Privacy policy

1. Controller and contact

The controller is Emilie Perron, French individual entrepreneur (EI) trading as NOVA2G, 101 Rue au Bois Marcel, 50000 Saint-Lô, France, SIRET 999 096 829 00018. Privacy requests: contact@jodevelop.com.

2. Data processed and purposes

• Permissions in the app: nothing is sent for transcription or export before you allow cloud transcription, in the welcome guide or at the first transcription. The AI features ask for their own permission the first time one of them is used (on Windows, one permission covers dictation and notes), and known voices ask for theirs. Each permission says what is sent and to whom, and is withdrawn in the app’s privacy settings (Settings or Preferences, depending on the system); withdrawing stops new sending but cannot recall a request already sent.
• iPhone and Android apps: the microphone opens only on your gesture (tapping or holding the microphone, a note’s button). On Android, a note that continues with the screen off and the upload of a file to transcribe run as foreground services (microphone, data sync), with a notification that lets you stop them; the notification permission is used to show it. On iPhone, the keyboard’s full access only serves its online features. For the account’s device list, the phone sends a random installation identifier, stored as a hash, the device’s name or model, its platform and the app version.
• TalkyText keyboard (iPhone and Android): what you type is processed on the phone; keystrokes, suggestions and spell checking are not sent. The keyboard sends only what you ask for: the audio of a dictation and, to continue it, the end of the text already written (1,000 characters at most), never the content of a password or payment card field; an AI correction or formatting sends the text concerned, after the AI permission. The typing history is optional, off by default and subject to its own consent; it stays on the phone and skips password and payment card fields (on Android, also private-browsing fields and fields that ask not to learn the input).
• Cloud dictation: TalkyText sends microphone audio, through Cloudflare, to its transcription servers and returns the resulting text. The microphone is used only while you dictate or record. Your dictionary goes with each transcription, for that transcription only. When you dictate again where TalkyText has just written, the end of that text, 1,000 characters at most, goes with the dictation so that it continues it; the server uses it for that dictation only. The router and transcription service process audio and text for the current request, without storing their content in their operational logs. History, notes and retained recordings are stored on your device; a failed dictation may retain its audio locally so that you can retry it.
• Files and speakers: the selected media is opened locally and its audio is sent to TalkyText Cloud. When enabled, speaker separation and timestamps are computed on the server. Speaker groups number turns within that file; they do not identify people. Temporary local decoding files are removed after processing, with recovery cleanup after interrupted tasks. On Windows and macOS, the audio of a transcribed file is kept on your device, compressed, with its transcript for synchronized playback, and is deleted with it. Speaker names you enter and the structured transcript are sent to the export service when you request an export (on Windows, also for Copy text and PDF); the generated file is returned without storing it there.
• Known voices (optional): voiceprints are biometric data. After your explicit consent, the voiceprint of a speaker you name can be kept on your device with the name you choose. Voiceprints go with each file or note whose speakers are separated to the TalkyText transcription server, which suggests the name of a recognized voice and keeps nothing; the names stay on your device. You can delete one voice or all of them, which also withdraws the consent. Remembering a voice requires confirming that the person agreed. On iPhone and Android, the voice library is encrypted on the phone and excluded from its backups.
• Optional AI: formatting, translation, correction, the command mode, AI notes, meeting minutes, themes and questions about your notes run only on request or when you turn an option on, after the AI permission. The text concerned is sent to the TalkyText AI service and then to Anthropic (Claude, United States): the dictated or selected text and your instruction, the text of the notes concerned and your questions; your dictionary may serve as a glossary. Audio is not sent to Anthropic. The TalkyText AI service stores no text: it keeps only technical records (licence identifier, request identifiers, dates and statuses) against duplicates and abuse, erased 7 days after their use. Anthropic deletes the inputs and outputs of its API within 30 days, unless a longer retention is needed to enforce its usage policy or required by law; NOVA2G does not claim a zero-retention agreement. Disabling AI does not disable ordinary transcription.
• On your device: the dictation history (with audio if you keep it), notes and their recordings, recent file transcriptions, your dictionary and replacements, the voiceprints you remembered and your settings stay on your device and are not synchronized; you can delete them in the app. On iPhone and Android, the history, notes, recordings and remembered voices are excluded from the phone’s backups (on Android, also from transfers to a new device). The app keeps a technical log on the device; it is sent only if you agree to attach it to a problem report.
• Note actions and system integrations: “Actions” sends the text of the AI note to the TalkyText AI service and then to Anthropic, under the same agreement as the AI note, to extract tasks and dates. Those you choose go to your Reminders or Calendar (iPhone, Mac), your calendar (Android) or a calendar file created on your device (Windows, Linux); TalkyText reads nothing from them. On iPhone and Mac, Spotlight keeps the title and text of your notes in the device’s index: a deleted note leaves it, and all of them at sign-out. The Apple Watch app sends the recording directly to your iPhone, which transcribes it as a note.
