Privacy policy

1. Who we are (controller)

The data controller is Dev Intensifies SLU, a Spanish Sociedad Limitada Unipersonal, CIF B70709647, registered at Carretera de Tiana, 193, 1º 2ª, 08390 Montgat, Barcelona, Spain. We trade as TypeNot (the application is named "NoType" internally). This policy covers the TypeNot desktop apps (macOS, Windows), the mobile apps (iOS, Android), the backend at api.typenot.app, and the marketing website typenot.app.

For any privacy question, or to exercise your rights, contact support@typenot.app. We have assessed our activities under Article 37 GDPR and concluded that we are not required to appoint a statutory Data Protection Officer, because our core activity is not large-scale processing of special-category data and does not involve regular, systematic monitoring of individuals; the address above reaches the person responsible for data protection. We keep this assessment under review.

Our lead supervisory authority is the Spanish Agencia Española de Protección de Datos (AEPD), aepd.es. You may lodge a complaint with the AEPD or with the supervisory authority of your country of residence or workplace at any time. UK users may complain to the Information Commissioner's Office (ICO).

2. What we collect

The short version: your voice is the most personal data there is, so the product is built to touch as little of it as possible. On desktop, your dictation audio is transcribed on your device and never leaves it; only the resulting text is processed further. The table below lists everything we collect.

What is required. An email address, a password, and a display name are required to create an account and to provide the Service — without them we cannot create your account. Everything else, including whether you dictate at all and whether you use the optional assistant feature, is voluntary and under your control.

3. Why we process it (legal bases, GDPR Art. 6)

No automated decisions about you. We do not carry out automated decision-making that produces legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR. AI cleanup and translation only reformat or translate the text you dictate; they do not make decisions about you.

Marketing. We use email only for transactional and service messages. If we ever send marketing or newsletter email, we will do so only with your separate, freely given consent, which you can withdraw at any time.

3.1 Special-category data (GDPR Art. 9)

We do not ask for, and do not want, special-category data (health, religion, political views, sexual orientation, etc.). However, because you control what you dictate, such information could appear in your speech. On desktop your audio is transcribed on your device, so that audio never reaches us. The resulting text may be sent to our AI cleanup/translation provider to produce your result. Where that text may reveal special-category data, our lawful basis is your explicit consent under Art. 9(2)(a), which we ask for before transcript text is sent to a third-party AI provider and which you can withdraw at any time (after which cleanup runs only to the extent it can without that provider, or not at all). You should avoid dictating special-category information you do not want processed by a third-party AI provider.

4. How your audio is handled

On desktop (macOS, Windows), transcription happens entirely on your device. Your microphone audio is held only in memory and fed to an on-device speech-to-text engine (whisper.cpp). It is never written to disk, never uploaded, and never stored on our servers. When the utterance is transcribed, the audio in memory is discarded. We surface a short collection notice at the microphone-permission / first-dictation step so you see how your voice is handled at the point you first use it.

To make on-device transcription work, the desktop app downloads a speech model (roughly 550 MB) over HTTPS from Hugging Face (huggingface.co) the first time you dictate, and pre-fetches it at start-up. That download reveals your IP address and request timing to Hugging Face and its CDN, but sends no audio or text. The model is cached on your device.

No crash recovery for in-progress recordings. Because audio is processed transiently and is never written to a durable on-disk archive, if the app or your device crashes while you are recording, that recording's audio can be lost and cannot be recovered. This is a deliberate privacy trade-off.

Mobile (iOS, Android). On-device transcription is not yet available on mobile; where it is unavailable the app declines to transcribe rather than silently sending your audio to the cloud. In no case does your audio leave your mobile device for transcription.

The shipping apps do not offer a cloud speech-to-text option. Our backend contains a relay to a US speech-to-text provider (Deepgram) for a possible future "cloud mode", but the current apps transcribe on-device only and do not route audio to it. If we ever enable cloud transcription, we would update this policy, obtain any consent required, and tell you before turning it on; even then, your audio would be streamed to that provider only to produce text and would not be stored on our servers (we would keep only a metadata audit record — a byte count and destination — never the audio), under zero-retention terms.

5. Processors and sub-processors

We use the processors below. Each acts on our instructions under a written data-processing agreement. Where an AI provider processes your text, we require by contract that it process your content only to return your result — a zero-data-retention (ZDR) arrangement in which it does not retain your content or train on it — and our backend refuses to start unless that provider's zero-retention flag is set. These protections are only as strong as the agreement in place with each provider; we do not control their infrastructure.

For US privacy laws, every recipient of personal information listed below is engaged as a service provider / contractor (or equivalent), bound by contract to process personal information only on our behalf and for the disclosed purposes, and prohibited from selling it, retaining it, or using it for their own purposes.

We do not sell your personal data and we do not share it with advertisers. We disclose data to authorities only when legally required. If a processor's role or identity changes materially we will update this list.

6. Feedback and support

When you submit in-app feedback, the text is stored on our server and may be synced into a private issue tracker (GitHub) for triage, alongside a pseudonymous identifier — your raw email is not sent to the tracker. Please do not include sensitive personal information in feedback; whatever you type is copied as written.

7. International transfers

Some processors are located outside the EEA/UK (chiefly the United States). For those transfers we rely on the European Commission's Standard Contractual Clauses (SCCs), supported by a transfer-impact assessment, and — only where the specific recipient is currently certified — the EU-US Data Privacy Framework (DPF). For UK users, the UK International Data Transfer Addendum to the SCCs applies. Where a provider is EU-hosted (for example our transactional-email provider), no international transfer takes place. We keep EU-region hosting where our providers offer it. You can request details of the safeguards for a specific transfer at support@typenot.app.

