Privacy Policy

Last updated: June 2026

Dictara is built for data minimisation: no account, no sign-up, no personal registration. Below we explain how personal data is processed when you use the app and this website.

1. Controller

2. Anonymous device ID

So that we can count your free trial and any purchased credit, the app generates an anonymous device identifier. It is derived from a hash value (SHA-256) of your Mac's hardware identifier and contains neither your name nor any other plain data. It lets us attribute used and purchased dictation time to a device only — it does not allow us to identify you personally.

Per device identifier we store: time of first and last use, dictation time consumed during the trial, and remaining credit.
Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract).

3. Voice recordings and transcription

When you dictate, the app records what you say for as long as you hold the dictation key and transmits the audio, encrypted, to our server and from there to our transcription provider, which converts speech into text. The text is inserted at your cursor.

• The audio is processed only for transcription and is not permanently stored by us.
• No voice recognition or voice profiling takes place.

Legal basis: Art. 6(1)(b) GDPR (provision of the dictation service you requested).

4. Automatic correction (optional)

If you enable the "auto-correction" feature (off by default), the transcribed text is additionally sent to a language-model provider to remove filler words and smooth sentences. Here too, we do not store the data permanently.
Legal basis: Art. 6(1)(b) GDPR.

5. Payment processing

If you buy dictation time, payment is handled by our payment provider Stripe. You enter your payment details (e.g. card data, email for the receipt) directly with Stripe; we do not receive full payment data. We only transmit your anonymous device identifier and the amount to Stripe so the credit can be applied to the correct device.
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (tax/commercial obligations).

6. Hosting, website & server logs

This website is delivered via Cloudflare Pages. Our server functions (the app's interfaces) run on servers in Germany (Hetzner). When the website is accessed or the app makes requests, technically necessary connection data is processed (in particular IP address, time, requested resource) — for delivery, stability and abuse prevention.
This website uses no tracking cookies and no analytics/tracking tool.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, fault-free operation).

7. Recipients / processors

To provide the service we use carefully selected providers:

8. Transfers to third countries

Some of the providers listed are located in the USA. Transfers are based on appropriate safeguards under Art. 46 GDPR (in particular EU Standard Contractual Clauses) or, where certified, the EU-US Data Privacy Framework. For details, please refer to the respective providers' privacy notices.

9. Retention period

Audio data is only processed transiently for transcription. Device-identifier data (usage/credit status) is stored for as long as necessary for operation. Payment/invoice records are retained for the statutory retention periods.

10. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Please note: since we cannot identify you without an account, we generally need the relevant anonymous device identifier (available in the app via "Copy device ID") in order to act on a request.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information.

11. Contact for privacy matters

For any questions about data protection, contact us at service@stuffle.com.