• Trial and licence: TalkyText-specific hashed hardware proofs, device name, platform, app version, and validation dates prevent trial abuse, limit new free trials to 7 days per computer or mobile account, bind historical lifetime licences to their computers, enforce the account device limit, and issue a renewable signed local authorization valid for no more than 24 hours. Existing trials retain their original expiry. TalkyText normally attempts renewal every six hours while it remains open and requires online validation after restart. Raw hardware identifiers are not sent. Purchase handoff tokens are random, short-lived, and stored only as hashes. So that a trial on a phone is offered only once, a hash of the email address and of the installation identifier is kept, including after the account is deleted; it cannot be turned back into the address. Public API keys, once the API opens, are stored as hashes and count as a device of the account.
• Account: email address, salted password hash, session data, and license/device links provide the customer portal and computer changes. The TalkyText account is held by TalkyText alone: the email address and password you enter in the app or on the site are sent over HTTPS to the TalkyText account service, which checks them itself; the password is never kept in plain text and no other service receives these credentials. The account can be deleted in the app (Account, Delete account) or on the site, in My account, “Delete account” (https://talkytext.com/account#delete-account). Deletion stops the site subscription and the renewal of Google Play and Microsoft Store subscriptions; an App Store subscription keeps being billed by Apple until you cancel it in the settings of your Apple Account.
• Subscriptions and store purchases: for each subscription, TalkyText keeps the register (site, App Store, Google Play or Microsoft Store), the plan, the dates, the status, the environment (real or test), the store country when provided and the store identifiers: Apple (originalTransactionId, transactionId, appAccountToken), Google (purchaseToken, order number, obfuscated account identifier) and, once that payment opens, Microsoft (recurrence identifier, encrypted Microsoft Store identity keys). The account’s purchase token is a random identifier with no direct link to your address: the app gives it to the store during a purchase to attach it to your account. TalkyText receives no card or payment identity from the stores. These data are used to open the plan on the account’s devices, prevent a double subscription, apply the refunds and revocations decided by the store, and for support. For a subscription taken out on the site, the acceptance of the terms, any request for immediate access, with their version and date, and the subscription and cancellation confirmations are kept as proof of the contract.
• License ownership transfer: source and target accounts, emails, affected order and licenses, declarations and consents, temporary-token hash, status, dates, and receipts verify an all-or-nothing transfer, prevent concurrent use, and preserve evidence. The plaintext token is never written to the database: an authenticated encrypted copy is deleted after the invitation is sent. If it cannot be sent, no new acceptance starts after expiry; the encrypted copy is purged at the first successful pass after that deadline and, where an acceptance had already started, its two-minute technical lease. After acceptance, the anti-replay hash reaches its retention threshold after 7 days and is then replaced at the next successful pass with a value unrelated to the token. The transferee receives neither the invoice, the order, nor the first buyer’s other data.
• Purchase, refund, notices, and fiscal documents: order, Stripe checkout/payment/charge/customer identifiers, any originating computer and its trial dates, email, final billing identity and address, amount, currency, tax details, any exchange rate, consent version, and timestamps calculate and display the price, collect the immediate one-time payment, deliver the licence, show the full commercial-refund option for 15 days, process a request and disable every licence in the order, issue the immutable invoice or credit note and its SHA-256 integrity hash, keep proof of the transaction, and meet accounting obligations. Each durable notice keeps its frozen content, hash, Message-ID, date, and sending or transport state so an identical retry is possible. Hashes are checked again on every download. NOVA2G never receives card details.
• Country and network: Stripe collects the final billing address during payment; its country is used for tax calculation and the invoice. The public price is charged in USD worldwide. Cloudflare processes the IP address at its network edge and supplies only its inferred country as possible secondary evidence and for security, not to restrict sales by country. The TalkyText application does not retain that IP in plain text; a temporary pseudonymized network bucket limits abuse.
• Withdrawal: name, acknowledgement email, optional postal address, order date and reference, statement, receipt content, and timestamps receive, evidence, and process the notice. A separate internal alert contains only the notice’s real reference, email, declared order date/reference, and sending or transport state; it does not copy the postal address, name, or full statement.
• AI content report: the report form of the app sends the feature concerned, the reason, your comment, the AI text only if you paste it, your email address only if you give it, the platform, the app version and the interface language. The report is emailed to the support inbox; the site keeps only an audit line without text (platform, feature, reason, reference). If it cannot be sent, the app offers to write an email instead.
• Updates: the update check of the desktop apps sends only the app version and platform; the Microsoft Store version is updated by the Store.
• Security and support: short-lived rate-limit records, pseudonymized network buckets, technical logs, and messages protect the service and answer requests.