8. Retention

9. Analytics and cookies

We want to be accurate here, because our previous policy was not. The typenot.app website and the apps use Umami, a privacy-focused, cookieless analytics tool that we self-host. It sets no advertising cookies and does not track you across other sites.

• In-app product analytics is on by default and is anonymous. A fixed, allow-listed set of events (for example: app opened, dictation started/completed), together with a small set of non-identifying fields such as platform and app version, is sent to our self-hosted Umami. A strict allow-list prevents any transcript, audio, email, or free-text from ever being included, and the analytics leg carries no account identifier — the events are anonymous and are not linked to your identity. Because the analytics are anonymous we rely on our legitimate interest (Art. 6(1)(f)) rather than consent, so there is no in-app analytics toggle; you can object at any time by emailing support@typenot.app.
• The website loads the same cookieless Umami script to count page views and downloads. No third-party advertising or cross-site trackers are used.
• Transcript-content AI tracing is opt-in. Detailed traces that would include your transcript text are disabled by default and are only captured if you explicitly turn on content tracing (which you can turn off again at any time).

We do not sell or share personal information, so no opt-out is needed to stop that; where we receive an opt-out preference signal such as Global Privacy Control (GPC), we treat it consistently with our no-sale / no-share posture.

10. Your rights (GDPR / UK GDPR)

If you are in the EEA or UK, you have the right to:

• Access your data (Art. 15) and receive a portable copy of the data we hold on our servers (Art. 20);
• Rectify inaccurate data (Art. 16) — you can edit your profile in the app;
• Erase your data and account (Art. 17);
• Restrict processing (Art. 18) and object to processing based on legitimate interest, such as product analytics, security and diagnostics (Art. 21);
• Withdraw consent at any time for anything based on consent (for example the Art. 9 consent to send special-category dictation text to an AI provider, or content tracing), without affecting processing already carried out;
• Complain to a supervisory authority — in Spain the AEPD (aepd.es), or the authority where you live or work.

How to exercise them. You can edit your profile directly in the app. For access, portability, erasure, restriction or objection, email support@typenot.app; a member of our team fulfils these requests. We respond within one month, as required by law (extendable by two further months for complex requests, with notice), and we verify the request against your account before acting. When you ask us to delete your account, we erase or irreversibly anonymise the personal data we hold about you on our servers — including account, assistant/document, usage and billing data — except records we must keep by law. Because your dictation library lives on your device, you control it directly by deleting entries or the app; a server-side copy cannot include content we never receive.

11. United States privacy rights

This section applies to residents of California and, where equivalent rights exist, of other US states (including Virginia, Colorado, Connecticut and Utah). Terms such as "personal information", "sell", and "share" have the meanings given in the applicable state law.

11.1 Categories collected, purposes, recipients and retention

11.2 No sale or sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months, including for consumers under 16. Every recipient of personal information is bound by contract to act only as our service provider / contractor.

11.3 Sensitive personal information

Voice input and the content of what you dictate may constitute sensitive personal information. We use it only to provide the service you request (produce your text) and for security — never to infer characteristics about you or for advertising. The AI providers that receive your transcript text are engaged as service providers / contractors and are contractually restricted from using it for their own purposes. You may nonetheless direct us to limit the use of your sensitive personal information by emailing support@typenot.app, and we will honor that request.

11.4 Your rights and how to exercise them

• Know / access the personal information we hold about you;
• Delete it, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of any sale or sharing (we do neither) and limit use of sensitive personal information;
• Non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised a right.

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Submit a request by emailing support@typenot.app. We confirm receipt within 10 business days and respond within 45 days, extendable by a further 45 days with notice. We verify your request against your account. You may use an authorized agent, with proof of authorization. Appeals: if we deny your request, you may appeal by replying to our decision or emailing us; we will respond to the appeal within 45 days (60 days in Colorado), and if we deny the appeal we will provide a way to contact your state Attorney General. California's "Shine the Light" law (Civil Code §1798.83): we do not disclose personal information to third parties for their own direct marketing.

11.5 Health data and biometrics

We do not create, derive, or store voiceprints or other biometric identifiers; your audio is transcribed on your device and discarded. If you dictate health-related information, the resulting text may be sent to an AI provider for cleanup/translation as described above — please do not dictate health data you do not want processed by a third-party AI provider. This addresses, among others, Washington's My Health My Data Act and state biometric statutes (e.g. Illinois BIPA, Texas CUBI).

12. Security

Data is encrypted in transit (TLS) and, on our servers, at rest. Passwords are stored only as bcrypt hashes. Authentication tokens on your device are held in encrypted storage. AI-provider API keys never leave our servers — the apps never see them — and access to production systems is restricted and logged. On desktop, your audio never leaves your device at all, which is the strongest protection we can offer for it. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as required by GDPR Arts. 33–34.

13. Children

TypeNot is not directed to children. You must be at least 16 years old to use the Service, which you confirm when you accept our terms at sign-up. Some EU member states set the age of digital consent lower (it ranges from 13 to 16; in Spain it is 14) — where a lower statutory age applies to you, that age governs your ability to consent. We do not collect birth dates, so age is self-declared, and we do not knowingly collect data from children below the applicable age. If we learn that a user is under 13 (or the applicable minimum), we will delete their data promptly. If you believe a child has created an account, contact us and we will delete it.

14. Changes to this policy

We will update this policy as the product evolves and will notify you of material changes by email or in the app before they take effect. The version and date at the top reflect the current edition. We keep each localized version accurate and materially equivalent to the English text; if any conflict arises for you, the version in your own language governs for you.

15. Contact

Dev Intensifies SLU · CIF B70709647 · Carretera de Tiana, 193, 1º 2ª, 08390 Montgat, Barcelona, Spain · support@typenot.app

Related documents: Privacy Policy · Terms of Service · Acceptable Use Policy.