Privacy

Clear limits on your data

Last updated: 21 October 2026Deutsche Fassung

1. Controller

Ihor Skakovskyi, Ostrovského 26, 150 00 Praha 5, Czech Republic
IČO 17328691
E-mail: hallo@witnessmac.com
Telephone: +420 607 643 905

No data protection officer has been appointed; the legal conditions for one are not met by a sole trader of this size doing this processing. The address above handles everything to do with data protection.

2. The short version

Nothing you dictate leaves your Mac. Not the audio, not the transcript, not the processed text, not your vocabulary, not the names of the applications you dictate into, and nothing derived from any of them. There is no product account, no sign-in and no analytics software in the app.

This website is a different matter, and the two are placed side by side deliberately. This product's promise is about the app on your Mac, not about this page: it is a sales page, we pay for people to find it, and a sales page may measure who visits it. What this page actually does today is in section 8.

The app also asks GitHub once a day whether a newer version exists (you can switch that off in Settings), and does so when you press “Check for updates”; it downloads an update only after you choose to install it. The complete list is in section 4.

3. What stays on your Mac

Speech recognition runs in the app, against a model on your disk. Audio is held in memory for the length of one utterance and discarded when the next begins or when you close the review. It is never written to disk.

Your vocabulary, the risk markings, the text processing and the review view are local computation over local text. There is no network code in them.

Removing the app leaves no archive of audio or transcripts behind, because none is ever created.

4. What the app transmits — in full

That is the complete list. The activation request has exactly two fields — email and device — and an automated test fails the moment a third is added. Update requests send no audio, dictated text, vocabulary, licence key, e-mail address or app content. Automatic installation and Sparkle system profiling are disabled. The daily check is on by default and can be switched off in Settings.

Update request retention: we do not receive or store GitHub's request logs. GitHub may retain IP addresses and request metadata under its privacy statement; it does not publish a fixed retention period for these requests. Sparkle stores its local update state on your Mac until you remove the app's preferences.

The device identifier is a salted SHA-256 of your Mac's hardware identifier, truncated to 128 bits. It cannot be turned back into a serial number, it applies only to this app, and it matches nothing outside it. It exists so that a licence covers two Macs rather than any number of them.

The connection is HTTPS. An endpoint without encryption makes the app report itself as unconfigured rather than send an address in the clear, and no build has a setting that relaxes that.

The declaration you make in the app before a checkout opens — that the key be delivered immediately, and that this gives up the right of withdrawal — is not transmitted. It is recorded in the local system log on your Mac and nowhere else.

4a. The nine product events, field by field

Witness builds fifteen events about setup and the licensing funnel. Nine of them are sent: installed, model_download_started, model_ready, model_failed, dictation_blocked_by_model, microphone_denied, trial_started, activation_requested and paywall_shown. The other six are written to the local system log on your Mac and go nowhere.

Each message is exactly this, and nothing else:

{"app_version":"0.4.0","event":"trial_started","install_id":"<a random UUID>","system_version":"15.0"}

Three events carry one more field, qualifier, whose value comes from a fixed list of words of its own. For paywall_shown it is one of four reasons the prices were shown. For model_ready it is one of four time buckets (underOneMinute, underFiveMinutes, underFifteenMinutes, overFifteenMinutes) and never a number of seconds. For model_failed it is network, storage or other, with no file name, path or system message. There is no sixth field, and an automated test fails if one is added without this page naming it.

• install_id is a random value created once, when you install the app. It is derived from nothing, not from this Mac, not from you, not from your licence, so it cannot be joined to the device identifier above, to your e-mail address, or to anything outside this product. The same identifier is the only identifier these events carry in PostHog (section 5), so that installations can be counted and not only events. It is not your licence’s identifier.
• app_version and system_version are what they say. The macOS version is major and minor only, because a rare build number is an identifier.
• event and qualifier are drawn from fixed lists in the app, and the service refuses anything outside them. Nothing you dictate is in this and nothing could be: there are five fields and none of them can hold a word you said.