3. Legal bases

Pre-contractual steps and contract performance cover the account, purchase, delivery, activation, a requested ownership transfer, and support. Legal obligations cover invoices, accounting records, and withdrawal notices. Contract performance also covers opening the plan on the account’s devices, preventing a double subscription, and applying the stores’ refunds and revocations; legal obligations also cover the accounting of the stores’ payouts. Legitimate interests cover service security, fraud prevention, and defending legal claims. Fields marked as required during purchase or withdrawal are necessary for those purposes; without them the relevant operation cannot be completed. Optional actions rely on your choice. Cloud transcription, the AI features and known voices (biometric data) also rely on the permissions you give in the app, which you can withdraw at any time without affecting earlier processing. TalkyText does not use this data for advertising, profiling, or automated decisions with legal effects.

4. Recipients and international transfers

Authorized NOVA2G personnel can access only what their task requires. Stripe processes hosted payments, billing data, and receipts. Cloudflare provides application and database hosting, transactional email delivery, content delivery, network protection, and the encrypted connections to the TalkyText transcription and AI services. Processing may occur outside the EEA and is governed, depending on the service and country, by an adequacy decision and/or the standard contractual clauses incorporated into the data-processing agreements of Stripe and Cloudflare. Optional AI requests also involve Anthropic. For a store purchase, Apple, Google or Microsoft collects the payment and remains responsible for its own payment processing; Google Cloud Pub/Sub carries Google Play notifications and Microsoft Entra ID authenticates the server to the Microsoft Store. These transfers to the United States rely on each provider’s safeguards (Data Privacy Framework, standard contractual clauses). You can request details or a copy of the safeguards using the contact in section 1. Data is not sold.

