Privacy Policy for WalkAITalkie

Last updated: 2026-10-04

1. Data Controller

Bernhard Götzendorfer
Rittingergasse 15/11
1210 Wien, Österreich (Austria)
Email: office@gotzendorfer.at

2. Overview

WalkAITalkie is designed with privacy as a core principle. By default, all speech recognition and text processing happens entirely on your device using Apple Silicon. No audio, transcriptions, or personal data are transmitted to any server. The app has no user accounts and no sign-in, and it does not accept API keys for cloud providers.

One optional extra leaves the Mac, and only after you turn it on: the cloud accelerator in the direct download (Pro, Section 6), which hands text to the Codex CLI or the Claude Code CLI you are signed in to under your own account. It sends text only, never audio. The Mac App Store version does not contain it. Everything else stays on your device.

This policy covers two distinct surfaces. Sections 3 to 7 describe the app (the macOS application). Section 8b describes the website (walkaitalkie.com), which is measured with a cookieless analytics service. Where a statement applies to only one of the two, it says so.

3. Data We Do NOT Collect (On-Device Mode)

• No audio recordings are uploaded or stored remotely
• No transcriptions are transmitted to any server
• No personal information (name, phone) is required or collected in on-device mode. There is no account to create; an email address is only processed if you buy a licence directly from us (see Section 5b).
• The app collects no usage analytics, tracking, or telemetry data
• The app uses no cookies or similar tracking technologies. The website walkaitalkie.com is measured without cookies as well — see Section 8b
• No advertising identifiers are accessed

4. Data Processing On Your Device

WalkAITalkie processes the following data exclusively on your Mac:

• Audio input: Captured from your microphone during push-to-talk sessions, processed in real-time by WhisperKit or Parakeet (your chosen STT engine), and immediately discarded after transcription
• Transcription text: Stored locally in your transcription history (on your Mac only), accessible and deletable at any time through the app
• App settings: Stored locally via macOS UserDefaults

5. Network Activity

WalkAITalkie has minimal network activity, limited to:

• AI Model Downloads: Speech recognition models (WhisperKit or Parakeet) and language models (MLX) are downloaded from Hugging Face CDN when you first select them in Settings. These are one-time downloads.
• Update Checks (non-App Store version only): The Sparkle framework periodically checks for app updates via our update server (hosted on Vercel). No personal data is sent. This can be disabled in Settings.
• App Store version: Uses Apple's built-in update mechanism. No additional network activity.

5b. Licence Validation

WalkAITalkie has no user accounts, no sign-in and no server-side profile. The only identity-related processing is the validation of a Pro licence:

• Mac App Store purchase: Validated by Apple through your Apple ID. Nothing is sent to us.
• Direct purchase (licence key): When you enter your licence key, the app sends the key and a randomly generated device identifier to our licensing server to activate the device and to revalidate the licence at most once every 7 days. No hardware identifiers are used and no content of your dictations is involved.
• Email address (direct purchase only): Stripe collects your email at checkout so that we can deliver the licence key and handle warranty, withdrawal and refund requests. It is never shared with third parties and never used for marketing.
• Withdrawal via “Withdraw from contract”: If you declare your withdrawal with this function, we store your name, your email address, the licence key or receipt number you entered, the selected language and the date and time of receipt. We use this data to confirm receipt, to process your declaration and to be able to prove it. We send the confirmation of receipt by email through our email delivery provider; it does not contain your entries.

Connections to our licensing server use SPKI-based certificate pinning. Removing the app from your Mac deletes the locally stored licence data; you can request deletion of the purchase record subject to the retention periods in Section 9 (see Section 12).