The six setup events are sent at most once per installation. The model is loaded at every launch and the microphone is read again every time the app comes forward. An event each time would not be a step in a funnel but a record of when this Mac opens Witness. So the app remembers the names of the ones it has already sent, in license.json under ~/Library/Application Support/Witness/, a readable file, and sends nothing the second time.

Turning it off: Settings → Privacy, one switch, which is on when you install the app. Off means none of the nine is sent, and nothing else about the app changes, neither the trial nor dictation nor the licence.

Two of them can happen before you have read that sentence. installed is sent when the app first starts, and model_download_started when it begins fetching the speech model at that same launch. The first-run screen carries the sentence about the switch and appears in the same first minute, behind the language question, but beside those two events and not before them. The other seven follow something you did. If that is not a trade you want, the switch turns all nine off.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is knowing how many installations reach a first dictation and where people stop using a product we are asking them to pay for. A count that only included people who agreed would count only those who did not stop, which is why the switch is on when you install the app. The interest is weighed against an identifier that is deliberately unlinkable to you and a message that cannot carry content. You can object at any time with the switch above, with no consequence for the trial, the licence, or dictation.

Retention: 90 days, then the rows are deleted. No IP address is stored for these events. The retention periods in section 8 apply to the copy passed on to PostHog.

5. The activation service

Purpose: to issue a licence key, mail it to you, recognise you when you activate a second Mac or replace one, and enforce the two-device limit.

Legal basis: Art. 6(1)(b) GDPR — performance of the contract for the trial or the licence. For keeping the payment provider's order identifier, additionally Art. 6(1)(c) GDPR, because tax retention duties attach to it. For the counter keyed to an IP address, Art. 6(1)(f) GDPR; our legitimate interest is protecting the service against automated abuse.

Processor: the service runs on Cloudflare Workers, and the licence table is a Cloudflare D1 database in Cloudflare's EEUR (Eastern Europe) region. Cloudflare runs the code and stores the table; it receives the data for no purpose of its own.

What the service reports to PostHog: six facts about the business, each when it happens — a trial was issued, a licence was bought, a paid licence reached its first Mac, a licence renewed, a licence was refunded, a subscription was cancelled on the website. They go to the same PostHog project in PostHog's EU Cloud that measures this site (section 8), so trials and sales can be counted next to visits and downloads. Each event carries a random identifier the service creates for the licence, the kind of licence, the payment provider's name, whether a purchase was an upgrade or the introductory offer, and — for payments — the amount and currency. It carries no e-mail address, no device identifier and no IP address, and it creates no person profile in PostHog, so an event says that a licence was sold, not who bought it. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is knowing how many trials and sales there are over time. The events are deleted on the same terms as this site's PostHog events.

The service also passes the nine product events from section 4a on to this PostHog project, at the moment it accepts and stores them, so that the path from download to a first dictation can be seen next to this site's visits and downloads. Each carries the event name, the app's random install_id as its only identifier, the word in qualifier where there is one, and the app version and macOS major and minor version, which is only what the app already sends to the service. The install_id is not your licence's identifier and is not joined to it. No e-mail address, no device identifier, no licence identifier and no IP address is passed on, and PostHog creates no person profile. An event the service refuses, or drops for too many requests, is not passed on. If you switch product events off in the app, they reach neither the service nor PostHog. The legal basis is Art. 6(1)(f) GDPR; the deletion terms are those of the other PostHog events.

What is stored — this is the whole table:

The licence key itself is not stored. It is reproduced from the fields above when you ask for it again — which is also why asking twice gives you the same key rather than a second one.

6. Payment

The checkout runs at Stripe as payment service provider; we issue the invoice, through Stripe. Stripe is an independent controller for the payment processing; Stripe's own privacy policy applies.

The app opens no payment page of its own and sees no card details: the buy buttons hand a URL to your browser. To our activation service, Stripe passes the address you bought with and identifiers for the order. The legal basis is Art. 6(1)(b) GDPR.