5. Retention

• account, active-license data, and holder chain: for the contractual relationship and license support, then up to 5 years for evidence and legal claims;
• transfer token: encrypted copy deleted after sending or at the first successful maintenance pass after expiry and any two-minute technical lease, with no plaintext token in the database; anti-replay hash due 7 days after acceptance and replaced at the next successful pass; transfer declarations and receipts: for the license lifetime, then up to 5 years after it ends;
• day-0, payment, and cancellation contractual copies, transactional sending or transport states, invoices, credit notes, payment evidence, and accounting records: through 31 December of the tenth year following the relevant year, i.e. ten years from the 31 December financial-year close, and eligible for purge on the following 1 January. At that pass, the order email, billing identity and address, and Stripe identifiers are redacted; only the pseudonymous checkout identifier may remain while a license uses it in its contractual chain. Contract-copy hashes and dates remain as pseudonymous order tombstones; a purged fiscal document leaves only a tombstone with no name, email, address, or payment reference, containing its number, series, any original-document number, hash, and dates needed to preserve the accounting sequence;
• verification-reminder token: encrypted copy deleted as soon as transport accepts the message, the address is verified, or the order is cancelled; no plaintext token is stored. The usable-link hash expires within 7 days and is then purged by maintenance;
• withdrawal notices and acknowledgements: 5 years from receipt, unless a dispute requires longer retention; delivered operator-alert outbox rows are deleted at the first successful daily pass at least 30 days after delivery;
• orders abandoned before payment confirmation: 30 days; legacy deferred orders confirmed at day 0 or cancelled instead follow the contractual-copy period above;
• technical token linking a computer to a purchase: no more than 45 minutes, then deletion at the next maintenance pass; only its hash is stored;
• subscriptions and store purchases: during the subscription, then 5 years after it ends as proof; store financial reports, without personal data: 10 years; Microsoft Store identity keys: erased at the end of the subscription or when the account is deleted; idempotence records of store notifications: 90 days;
• acceptance when subscribing on the site and its confirmation: like the contractual copies above, ten years; acceptance followed by an abandoned payment: 30 days; cancellation confirmation: 5 years;
• inactive unlicensed device proofs: 3 years after the last contact;
• phone trial hashes: 3 years after the trial opens;
• technical records of the TalkyText AI service: 7 days after their use; text sent to Anthropic: up to 30 days on its side, under the exceptions above;
• content kept on your device (history, notes, recordings, transcriptions, voiceprints): until you delete it in the app;
• security audit records: 3-year threshold; rate-limit records: 8-day threshold, covering the longest anti-abuse window and its maintenance margin;
• account session cookie: up to 7 days; support messages: the time needed to resolve the request, then up to 3 years for dispute evidence.

Confirmation, fiscal-document, transfer, acknowledgement, and operator alert outboxes are retried every five minutes. Other active-database deletions are scheduled daily at 03:17 UTC. The durations above are therefore eligibility thresholds; physical deletion occurs at the next corresponding successful pass, after any active technical lease.

After deletion from the active database, data may remain for no more than 400 days in access-restricted encrypted backups used solely for disaster recovery. A restore reapplies deletion deadlines, and those backup copies expire automatically.

6. Cookies

TalkyText uses only the strictly necessary account session cookie, a technical computer-to-purchase cookie valid for no more than 45 minutes, and security mechanisms. Stripe may place cookies on its hosted checkout. There are no audience-measurement, advertising, or social-media cookies on the TalkyText site, so no optional cookie banner is required.

7. Your rights

Depending on the processing, you may request access, correction, deletion, restriction, portability, or object on grounds relating to your situation. You may also give post-mortem instructions under French law. Email us with enough information to identify the relevant account; identity proof is requested only when necessary. You may complain to the French data protection authority, the CNIL, at cnil.fr. Deleting license identifiers can make future activation impossible; statutory records may still be retained.

In the app, the privacy settings withdraw the cloud transcription and AI permissions, the known voices settings delete voiceprints, and the history, notes and recent transcriptions can be deleted at any time.

8. Security and changes

Passwords are salted and hashed, raw hardware identifiers are not transmitted, and payment cards remain with Stripe. The apps reach the TalkyText services only over encrypted connections. No Internet system is risk-free. Material policy changes will be dated here and, where required, notified through the account or application.