What stays on your Mac, and the little that doesn't

This policy describes what the HandsFree macOS app and this website actually do with your data. It is written to match the software's behaviour, not to cover every hypothetical — if the app changes, this page changes with it.

Audio and transcripts never leave your device

Speech-to-text runs entirely on your Mac, using whisper.cpp with Metal acceleration on Apple silicon. There is no transcription service behind HandsFree and no endpoint that accepts audio. Concretely:

• Microphone audio is held in memory only while you are dictating, is fed to the local model, and is discarded. It is not written to disk as an audio file and it is not uploaded.
• The transcript — before cleanup and after — is produced on your Mac and inserted into the app you're focused on. It is not transmitted to us in any form, including in aggregate, hashed, sampled, or "anonymised" form.
• The transcription model is downloaded once from a public model host and then lives in ~/Library/Application Support/HandsFree/models/. That download contains no data about you.

What is stored locally on your Mac

These things are on your machine only. We cannot read them, and there is no sync service or cloud backup for them.

Because history is stored as readable text on your Mac, treat it like any other document: anyone with access to your user account could read it. If you dictate sensitive material, consider turning history off or shortening its retention window.

What we collect, and why

We collect the minimum needed to run accounts and meter a free trial.

Your email address

You sign in with a six-digit code emailed to you — there are no passwords. We store your email address to identify your account, deliver those codes, and send transactional messages about your subscription — chiefly your subscription key, and any reply about a payment you told us about. We do not send marketing email, and we do not sell, rent, or share your address with anyone for their own purposes.

A word count. Not words.

The free trial is 2,000 words, and that has to be counted somewhere trustworthy, so it's counted on our server. After a dictation is inserted, the app sends a small record containing:

• the number of words in that dictation,
• which of your devices it came from,
• a random event identifier so a retried send isn't counted twice, and
• a timestamp.

There is no field in that record for text, and no truncated sample, subject line, or first-few-words preview. The transcript is not part of the request. That's enforced by an automated test in the app's test suite, precisely so it can't quietly regress.

If your Mac is offline, these counts queue locally and are sent when you reconnect. They contribute only to your own trial balance.

Subscription state

For your account we store: the date your subscription expires, the number of trial words used, any extra word allowance you've been granted, and a record of which subscription keys you have redeemed and when. Your subscription status isn't stored as a separate field at all — it is simply derived from that expiry date. We also record which of your devices have signed in, with a label and a last-seen timestamp, to enforce the three-device limit.

Subscription keys themselves are stored only as a hash, alongside a four-character prefix and a short free-text note that lets us reconcile a key against the payment it was issued for. That note contains whatever we needed in order to match your payment — typically your email address and a transaction reference you sent us.

What we deliberately don't collect

• No analytics or product-telemetry SDK in the app.
• No crash-reporting service.
• No record of which apps you dictate into.
• No advertising identifiers, no tracking pixels, no third-party cookies.
• Nothing on this website. These pages are static HTML and CSS with no scripts, no fonts loaded from elsewhere, no analytics, and no requests to any other host. Visiting this page tells us nothing beyond what our host records to serve the file.

If you enable the optional AI polish

HandsFree can optionally run your transcript through a large language model to smooth tone or reformat it. This is off by default, and it's bring-your-own-key: we don't resell inference and no AI usage is included in the subscription.

Be clear-eyed about what this means when you switch it on:

• If you configure a cloud provider (Anthropic or OpenAI) with your own API key, then your transcript text is sent to that provider, from your Mac, directly. It does not pass through our servers, and we never see it — but the provider does, and their privacy policy and data-retention terms govern it, not ours. Check them if the content is sensitive.
• If you point it at a local model served by Ollama or LM Studio on your own machine or network, the text goes only there.
• The "Offline only" switch hard-disables all of this. With it on, no transcript text can be sent to any provider, regardless of what else is configured.
• Your API keys are stored in your macOS Keychain, are sent only to the provider they belong to, and are never transmitted to us.

Payments

No card details are handled at any stage. Not by us, and not by a payment processor acting for us, because there is no card payment and no processor. There is no checkout page anywhere — not on this website and not in the app — so there is no point at which a card number, expiry date, or security code could be entered, transmitted, or stored. This is a stronger privacy position than the usual "your card goes to our processor, not to us", and it's worth stating plainly.

Payment is arranged directly instead: you send the money by crypto, bank transfer, or UPI, email us a reference, and we email back a one-time subscription key that you redeem in the app. See how to pay.

What that means we actually receive:

• Whatever you choose to send us. Typically a transaction hash, a UPI or bank reference number, or a screenshot of a confirmation, in an email from your account address. We don't ask for more than is needed to identify the payment, and we can't collect anything you don't send.
• Whatever your own payment method reveals to us. A bank transfer typically shows us the sending account name; a UPI payment shows the payer name and reference; a crypto transfer shows a sending address on a public ledger. That is a consequence of the method you pick, and picking a different one changes it — which is part of why several are offered.
• The record of the key we issued you. Held as described under subscription state, above.

Note the flip side honestly: crypto ledgers are public and permanent, so a payment you make from an address associated with your identity is associated with this purchase for as long as that ledger exists. We neither control nor benefit from that, but you should know it before choosing a method.

Who else touches your data

That's the complete list, and it is one entry shorter than it used to be: there is no payment processor, because payment never passes through this software. None of these providers receive your audio or your transcripts either, because those never leave your Mac in the first place.

Your own bank, exchange, or wallet provider obviously sees the payment you make with it, and is not acting for us when it does — your relationship with them, and their privacy policy, governs that.

How long we keep things

• Account record and word counts — for as long as your account exists.
• Payment records — the email in which you sent us a payment reference, and our record of the key we issued for it, are kept as accounting records. Tax law may require us to keep them even after you delete your account, so they are the one thing that can outlive it.
• Dictation history — entirely up to you; it's on your Mac and follows the retention setting you choose.

Deleting your account

You can delete your account from Settings in the app, or by emailing support@handsfree.app from the address on the account.

Deleting the account erases, from our systems:

• your account record and email address,
• your trial word count and every usage record,
• your device records, and
• your subscription state, including your expiry date — which ends any active subscription. There is nothing to cancel and no payment method to remove, because none was ever stored.

What it does not touch is anything on your Mac: your dictation history, dictionary, shortcuts, and downloaded model stay where they are, because we have no way to reach them. To remove those, delete the app and its folder at ~/Library/Application Support/HandsFree/.

Some transaction records may be retained where tax or accounting law requires it, as noted above. Deletion is not reversible, and a deleted account's trial allowance does not come back if you sign up again with the same address.

Your rights

Depending on where you live, you may have the right to access, correct, export, or erase the personal data we hold, to object to processing, or to complain to a data-protection authority. Given how little we hold — an email address, a word count, and subscription state — access and erasure requests are straightforward. Email support@handsfree.app from the address on the account and we'll respond within 30 days.

We process your email address and usage counts because they're necessary to provide the service you asked for and to meter the free trial fairly.

Children

HandsFree isn't directed at children under 13, and we don't knowingly collect their data. If you believe a child has created an account, email us and we'll delete it.

Changes to this policy

If we change what we collect, we'll update this page and its "last updated" date, and — for anything that materially affects you — email account holders. We won't start collecting a new category of data quietly.

Contact

Questions about privacy: support@handsfree.app.