6. Cloud Accelerator (Optional — Pro, Direct Download Only)

Session notes are summarised on your Mac by default. If you are already signed in to the Codex CLI (OpenAI's command-line tool) or the Claude Code CLI (Anthropic's command-line tool), you can let WalkAITalkie hand the text to that tool instead, which is considerably faster. The processing runs under a contract between you and the provider, not between us and the provider:

• What is sent: the finished transcript of a session recording, and the description you type when you create a custom format with the format assistant. Nothing else.
• Text only: your audio and the recording itself never leave your Mac. Speech recognition and dictation always run on your device.
• Off by default: nothing is handed over until you choose a provider in Settings and confirm it once. Consent is given per provider. The other provider is only used as a fallback if you are signed in to it and have confirmed it as well; the app then shows which provider actually received the text. You can switch the accelerator off again at any time.
• Your account, your quota: the request runs under the ChatGPT or Claude account you are already signed in to in that tool on this Mac, over that account's credentials, and counts against your plan with that provider. We have no account with the provider in this path, there is no WalkAITalkie server in between, we see nothing, and we store nothing.
• Direct download only: the Mac App Store build does not contain this feature at all — the code is excluded at compile time, so there is nothing to enable there, and that build has no cloud processing.
• Declining costs you nothing: without the accelerator the summary is still written on your Mac, it just takes longer.

What the provider does with the text is governed by the terms of your account with it and by its privacy policy (OpenAI Privacy Policy, Anthropic Privacy Policy). We are not a party to that processing and cannot act on your behalf in it.

7. Legal Basis (GDPR Art. 6)

• On-device processing: Does not constitute data processing under GDPR as no personal data leaves your device
• Model downloads: Art. 6(1)(b) — necessary for the performance of the software (downloading the models you selected)
• Update checks: Art. 6(1)(f) — legitimate interest in providing security updates and bug fixes
• Licence validation & email for direct purchases: Art. 6(1)(b) — necessary for the performance of the contract (activating the licence on your devices and delivering the licence key)
• Cloud accelerator (direct download only): Art. 6(1)(a) — explicit consent, given separately for each provider via the in-app confirmation, before any text is handed to the Codex CLI or the Claude Code CLI. Withdrawing consent (switching the accelerator off) is possible at any time and takes effect immediately; it does not affect the lawfulness of processing carried out before the withdrawal
• Withdrawal via “Withdraw from contract”: Art. 6(1)(c) (compliance with our legal obligation to confirm receipt, § 13a FAGG) and Art. 6(1)(f) (legitimate interest in being able to prove receipt of your declaration)

8. Third-Party Services

The app does not integrate any third-party analytics, advertising, or tracking services (for the website, see Section 8b). The only third-party network connections made by the app are:

• Hugging Face (huggingface.co): CDN for downloading AI models. Subject to Hugging Face Privacy Policy
• Vercel (vercel.com): Hosts the update feed for the Sparkle update framework (non-App Store version). Subject to Vercel Privacy Policy
• OpenAI via the Codex CLI (direct download only, not in the Mac App Store build): text summarisation for the cloud accelerator, only when you enable it and only through your own ChatGPT account — see Section 6. Subject to the OpenAI Privacy Policy and to the terms of your ChatGPT plan
• Anthropic via the Claude Code CLI (direct download only, not in the Mac App Store build): text summarisation for the cloud accelerator, only when you enable it and only through your own Claude account — see Section 6. Subject to the Anthropic Privacy Policy and to the terms of your Claude plan

8b. Website Analytics (walkaitalkie.com)

This section applies to the website only, not to the app. We use Vercel Analytics (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA) to measure aggregate reach — how many people visit which pages.

• No cookies: Vercel Analytics sets no cookies and stores no identifiers on your device. It does not track you across websites or sessions.
• No personal profiles: Page views are aggregated. A short-lived, non-reversible hash derived from request data is used to approximate visitor counts and is discarded; we cannot identify you or build a profile from it.
• Data collected: page URL, referrer, approximate country, device type, and browser type.
• Click events: besides page views we record a small, fixed set of non-personal click events — a click on a download button, a click on the Pro button, and a click on the Mac App Store link. Each event carries only a fixed label such as “hero” or “stripe” that says which button was used. Nothing you type, no e-mail address and no identifier is attached, and these events set no cookie either.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding aggregate reach and in operating the website reliably. Because no information is stored on or read from your device, no consent under § 165 TKG 2021 / the ePrivacy Directive is required.
• Processor: Vercel Inc. acts as our processor under a data processing agreement (Art. 28 GDPR); transfers to the USA are covered by the EU Standard Contractual Clauses. Retention follows Vercel's published retention period for Web Analytics data. See the Vercel Privacy Policy.
• Objection: You may object to this processing at any time under Art. 21 GDPR by emailing office@gotzendorfer.at. A browser-level tracking blocker also prevents the measurement script from loading.

