: info@login-online.com
Privacy questions about VoxaFlow: hello@voxaflow.ai

2. Summary

• VoxaFlow processes voice recordings and dictated text exclusively on your Mac. They are never sent to us. Only if you turn on iCloud sync does the app store data end-to-end encrypted in your own iCloud Drive (section 4).
• This website sets no cookies, embeds no third-party analytics or tracking services and loads nothing from other servers. Fonts are delivered by our own server. We count visits anonymously on our own server (section 3).
• All our servers are located in Germany. We do not pass data on to third parties and do not transfer data to countries outside the EU.

3. Visiting this website

Server log files

When you open voxaflow.ai or our download servers for models and updates, the web server processes technically necessary data. The log files contain:

• the IP address in shortened form (for IPv4 only the first two blocks, for IPv6 the first 32 bits), so it can no longer be attributed to a connection,
• date and time, requested address, status code, amount of data transferred, protocol and the referring page (referrer).

The identifier of the browser or app (user agent) and the preferred languages are not stored. The full IP address is processed in memory only for the duration of the connection, because a response cannot be delivered without it.

The purpose is secure and stable operation, defense against attacks and counting downloads. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in these purposes. Log files are deleted automatically after 7 days. We evaluate download numbers only in aggregate, without reference to individuals.

Anonymous usage statistics

To understand how the website and the app are used, we evaluate website visits, downloads and the app's update checks on our own server. The web server passes each request to an evaluation program on the same server. It derives country, region and city from the IP address (using a local database, without asking third parties), device type, browser and operating system or the app version from the user agent, and the source from the referring page. It also computes a checksum from a secret key that changes daily, the IP address and the user agent, so that we can count the visitors of a day.

Only these derived values are stored, never the IP address and never the full user agent. Because the key changes every day and is not kept, the checksum cannot be linked to a person or to another day. If your browser sends “Do Not Track” or “Global Privacy Control”, we only count the request, without location, device or checksum. The data is deleted after 14 months.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding the reach and use of our offering. Since nothing is stored on or read from your device, no consent under § 25 TDDDG is required. You can object under Art. 21 GDPR, most easily via your browser's “Do Not Track” or “Global Privacy Control” setting.

Cookies and external content

This website uses no cookies and stores nothing on your device. There are no advertising or social media services, no embedded videos or maps and no fonts or scripts from other servers. A consent banner is therefore not required.

Hosting

Our servers are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centers in Germany. Hetzner processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Contact by email

If you write to us, we process your email address and the content of your message to answer your request. The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is concerned, otherwise Art. 6(1)(f) GDPR. We delete messages once the request has been dealt with and no statutory retention obligations apply.

Your message stays in our mailbox with our email provider spamgo, which processes the mails on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Our admin backend on the Hetzner servers reads the mailbox to answer it but does not store the messages in a database of its own. It only keeps logs without message content (time, address, subject) and deletes them after 90 days. A new request may receive an automatic confirmation of receipt at your sender address, at most one in seven days.

AI reply drafts

For individual requests we may have an AI service draft a reply. A team member reviews and edits every draft before it is sent; the AI does not answer anything automatically. To do so, at the push of a button we send the text of your message to the OpenAI API, with your first name but without email addresses, phone numbers, quotes and signature. OpenAI processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR and, under its terms, does not use it to train models. Data may be transferred to the USA in the process; this is safeguarded by the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(f) GDPR, our interest in a quick and accurate answer.

4. The VoxaFlow app

Processing on your Mac

Speech recognition and text cleanup run entirely on your Mac. The microphone recording is held in memory only while you dictate and is discarded afterwards; only the latest recording stays in memory until the next one, so it can be processed again. Dictated text, history, dictionary, snippets, settings and the statistics of the overview (numbers only, such as words, durations and apps used, no text) are stored by VoxaFlow locally on your Mac. You choose in the app how long the history is kept (7 days to forever); history and statistics can be turned off and deleted there. The app uses the microphone and accessibility permissions only to record your voice and to insert the text at the cursor. If “Learn from my corrections” is on, the app reads the text field it wrote into (never a password field) for up to a minute after inserting, to offer corrected words as dictionary suggestions; this too happens only on your Mac. We have no access to this data.

Sync via iCloud (optional)

From version 0.7 you can sync dictionary, snippets, settings and statistics between your Macs, and optionally the history with the dictated texts. The feature is off until you turn it on in the app under “iCloud & Data”.

• Location: the “VoxaFlow” folder in the iCloud Drive of your own Apple Account. macOS does the transfer; the app itself opens no connection for it, and nothing of it goes to our servers.
• Encryption: every file is encrypted with AES-256-GCM on your Mac before it is stored. Your first Mac creates the key; it is kept in your keychain (in iCloud Keychain where permitted) and passed to further Macs via a recovery code that only you know. Neither Apple nor we can read the contents. Unencrypted are only a check value for the key, a random device ID per Mac as folder name, the file names (such as the month of a history section) and the size and time of the files.
• Apple: iCloud is a service of Apple that you have agreed with Apple; Apple's terms and privacy policy apply. Apple processes the encrypted files for you, not on our behalf, and may store them outside the EU. We receive neither the files nor any information about your Apple Account.
• Deleting: in the app with “Delete all data in iCloud” or by deleting the “VoxaFlow” folder in iCloud Drive. Turning sync off leaves the data on each Mac unchanged.

Connections made by the app

The app connects exclusively to our own servers in Germany:

The information on server log files in section 3 applies to all connections. For the model download and the update check, the legal basis is Art. 6(1)(f) GDPR (providing the software and keeping it secure).

The device hash is a value calculated from characteristics of your Mac from which the device cannot be derived. Combined with the IP address it is nevertheless personal data (pseudonymous). We use it to limit licenses to two devices, to grant a trial only once and to secure the launch price for beta users. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for customers and Art. 6(1)(f) GDPR (legitimate interest in preventing abuse) for the beta and trial.

Retention: activations until 12 months after the device is deactivated, trial and beta entries 24 months, licenses for the duration of the license.

The app never sends to us: audio, text, clipboard contents, names of apps or documents, your name or email address, device name, user name, macOS version (apart from the exception above when downloading speech recognition), hardware model, word counts, usage statistics or crash reports.

“Report a Problem …” in the app's menu creates a text file with version, Mac model, settings, log entries and the latest crash report (no dictated text, no audio) and opens an email to hello@voxaflow.ai with it in your mail app. It is transferred only if you send the email yourself; “Contact by email” in section 3 then applies.

Purchases

Sales start on January 1, 2027. Before then, we will add information on payment processing, license emails and the customer portal to this policy.

5. Recipients and third countries

Apart from our hosting provider, our email provider and, for AI reply drafts only, OpenAI (all section 3), no third parties receive data. We transfer data to countries outside the European Union only for AI reply drafts (USA, standard contractual clauses). You use the optional iCloud sync (section 4) under your own agreement with Apple; the data is encrypted so that Apple cannot read it. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

6. Your rights

Under the GDPR you have the right to

• access the data processed about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21).

To exercise these rights, write to hello@voxaflow.ai or to the address in section 1. Since we store only shortened IP addresses for website visits, we cannot attribute these entries to a person.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.

7. Changes

We update this policy when the app, the website or the legal situation changes. The version published here applies.