Privacy
Clear limits on your data
Last updated: 5 September 2026Deutsche Fassung
1. Controller
Ihor Skakovskyi, Ostrovského 26, 150 00 Praha 5, Czech Republic
IČO 17328691
E-mail: hallo@witnessmac.com
Telephone: +420 607 643 905
No data protection officer has been appointed; the legal conditions for one are not met by a sole trader of this size doing this processing. The address above handles everything to do with data protection.
2. The short version
Nothing you dictate leaves your Mac. Not the audio, not the transcript, not the processed text, not your vocabulary, not the names of the applications you dictate into, and nothing derived from any of them. There is no product account, no sign-in and no analytics software — neither in the app nor on this website.
Three things can leave the app, and each of them only after you press something. They are in section 4.
3. What stays on your Mac
Speech recognition runs in the app, against a model on your disk. Audio is held in memory for the length of one utterance and discarded when the next begins or when you close the review. It is never written to disk.
Your vocabulary, the risk markings, the text processing and the review view are local computation over local text. There is no network code in them.
Removing the app leaves no archive of audio or transcripts behind, because none is ever created.
4. What the app transmits — in full
| What | When | To whom | Why |
|---|---|---|---|
| A request for the speech model | You press “Prepare speech model…” | Hugging Face, the model's host | Fetching a static file. One way — nothing is uploaded |
| Your e-mail address and a device identifier | You press “Send me a key” | Our activation service at api.witnessmac.com | Issuing a licence key for this Mac |
| A licence key you already hold | You press “Remove from this Mac” | The same service | Freeing one of the two Macs your licence covers |
That is the complete list. There is no fourth row. The activation request has exactly two fields — email and device — and an automated test fails the moment a third is added. That is how this page stays true.
The device identifier is a salted SHA-256 of your Mac's hardware identifier, truncated to 128 bits. It cannot be turned back into a serial number, it applies only to this app, and it matches nothing outside it. It exists so that a licence covers two Macs rather than any number of them.
The connection is HTTPS. An endpoint without encryption makes the app report itself as unconfigured rather than send an address in the clear, and no build has a setting that relaxes that.
The declaration you make in the app before a checkout opens — that the key be delivered immediately, and that this gives up the right of withdrawal — is not transmitted. It is recorded in the local system log on your Mac and nowhere else.
5. The activation service
Purpose: to issue a licence key, mail it to you, recognise you when you activate a second Mac or replace one, and enforce the two-device limit.
Legal basis: Art. 6(1)(b) GDPR — performance of the contract for the trial or the licence. For keeping the payment provider's order identifier, additionally Art. 6(1)(c) GDPR, because tax retention duties attach to it. For the counter keyed to an IP address, Art. 6(1)(f) GDPR; our legitimate interest is protecting the service against automated abuse.
Processor: the service runs on Cloudflare Workers, and the licence table is a Cloudflare D1 database in Cloudflare's EEUR (Eastern Europe) region. Cloudflare runs the code and stores the table; it receives the data for no purpose of its own.
What is stored — this is the whole table:
| Stored | What for | How long |
|---|---|---|
| Your e-mail address, lowercased | Identifies the licence | For the life of the licence |
| The device identifier | The two-Mac limit | For the life of the licence, or until you release the Mac |
| Kind, issue date, expiry, key id | What was issued | For the life of the licence |
| The payment provider's order id | Reconciling a payment, and invoices | As long as tax law requires |
| Your IP address, as a counter | Rate limiting, against abuse | 24 hours, as a count and not as a log |
| Provider identifiers for your purchase | Matching a later renewal or refund to your licence rather than to somebody else's | For the life of the licence |
The licence key itself is not stored. It is reproduced from the fields above when you ask for it again — which is also why asking twice gives you the same key rather than a second one.
6. Payment
The checkout runs at Stripe, which acts as merchant of record in its own name on this sale and issues the invoice. Stripe is an independent controller for the payment processing; Stripe's own privacy policy applies.
The app opens no payment page of its own and sees no card details: the buy buttons hand a URL to your browser. To our activation service, Stripe passes the address you bought with and identifiers for the order. The legal basis is Art. 6(1)(b) GDPR.