9. Data Retention

• All transcription data is stored locally on your Mac and can be deleted at any time through the app's History tab
• On-device mode: No data is retained on any server because no data is transmitted to any server
• Cloud accelerator (direct download only): Text is handed to the provider through the CLI on your Mac. We do not see or store any of your content. Retention is governed by the provider's policy and the terms of your account with it.
• Licence activation records: For direct purchases we retain the licence key, the device identifiers it is activated on, and the timestamp of the last validation for as long as the licence is in use.
• Purchase records (direct purchases): Your email address and the payment record are retained for the statutory Austrian bookkeeping period of 7 years (§ 132 BAO). Data not subject to that obligation is deleted within 30 days of your request (see Section 12).
• Withdrawal declarations: We store the data from a withdrawal declaration made with “Withdraw from contract” for three years from receipt. An erasure request made before this period ends is fulfilled for this data only once the three years have passed, so that we can prove receipt of your declaration.

10. International Data Transfers

In on-device mode, no personal data leaves your device, so no international transfer occurs. When you enable the cloud accelerator (Section 6), text may be transferred to the provider you chose:

• OpenAI, Inc. (San Francisco, USA) — participant in the EU–U.S. Data Privacy Framework (DPF). Adequacy decision by the European Commission (July 10, 2023).
• Anthropic, PBC (San Francisco, USA) — participant in the EU–U.S. Data Privacy Framework (DPF). Transfers are additionally covered by Standard Contractual Clauses (SCCs) where applicable.

Cloud accelerator requests are sent by the Codex CLI or the Claude Code CLI on your Mac under your own ChatGPT or Claude account; they do not pass through any server of ours. Our licensing server is hosted in the EU (Hetzner, Falkenstein, Germany) and processes licence keys only.

11. Processors (Art. 28 GDPR)

We do not operate any inference or relay service, so no dictation content is ever processed on our behalf. The processors we do engage are:

• Stripe — payment processing and checkout email for direct purchases.
• Our licensing server (hosted at Hetzner, Falkenstein, Germany) — licence key activation and revalidation.
• Vercel — website hosting, the Sparkle update feed, and website analytics (see Section 8b).

If you use the cloud accelerator, the provider is not our processor — OpenAI or Anthropic acts under your own ChatGPT or Claude account and your contract with it, not on our instructions.

12. Your Rights (GDPR Art. 15–21)

Under the General Data Protection Regulation, you have the right to:

• Access (Art. 15): Request information about your personal data. In on-device mode no personal data is stored on our servers. If you bought a licence directly from us, you can request a copy of your purchase record and licence activation data.
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Delete your data — you can clear all local transcription history in the app. For licence and purchase records, email us at office@gotzendorfer.at and we will delete your records within 30 days, subject to legal retention obligations and the retention of withdrawal declarations under Section 9.
• Restriction (Art. 18): Restrict processing of your data
• Portability (Art. 20): Export your data — available via the History tab's export function (CSV/JSON)
• Objection (Art. 21): Object at any time to processing based on our legitimate interests (Art. 6(1)(f)) — in particular to website analytics (Section 8b) and update checks

To exercise any of these rights, contact us at office@gotzendorfer.at.

13. Children's Privacy

WalkAITalkie does not knowingly collect data from children under 16. The app requires no registration; the only personal data we receive is the email address supplied when buying a licence directly, and that purchase is not directed at children. If we become aware that we hold data of a child under 16, we will promptly delete it.

14. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated “Last updated” date.

15. Contact

For any questions about this privacy policy, please contact:
Email: office@gotzendorfer.at

16. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Wien, Österreich
Website: https://www.dsb.gv.at