Cancellation and subscription management. The “Cancel contracts here” form takes your e-mail address and passes it to our activation service, which uses it to end the subscription at Stripe at the end of the paid period and to e-mail you the confirmation. The address sits for at most 24 hours as a counter key in the limit against abuse. “Manage subscription” takes you to the sign-in page of Stripe's customer portal; there Stripe processes your data as an independent controller. The legal basis is Art. 6(1)(b) GDPR.

7. E-mail

Licence keys are sent through Resend as a processor; the technical delivery runs over Amazon SES in the eu-west-1 (Ireland) region. The sender address is keys@witnessmac.com. These mails are contractual communication under Art. 6(1)(b) GDPR. Marketing to an address collected here would need its own, separately obtained consent; we send none.

Incoming mail to hallo@, keys@ and dmarc@ is received by Cloudflare Email Routing and forwarded to a private mailbox of the provider at Google (Gmail). If you write to us, we process your message and your address in order to answer it (Art. 6(1)(b) or (f) GDPR) and keep the exchange as long as it is needed for follow-up questions or legal duties.

8. This website

This page uses Google Analytics 4 and the Google Ads conversion tag to measure which ad and which search term led to a visit and to a requested licence. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

With PostHog we also measure how this page is used: which page you arrived from, which sub-pages you open, which buttons and links you click, how far you read, and whether the download started. That answers where this page fails — not who you are.

The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, acting as a processor for us. The events are processed and stored in PostHog's EU Cloud in Frankfurt am Main. The requests do not go there directly but through witnessmac.com/ingest, and so through our own server: we pass on your IP address so that the country can be determined, but not this site's cookies. Session recording is switched off — no video of your visit and no recording of your mouse movements is created.

Without your consent these tools store nothing on your device and read nothing from it — the Product Hunt badge further down is the one exception, and it is described there. Measurement still happens, but without recognition: the Google tag sends a shortened IP address, the page viewed, device and browser, and the ad click identifier from the address bar. PostHog then runs with no storage on your device at all — the events of one visit hang together only for as long as the tab is open, and on your next visit you are an unknown person. What is reported is that the download page /danke was opened. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is knowing what we are paying for advertising for and where this page fails. You may object under Art. 21 GDPR.

With your consent Google Analytics, Google Ads and PostHog may additionally set and read cookies and connect your visits to one another; PostHog keeps its identifier under the name ph_…_posthog in your browser’s local storage and in a cookie of the same name. The legal basis is § 25(1) TDDDG for the storage on your device and Art. 6(1)(a) GDPR for the processing. Your decision sits in your browser's local storage under witness.consent; you can change it at any time through Cookie settings in the footer of every page, with effect for the future. Withdraw it and PostHog’s identifier is deleted, and measurement continues without storage.

What is not processed: anything from the app. No audio, no transcript, no vocabulary, none of the applications you dictate into. The app carries none of these tags, and the events in section 4a go to our own service and not to Google. The app never calls PostHog itself; the service passes the events on, as section 5 describes.

Retention: Google’s cookies expire after at most 24 months; in Google Analytics user and event data is deleted after 14 months; PostHog’s identifier expires after 12 months; the events in PostHog are deleted once they are no longer needed for that purpose, and at the latest when the project is closed — PostHog offers no automatic retention period to configure, and we will not state one here that we could not keep; on request we delete the events belonging to you, see section 13.

Third country: Google also processes data in the United States. This rests on the European Commission’s standard contractual clauses and on the adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified. PostHog stores this site’s events in the European Union; its parent company PostHog, Inc. is in the United States, and any transfer there rests on the European Commission’s standard contractual clauses. Access by US authorities cannot be ruled out.