7. E-mail
Licence keys are sent through Resend as a processor; the technical delivery runs over Amazon SES in the eu-west-1 (Ireland) region. The sender address is keys@witnessmac.com. These mails are contractual communication under Art. 6(1)(b) GDPR. Marketing to an address collected here would need its own, separately obtained consent; we send none.
Incoming mail to hallo@, keys@ and dmarc@ is received by Cloudflare Email Routing and forwarded to a private mailbox of the provider at Google (Gmail). If you write to us, we process your message and your address in order to answer it (Art. 6(1)(b) or (f) GDPR) and keep the exchange as long as it is needed for follow-up questions or legal duties.
8. This website
The website loads no analytics, advertising or tracking scripts, sets no cookies, and embeds no fonts, maps, videos or other content from third-party servers. There is therefore no consent banner either: there would be nothing to consent to.
It is served by Cloudflare (processor). When you load a page, the infrastructure processes the technically necessary connection data — IP address, time, requested address, amount of data transferred, status code and user agent — in order to deliver the page and keep the service safe from attack. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and functioning operation of the website. This connection data is not combined into profiles and not linked with other data.
9. The form on /danke
The form is optional. The download and the installation guide work without it. It transmits exactly three things: your e-mail address, the language of the page, and, if you pick one, a coded answer about where you dictate most. It sends no audio, no transcript, no vocabulary, no clipboard and no content from other applications.
The purpose is sending your licence key and the setup help that goes with it; the legal basis is Art. 6(1)(b) GDPR for the pre-contractual step you trigger by submitting. The optional answer about your area of use is processed on the basis of your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future. The entries are deleted once the key has been sent and no question is left open.
The recipient is the activation service described in section 5; there are no other recipients, and nothing is passed to third parties for advertising. If no recipient is configured, the form sends nothing and says so — then you ask for the key in the app.
10. The speech model
When you press “Prepare speech model…”, the app fetches the model from the public repository argmaxinc/whisperkit-coreml at Hugging Face. Hugging Face thereby learns the technical connection data of that request, in particular your IP address. Nothing is uploaded, and the request contains nothing about who you are. The legal basis is Art. 6(1)(b) GDPR, because there is no recognition without a model. Hugging Face's own privacy policy applies to that fetch.
11. No telemetry
The app builds ten events about the licensing journey — installed, trial started, key requested and so on — carrying the app version, the major macOS version and a random identifier created at install. None of them is transmitted. They are written to the local system log and stay there.
The type they are built from has no free-text field anywhere, so there is nothing a transcript could end up in even by accident. If that ever changes, it changes with consent asked for in the app and with a new row in the table in section 4 — not quietly.
We collect no crash reports. macOS may offer to send Apple a report; that is between you and Apple, and this app neither reads it nor asks for it.
12. No automated decision-making
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
13. Transfers to third countries
Cloudflare, Stripe, Resend, Amazon Web Services, Hugging Face and Google are companies established in, or with a parent company in, the United States. Even where the data is stored in the EU — for us, the licence table in Cloudflare's Eastern Europe region and mail delivery through Ireland — access from a third country cannot be ruled out. We base such transfers on the European Commission's standard contractual clauses and, where the provider concerned is certified under it, on the adequacy decision for the EU-US Data Privacy Framework.
14. Your rights
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
An e-mail to hallo@witnessmac.com is enough. There is no form and no account you would have to sign into for it.
Erasure, and what it means: on request, your record in the activation service is deleted; only an anonymised order row is kept where an invoice requires it. The consequence matters, because it cannot be undone: no further key can be issued for that address, so a Mac you later replace cannot be activated. Keys already on your Macs keep working — they are verified on the Mac, against a signature, with no connection.
15. Right to complain
You can complain to a data protection supervisory authority. The one responsible for us is the Czech Office for Personal Data Protection, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You can also go to the authority where you live or work.
16. Whether you have to provide anything
You are not obliged to give us data. Without an e-mail address, however, no trial or licence key can be issued and delivered, because the licence is bound to that address; without a device identifier, the two-Mac limit could not be enforced.
17. Children
The product is not directed at children and asks nothing about age.
18. Changes to this policy
The table in section 4 is the promise. If a future version sends something that is not in it, this policy is changed before that version is published — and the app's request stays exactly as wide as this policy reaches.
What that means for the contract is in the Terms and Licence.