Privacy policy

Madjinn Utveckling AB, org. nr 559147‑2211, c/o minpostbox 1274, Vasagatan 11, 41124 Gothenburg, Sweden, is the controller of the data described here. Contact: privacy@madjinn.dev.

The WhispAway app records your voice only while you hold the space bar. The audio stays in memory, is transcribed on the iPhone, and is never written to disk.

While a dictation session is ready, the microphone stays on so dictation starts at once, and iOS shows its microphone indicator. Nothing is recorded or kept until you hold the space bar. You end the session in WhispAway, or it ends by itself after the time you've chosen.

The WhispAway keyboard has no internet access of its own and never sends what you type. To capitalise and space words correctly, it reads the text just before the cursor, on the iPhone. It never gives dictation or automatic edits to password fields. The Pinyin keyboard remembers the words you choose, in its own storage on the iPhone.

The keyboard needs Full Access only to share a folder with the WhispAway app, which is how dictated text reaches it, and for its haptic taps.

When you use WhispAway Cloud, the app sends each dictation's audio as you speak, over an encrypted connection. This includes your free first day, unless you turn off “Use the cloud today, free” during setup.

• The connection passes through our relay server at Hetzner in Helsinki, Finland, which forwards it without decrypting it. Your audio is decrypted only on our own servers in Sweden, where it is transcribed.
• The audio and its text are kept only in memory, are never saved to a file or a database, and are deleted as soon as the text is sent back.
• Each request carries a random request ID and a short-lived access key. It carries no name, email address or Apple ID.

Apple handles your payment. We receive Apple's signed record of the purchase, never your payment details or your Apple ID. During setup, the app asks Apple's DeviceCheck whether this iPhone has already had a free first day. Apple's privacy policy covers what Apple processes.

Setup asks whether you want to share anonymous usage statistics, and nothing is sent until you choose. If you choose “Share statistics”, the app sends them to TelemetryDeck, a German company with its servers in the EU. You can change your choice any time in WhispAway's Settings, under Privacy. They cover:

• the setup steps;
• dictations' outcomes, models, lengths in ranges, and timings;
• model downloads and preparation;
• WhispAway Cloud events, such as the offer shown or a trial started;
• the app version, iOS version and iPhone model.

They never contain your words, your audio or what you type. They're labelled with a random code made for this install, run through a one-way hash, so they can't be linked to you, your Apple ID or other apps. Turning the statistics off deletes those not yet sent; turning them on again makes a new code. TelemetryDeck keeps them for as long as we use its service.

The speech models are downloaded from Hugging Face (huggingface.co), and from the mirror hf-mirror.com when Hugging Face can't be reached. Like any website, these see your IP address. The app sends them no identifiers.

Your settings, your test dictations in Settings (at most 10, each deletable) and the speech models stay on your iPhone. Your settings are included in your own iPhone backups; your test dictations and the models never are. Deleting the app deletes all of it.

• Transcribing your dictations and checking your subscription: to provide the service you asked for (GDPR article 6.1 b).
• Fair use, abuse limits and the technical log: our legitimate interest in a reliable, fair service (article 6.1 f).
• Usage statistics: your consent, given in setup (article 6.1 a). You can withdraw it any time in WhispAway's Settings, under Privacy.

You can ask for a copy of the data we hold about you, have it corrected or deleted, or object to its use. We hold no name or email, so to find your subscription we'll ask for the order ID from Apple's receipt.

You can also complain to Integritetsskyddsmyndigheten (IMY), Sweden's data protection authority, at imy.se.

whispaway.app is served from our own servers in Sweden. Our relay in Helsinki, Finland, passes the encrypted connection through without decrypting it. A security log keeps each visit's IP address, time and result for up to 7 days, in memory only, never on disk or in backups. The site sets no cookies and loads nothing from other companies. If you pick light or dark, your browser remembers the choice; it's never sent to us.

WhispAway isn't directed at children, and we don't knowingly collect data about them.

We'll update this page when what we do changes, and say so in the app if the change matters to you.