Privacy

Privacy Policy

Under the Swiss revDSG and the GDPR (for customers in the EU). Last updated: July 2026.

1. Data controller

Joshua Böhme, Poststrasse 4, 9443 Widnau, Switzerland. Email: support@diktavo.com.

2. Principle: local processing

Diktavo's speech recognition runs entirely on the user's device. Audio recordings themselves are never transmitted to us or to any third party and stay exclusively on the user's PC; the conversion of speech to text takes place exclusively locally. The text produced by a dictation likewise stays local, unless the user is signed in with a user account: in that case the app transmits the dictation history to synchronize it between the devices of the same account (see Section 3, "History synchronization"). Also excluded from local processing are the other connections listed in Section 3 (in particular license verification, the user account, and optional services); apart from the dictation history mentioned above, none of these transmit audio recordings or recognized text. A further exception is feedback the user actively sends themselves if they attach a screenshot to it: depending on its content, that screenshot may also show dictated text.

3. What data we process

• License verification: On activation and at regular checks, the app transmits the email address, license key, and a pseudonymous device identifier (a hash derived from hardware characteristics, not a plain name) to our license server (Cloudflare). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• User account: On registration and sign-in we process the email address, a password hash (never the plaintext password), session data for signed-in devices (device name and pseudonymous device identifier), and, if enabled, the two-factor setting. When signing in via Google, we receive the email address from Google. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Account settings: So that Diktavo behaves the same way across several devices of the same account, we store operating settings such as keyboard shortcuts, language selection, paste behavior, and sound and theme choices. Not transmitted are the performance metrics measured on the respective device. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• History synchronization: If the user is signed in, the app transmits the dictation history (the dictated text) and usage statistics to our server shortly after each dictation, so that the history is available on all devices of the same account. Transmission is encrypted (TLS); storage takes place server-side, not end-to-end encrypted. The transmitted text is processed exclusively for this purpose and is not shared with third parties. Synchronization is tied to being signed in to the account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Dictionary synchronization: If the user is signed in, the app synchronizes the personal dictionary (custom replacements, learned terms, blocked words) between the devices of the same account. Transmission is encrypted (TLS); storage takes place server-side, not end-to-end encrypted. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Word count (usage volume): For signed-in users we transmit the number of dictated words (only the count, never the dictated text itself), to determine and enforce the scope of the free plan (3,000 words per week) or Pro access. This happens independently of leaderboard participation. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Leaderboard (optional): If the user additionally opts into the leaderboard, we make their word count publicly visible under a self-chosen display name and, optionally, their country. Dictated text is never transmitted for this purpose. Participation can be switched off at any time in the settings; the word count is then no longer shown publicly but continues to be counted for usage determination. Legal basis: consent (Art. 6(1)(a) GDPR).
• Feedback (optional, signed-in users only): If the user sends feedback from within the app, we transmit the text they entered, the app version, the configured language, and, if they choose to attach them in the dialog, up to three screenshots. An email address is only transmitted if the user enters it themselves in the field provided for that purpose.
  The content is already encrypted on the user's device and is readable only by the operator. It is held encrypted at Cloudflare until the operator retrieves it, for at most twelve months, after which it is automatically deleted. After retrieval, the feedback is held exclusively locally by the operator. Screenshots are re-encoded before being sent, which strips metadata such as location information. Legal basis: consent (Art. 6(1)(a) GDPR).
• IP addresses: We process IP addresses briefly for rate limiting and abuse prevention; they are always hashed with a secret server key and are never stored in plaintext or shown in responses or persistent logs. Legal basis: legitimate interest in preventing abuse (Art. 6(1)(f) GDPR / Art. 31 revFADP).
• Purchase/payment: Handled by our merchant of record, Polar Software Inc., which processes billing and payment data as an independent controller.
• Website: Cookieless traffic measurement (Cloudflare Web Analytics), no cookies, no personal profiling, no IP storage. Legal basis: legitimate interest in traffic measurement (Art. 6(1)(f) GDPR / Art. 31 revFADP).

4. Disclosure / processors

Data processors (under a data processing agreement per Art. 28 GDPR): Cloudflare, Inc. (license infrastructure, downloads, website). Independent controller: Polar Software Inc. (purchase/payment/billing); its privacy notices additionally apply in that respect. Insofar as data is transferred to the United States (Cloudflare, Polar), this takes place on the basis of the EU Standard Contractual Clauses or a valid adequacy mechanism.

5. Retention period

License data for the duration of the contractual relationship plus statutory retention periods. Account, settings, and leaderboard data for the duration of the account; once the account is deleted, this data is removed, including any feedback not yet retrieved by the operator. Feedback is retained for up to twelve months after being handled, to help identify recurring issues; screenshots attached to it are deleted after three months.

6. Your rights

Access, rectification, erasure, restriction, objection, withdrawal of consent, and data portability. Requests to support@diktavo.com. Customers in the EU also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible.