Privacy statement

This privacy statement covers the SayFeather apps (the desktop app for macOS and Windows, and the Android keyboard and floating button), the website sayfeather.nl and the service you use to buy and activate a licence. SayFeather is made by Made By Adem, who is responsible for the data described here. Privacy questions: [email protected].

In short

• Your words are yours. Speech recognition runs on your own device. Your audio never leaves it.
• The optional clean-up of the text goes straight from your device to the AI provider you chose, with your own key. SayFeather never receives your text or your key. With a local model (Ollama, LM Studio) nothing leaves your computer at all.
• SayFeather only receives data when you buy or activate a licence, when you send feedback yourself, or when you turn on the optional sync between your devices.
• Sync is off by default. If you turn it on, only an encrypted copy of your word list and a few settings is stored, and we cannot read it.
• The apps contain no ads, no tracking and no analytics software. We do not sell data.

What happens when you dictate

Speech recognition: on your device

SayFeather turns your speech into text with Whisper, which runs locally on your computer or phone (desktop and Android). The microphone audio is processed in memory on your device and is not sent anywhere. When you download a speech model, the app gets it from Hugging Face (huggingface.co). That request shows your IP address to Hugging Face, as any download does; SayFeather is not involved and sends no information about you with it.

Clean-up: straight to the provider you chose

If you switch on the clean-up (it needs an active licence), the app sends the transcript, and the words from your own word list, from your device straight to the AI provider you picked, using your own account key. This can be Anthropic, OpenAI, Google (Gemini), Mistral, Groq, OpenRouter, a local program such as Ollama or LM Studio, or an address you enter yourself. SayFeather never receives this text, and our service is not in between. The provider handles the text under its own privacy terms and settings; read them before you choose. The clean-up only corrects the text. If the provider is slow or fails, the app inserts the raw text instead.

With a local provider (Ollama, LM Studio) the text goes to a program on your own computer, so everything stays offline.

On your device

• Your provider key is kept in your computer's secure storage (macOS Keychain, Windows credential store) or, on Android, encrypted with a key in the Android Keystore. It is not sent to SayFeather.
• Your settings, your word list and the speech models are kept on your device. If you turn on sync, an encrypted copy of your word list and a few settings is also kept at SayFeather (see Sync between your devices).
• The desktop app puts the text at your cursor by briefly using the clipboard and then restores what was on it before.
• For every dictation the app writes how long each step took (numbers only, no text) to a file in its log folder on your device. Nothing is sent.
• The desktop app checks for updates at download.sayfeather.nl (on Cloudflare R2) after it starts and every six hours. Such a request reveals your IP address and the usual technical details of a web request to Cloudflare, which may keep them in its server logs. We do not use them to recognise anyone.

Android: keyboard and floating button

The SayFeather keyboard is an ordinary Android keyboard with a microphone button. The floating dictation button, which works with the keyboard of your choice, uses an Android accessibility service. You switch it on yourself in the Android settings and you can switch it off there at any time.

• The service sees which field has the focus, whether it is a text field, whether it is a password field (the button never shows for those) and whether a keyboard is open. It reads the text of that one field and the cursor position only to put your dictated text at the cursor.
• It remembers the name of the app in front, only on your phone, to keep the button where you dragged it in that app.
• It looks at nothing else: it stores no screen content and sends nothing to SayFeather. Text from other apps never goes anywhere through SayFeather; only what you dictate can go to your own AI provider, as described above.
• The button inserts the text only into the field that had the focus when you started recording. It pastes it there through the clipboard and then tries to put back what was on the clipboard before; Android does not always allow that, so your dictated text can stay on the clipboard (on Android 13 and newer it is marked as sensitive, so the clipboard preview does not show it). If that field is gone, the text goes to the clipboard.
• The microphone permission is used only while you record. SayFeather asks for it in the setup screen of the app, at the step Allow the microphone. The recording stays on your phone and is dropped once it has been turned into text.
• The SayFeather keyboard has no typing keys: it has a microphone, delete, space, Enter and a switch to your other keyboard. It cannot see what you type with another keyboard, and it records no keystrokes.
• The Android app has no account. Nothing about you is collected unless you activate a licence, send feedback or turn on sync, as described below.

Your licence

SayFeather works with a licence code. To deliver and check it we use a service that Made By Adem runs itself at Cloudflare (Workers, with a database in the EU). Dictating with raw text works without a licence; the licence unlocks the clean-up. For each licence we keep only:

• your email address, stored encrypted, plus a hash (HMAC) of the address to look up your licence;
• your country (for VAT);
• your licence code, only as an HMAC; we cannot read it back;
• the kind of licence, the start and end date, the maximum and the number of activations, and the status (for example active, expired or refunded);
• the transaction number of the payment at Pay.nl;
• for each device on which you activate SayFeather: the random activation number the app makes itself, the app version and when the device first and last made contact, plus when it signed off.

When you buy for a business, we also keep the name, and for the invoice possibly the VAT number and address. We do not keep what you dictate, device identifiers or IP addresses in the database. The app creates the activation number itself, at random, and it cannot be traced back to your device. The service looks at your IP address only to limit how often the buy form can be used; that address is kept in Cloudflare's memory for a moment and is never written to our database.

The app only contacts the service to activate your licence and to renew the proof of your licence in the background. In between it works without a connection.

Sync between your devices (optional)

Sync keeps your own word list and a few settings the same on your computer and your phone. It needs an active paid licence and is off by default; nothing is stored for sync until you turn it on. For what is stored and how long:

• What is stored: one encrypted block with your own words, your choices in the built-in word lists and the settings that sync: language, clean-up on or off, AI provider and model. Never your AI keys, hotkeys, microphone, speech model or what you dictate.
• We cannot read it: the block is encrypted on your device with a key made from your recovery code. That key stays on your devices and is never sent to us. The server sees roughly how big the block is and when it last changed. Without a device or the recovery code the data cannot be recovered, by you or by us.
• What it is tied to: a random sync number made from your recovery code, and the public licence number (not your licence code). The licence number lets us limit sync to 2 sync accounts per licence and delete the copy when a licence is refunded. No email address, name or IP address is stored with it.
• How long: the newest 4 versions are kept. A copy that has not been used for 400 days is removed automatically.
• Deleting: turn sync off in the app with "Also delete the copy on the server" ticked (it is by default) and the copy is removed at once. You can also ask us to delete it, and it is deleted when a licence is refunded.
• Where: the sync service runs on Cloudflare (a Worker with a database in the EU). Cloudflare sees your IP address and the usual technical details of a request, as described under the website.

Buying a licence

• Order: when you start a payment we keep, with that order, your email address (encrypted), your country, the licence you chose, the amounts including VAT, a discount code if you used one, and, if you fill them in, your name, VAT number and address. We also keep the time at which you ticked the box about your right of withdrawal, as proof of your request to deliver the licence at once.
• VAT country: your country decides the VAT rate and whether the invoice carries VAT, reverse charge or EU one-stop-shop (OSS) VAT.
• Payment goes through Pay.nl. You enter your bank or card details on their page. We send Pay.nl only the amount, a description of the purchase and an order reference, not your email address or name, and we receive only the outcome and a transaction number. We keep no bank or card details.
• Invoice: after payment we make an invoice with the invoice number, date, your name (or business name), address, country, VAT number if you gave one, what you bought and the amounts. A refund gets a credit note. We keep your email address on the invoice encrypted.

Email

We send your licence code and invoice, a renewal confirmation, a reminder before your licence ends (for licences with an end date) and a refund notice through Resend, from [email protected] (EU region). For each mail we keep the recipient (encrypted), the subject and whether it was delivered. Mail you send to [email protected] is forwarded to Adem's inbox by Cloudflare Email Routing.

Feedback

In the desktop app (Settings or the tray menu) and in the Android app you can send feedback yourself. A report contains:

• what you type: an optional title, your description and the kind (bug, idea or question);
• an email address, only if you fill one in;
• on the desktop a picture of the screen where your mouse is, which you see first and can hide parts of or remove before you press Send; on Android and the desktop also the files you add yourself (at most 3 in all, 2 MB each);
• the app version and the operating system, unless you untick that.

A report is sent encrypted (https) and only when you press Send. It is handled by our own automation (n8n), and a new report is announced in a Telegram chat of Made By Adem. The title, text and app version also appear in our management environment at Cloudflare, with the screenshot and files left out. We use reports only to fix problems and improve the app. We keep a report as long as we need to handle it; once handled, the copy in our management environment is deleted after 1 year.

The website sayfeather.nl

This website measures visits with Google Analytics, but only if you agree in the notice. There you choose between "No thanks", "Visits only" and "Visits and ads"; nothing is pre-ticked. Without your consent the website does not load Google Analytics and Google sets no cookies. With your consent we see which pages are viewed, for how long, on what kind of device and from which country, which download button you use (with the kind of device, without name or email address) and whether a purchase was made (with amount and order number, without name or email address); Google sets cookies (_ga) for this. If you also choose ads, Google Ads sees whether you came through an advertisement and whether that led to a download or purchase, without name or email address; Google also sets cookies (_gcl_…) for this. Personalised advertising and Google signals are always off. Google may process this data outside the EU. You can change your choice at any time through "Cookie settings" at the bottom of the website. Your choice itself is only stored in your own browser.

Apart from that, the website sets no cookies. If you reach the website through a link with a campaign label (for example utm_source=facebook), we count that visit for the campaign and your browser remembers the label while the tab is open (sessionStorage, not a cookie). If you buy, we store the label with that order. That shows us which advertisement works. The label says nothing about you, and we keep it, with the daily visit counts, as statistics without an end date. If you come through an advertisement from Google or Microsoft, the address holds a click code; that visit counts for the campaign google or microsoft, and we do not keep the click code itself. Only if you consent to ads does Google keep it in a cookie (_gcl_aw). Apart from that, the website stores nothing in your browser.

The website runs on Cloudflare (Pages). Like every web host, Cloudflare sees your IP address and the usual technical details when you open a page. The pages also ask our service (api.sayfeather.nl) for current prices, the questions and answers and the checkout; that request is handled the same way and we store no IP address in our database.

How long we keep data

• Licence data: while your licence runs and up to 2 years after it ended, so you can renew or we can help you. A licence without an end date that is still active is kept.
• Unpaid orders: 30 days.
• Devices that signed off: 90 days.
• Sync copy (encrypted): the newest 4 versions, removed 400 days after the last write, at once when you turn sync off with deletion, on request, or when a licence is refunded.
• Sent mails (the log: recipient, subject, status): 1 year.
• Handled reports in our management environment: 1 year after they were handled.
• Invoices and credit notes: the data on an invoice must be kept for 7 years under Dutch tax law.
• If you ask us to delete your data, we do so at once, except what is on an invoice.

Who processes your data

We do not sell data. Data only goes to parties that help us deliver your licence or handle reports, and only for that purpose:

• Cloudflare: the licence service and its database, the sync service and its database (only if you turn sync on), the website, the downloads and updates, and email forwarding.
• Pay.nl: payments.
• Resend: sending email.
• Telegram: the notification that a new report has arrived.
• Our own server where n8n runs, for reports.
• Google: measuring visits and ads on the website, only with your consent.

Cloudflare, Resend and Telegram are American or international companies and may process data outside the EU. The AI provider you choose and Hugging Face are separate parties with their own privacy terms; they do not work for us.

Your rights, deleting your data and contact

You may ask to see, correct or delete your data. Email [email protected]. Because your audio and your dictated text never reach us, there is nothing of that to find or delete with us, and we cannot read the encrypted sync copy, only delete it; for text at your AI provider, contact that provider. If you disagree with how we handle your data, you can file a complaint with the Autoriteit Persoonsgegevens (the Dutch data protection authority), or with the authority in your own country.

Deleting your data (also for the Android app)

• On your device: uninstall the app. That removes your settings, your word list, your provider key, the speech models and the licence proof from the phone or computer. The Android app makes no backup in the cloud; only if you turn on sync is there an encrypted copy at SayFeather (see below).
• At SayFeather: there is no account with a name or password. What we keep is the licence data described above and, if you turned on sync, the encrypted sync copy. Turn sync off in the app with "Also delete the copy on the server" ticked to remove the sync copy at once. To have everything deleted, email [email protected] from the address you bought with. We delete it at once, except what is on an invoice (7 years, Dutch tax law).
• At your AI provider: text you sent for clean-up is kept under that provider's own terms. Contact the provider to have it deleted.

Support

Questions, problems or ideas about SayFeather, including the Android app: email [email protected]. You can also send feedback from inside the app.

Children

SayFeather is not meant for children under 16.

Changes

When this statement changes, we update the date at the top. For a change that matters to you, we say so on the website.

Back to the site