One image from a third-party server: the trust strip on the home page carries the Product Hunt badge. It is not hosted by us but loaded from api.producthunt.com, so that the vote count on it is the current one. Your browser fetches it as the page loads; Product Hunt thereby learns the connection data of that request — IP address, time, browser, and the page it was requested from — and sets one Cloudflare cookie (__cf_bm, roughly half an hour) to fend off automated requests. The provider is Product Hunt, Inc. in the United States; their privacy policy applies, and access by authorities there cannot be ruled out. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show the product's rating where it was given. You may object under Art. 21 GDPR. The badge measures nothing, does not recognise you, and learns nothing about your visit beyond that single request.

A discount through a partner's link: if you open this site through the link of a partner we have agreed a discount code with (for example ?ref=tamara), it sets the cookie witness_offer. It holds the partner's name only, no identifier, and expires when the offer ends. When you later open the payment page from the app, the way there runs through witnessmac.com/buy: our server reads the cookie and fills the code in on Stripe's payment page for you. Stripe thereby learns which code was used, exactly as if you had typed it, and that is what decides what the partner receives from us. The cookie is not used to measure your visit. The legal basis is § 25(2) no. 2 TDDDG, because the discount you opened the site with cannot reach the payment page without it, and Art. 6(1)(b) GDPR. You can delete it in your browser at any time; you then type the code on the payment page yourself.

Apart from that, the site embeds no fonts, maps or videos from third-party servers.

It is served by Cloudflare (processor). When you load a page, the infrastructure processes the technically necessary connection data — IP address, time, requested address, amount of data transferred, status code and user agent — in order to deliver the page and keep the service safe from attack. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and functioning operation of the website. This connection data is not combined into profiles and not linked with other data.

9. The speech model

At the first launch the app fetches the model by itself, from the public repository argmaxinc/whisperkit-coreml at Hugging Face. Hugging Face thereby learns the technical connection data of that request, in particular your IP address. Nothing is uploaded, and the request contains nothing about who you are. The legal basis is Art. 6(1)(b) GDPR, because there is no recognition without a model. Hugging Face's own privacy policy applies to that fetch.

10. The six events that are not transmitted

The app builds fifteen events about setup and the licensing journey, such as installed, model ready, trial started and key requested. Nine of them are sent, and section 4a says exactly which and exactly what is in them. The other six are not transmitted: they are written to the local system log on your Mac and stay there.

The type they are built from has no free-text field anywhere, so there is nothing a transcript could end up in even by accident. Any further change happens with a new row in the table in section 4 and a switch you can reach — not quietly.

We collect no crash reports. macOS may offer to send Apple a report; that is between you and Apple, and this app neither reads it nor asks for it.

11. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Transfers to third countries

Cloudflare, Stripe, Resend, Amazon Web Services, Hugging Face, PostHog and Google (Gmail, and where consent is given Analytics and Ads) are companies established in, or with a parent company in, the United States. Even where the data is stored in the EU — for us, the licence table in Cloudflare's Eastern Europe region and mail delivery through Ireland — access from a third country cannot be ruled out. We base such transfers on the European Commission's standard contractual clauses and, where the provider concerned is certified under it, on the adequacy decision for the EU-US Data Privacy Framework.

13. Your rights

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An e-mail to hallo@witnessmac.com is enough. There is no form and no account you would have to sign into for it.

Erasure, and what it means: on request, your record in the activation service is deleted; only an anonymised order row is kept where an invoice requires it. The consequence matters, because it cannot be undone: no further key can be issued for that address, so a Mac you later replace cannot be activated. Keys already on your Macs keep working — they are verified on the Mac, against a signature, with no connection.

14. Right to complain

You can complain to a data protection supervisory authority. The one responsible for us is the Czech Office for Personal Data Protection, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You can also go to the authority where you live or work.

15. Whether you have to provide anything

You are not obliged to give us data. Without an e-mail address, however, no trial or licence key can be issued and delivered, because the licence is bound to that address; without a device identifier, the two-Mac limit could not be enforced.

16. Children

The product is not directed at children and asks nothing about age.

17. Changes to this policy

The table in section 4 is the promise. If a future version sends something that is not in it, this policy is changed before that version is published — and the app's request stays exactly as wide as this policy reaches.

What that means for the contract is in the Terms and Licence.