Privacy policy

Draft for review · September 23, 2026

1. What this covers

Dennis Kaczmarowski, based in Washington, United States, operates Vokalu and is responsible for the personal information described here. This policy covers the Vokalu website and hosted Windows dictation app. Questions and privacy requests can be sent to suolaraketti@proton.me, including before you create an account.

2. What happens when you dictate

When you start dictation, microphone audio travels over the internet for speech recognition. For Dictate + Format, the resulting text is processed to remove filler, apply corrections, and format your words. Command Mode processes the text you select and the instruction you speak. App context and relevant dictionary or formatting information may accompany a request so that the result fits where you are writing.

Vokalu’s servers process and discard your audio and words rather than saving them as dictation history. Usage duration and charges are recorded for billing. Speech recognition and text formatting involve third-party processors; this statement about Vokalu’s servers is not a promise that every processor has identical retention practices. The provider-specific retention terms are described below; Vokalu does not offer blanket zero-retention processing.

3. Information that stays on your computer

The app keeps dictation history locally, including original and cleaned text. Privacy mode stops new dictations from being saved to that history; it does not make online processing offline. Your settings, snippets, and personal dictionary are also managed on your PC. Automatic dictionary learning examines corrections locally and can be undone. Relevant saved words can be included in requests to improve recognition or formatting.

The app may maintain local diagnostic logs for troubleshooting. If you contact support, review any log or screenshot before sharing it and remove information you do not want to send.

4. Account, payment, and support information

Account records include your email address, selected plan, credit balance, account creation time, and sign-in session records. An installation identifier is associated with your account to enforce the one-trial-per-computer offer. Login requests include short-lived verification information and attempt counts.

The billing ledger records top-ups, free credit, usage duration, charges, timestamps, and payment references. Payment details are handled by our payment processor, Stripe. Vokalu does not ask you to send card numbers by email. If you write to support, we receive your address and the information you choose to include.

5. Website infrastructure and analytics

The website is hosted on Cloudflare. Hosting services process technical request information to deliver and protect the site. If enabled, Cloudflare Web Analytics provides aggregate website measurements without analytics cookies. We do not embed advertising trackers in this site. Your browser may cache site resources such as fonts and images.

6. Why information is processed

We use information to deliver dictation, authenticate accounts, maintain balances, handle payments and support, prevent misuse, and satisfy legal obligations. Where data protection law requires a lawful basis, processing may be necessary to provide the service you request, meet a legal obligation, or pursue a legitimate interest such as securing accounts. Where consent is required for optional processing, that processing must be explained separately.

7. Service providers and disclosures

Our speech and formatting processors are Deepgram and OpenAI. Other providers support payments, hosting, sign-in email, and support. They do not all receive the same information:

• Deepgram: speech recognition, receiving audio and relevant recognition context. The source configuration uses its global endpoint by default; that alone does not establish a specific processing country. Deepgram’s data controls explain that opting out of its model improvement program prevents retention of audio and transcript content after processing; usage and request metadata remain. Vokalu’s updated code explicitly opts out on every speech request. Production deployment must be verified before treating this as a live-service guarantee.
• OpenAI: text formatting and Command Mode, receiving transcript or selected text, instructions, and relevant app or dictionary context. OpenAI’s API data controls apply under its standard API terms. API content is not used to train its models by default, unless the customer opts in. Abuse-monitoring logs may include prompts and responses and are normally retained for up to 30 days; longer retention may apply for legal obligations or safety reasons. Vokalu is not enrolled in OpenAI Zero Data Retention. Our requests explicitly disable stored completions, but that does not disable abuse-monitoring retention. Model-specific application state, such as prompt caching, can also have separate retention under those terms.
• Stripe: checkout, payments, refunds, tax handling, and associated transaction information.
• Cloudflare: website delivery, security, and aggregate Web Analytics if enabled.
• Resend: the account-email integration in our source code, handling recipient addresses and sign-in messages when configured.
• Backend hosting and database providers: infrastructure for requests and account and billing records. The current Railway project hosts the API and a PostgreSQL database for account and billing records.
• Proton Mail: correspondence you send to our support address.

Processing may take place in the United States or other locations used by our providers and their subprocessors. Deepgram’s global endpoint is its default service endpoint, not a country-specific residency commitment. Content retention and processing location are separate: opting out of retention does not make a global endpoint region-restricted. Where international-transfer safeguards are required, the applicable provider agreements and mechanisms must be verified before launch. We may also disclose information where legally required or reasonably necessary to investigate fraud or protect the service.

8. Retention and security

Account information is kept while needed to provide the service. Billing records may need to be kept for tax, accounting, refunds, and disputes. Security and trial-abuse records are retained only where there is a documented lawful need; they are not an excuse to keep all account information indefinitely. We use safeguards appropriate to the service, but no online system can guarantee absolute security.

Our proposed deletion process is handled by support. Email us from your account address with the subject “Delete my Vokalu account.” We verify ownership using the account email without requesting your password or full payment details, explain the effect on unused credit and any refund rights, revoke active sessions, and delete or de-identify personal account data that no longer needs to be retained. We aim to complete verified requests within 30 days, or a shorter period where law requires it, and explain any permitted extension.

If a record must be retained, we identify the category, reason, and applicable retention period in our response and restrict its use to that purpose. Relevant deletion requests are also passed to service providers as appropriate. Residual backup copies follow the confirmed backup lifecycle and must not be restored to active use without reapplying deletions. Deleting an account does not remotely erase files on your PC; local history, settings, and logs must be removed separately. These procedures are an operational commitment to implement and verify before this draft takes effect, not a claim that automated deletion is already available.

9. Your choices and rights

You can choose when to start dictation, manage local history and settings, and turn on Privacy mode. You can email us to request access, correction, deletion, or an export of account information. Depending on your location, you may also have rights to object to or restrict processing, withdraw consent for consent-based processing, and complain to a data protection authority. We may need to verify your identity. Some financial or abuse-prevention records may need to be retained where law permits or requires it.

10. Younger users

Vokalu is a general-purpose productivity service. Users under 18 are encouraged to involve a parent or guardian. Where applicable law requires parental permission for processing a child’s personal information, encouragement alone is not sufficient: the required permission must be obtained before that processing. If you believe a child has provided personal information without legally required consent, contact us so we can investigate, restrict further processing as appropriate, and arrange deletion unless retention is legally required.

11. Changes and contact

Material changes to information handling will be described in an updated policy and communicated where required. For questions about this draft or a privacy request, contact suolaraketti@proton.me.