Privacy Policy

How Sawti collects, uses, and protects your data.

v2.0 Effective 26 August 2026

This policy covers the Sawti apps on Mac, Windows, iPhone, iPad and Android, and the website at sawti.io. It is written to meet the GDPR (RGPD) and the French Data Protection Act.

Sawti («صوتي», “my voice”) is a voice dictation app for Mac, Windows, iPhone, iPad and Android. This policy explains, in plain language, what personal data we handle when you use Sawti, why we handle it, and what rights you have. Privacy is built into how Sawti works, so this policy is short by design.

1. Who we are (data controller)

The person responsible for the personal data described here (the “data controller”) is:

  • Rami Hanna
  • Individual entrepreneur (entrepreneur individuel), registered in France under the artiste-auteur (author-artist) regime
  • INSEE activity code 90.03B (“Autre création artistique”)
  • SIRET 909 970 881 00019 (SIREN 909 970 881)
  • 32 Mail des Charmilles, 10000 Troyes, France

Sawti is operated by an individual, not a company, so there is no company name and no share capital. We are not legally required to appoint a Data Protection Officer and have not done so. For any privacy question, use the contact form at https://sawti.io/contact.

2. What this policy covers

This policy covers every Sawti app (Mac, Windows, iPhone, iPad and Android, including the Sawti keyboard on iPhone, iPad and Android) and the website at sawti.io.

3. How Sawti works, briefly

On Mac and Windows, Sawti sits in the menu bar or the system tray. You press a hotkey, speak, and press it again; Sawti turns your speech into text and pastes it into whatever app you are using. On iPhone, iPad and Android you either record in the app or dictate straight into any text field using the Sawti keyboard. Sawti can also translate selected or pasted English text into plain Arabic (the “read-back” feature).

To do this, the app records a short audio clip and sends it once, over an encrypted HTTPS connection, to Sawti’s own server (`sawti-server.vercel.app`, hosted by Vercel). That server forwards the audio to OpenAI, which transcribes it (the `gpt-4o-transcribe` model) and, depending on the mode, cleans up or translates the text (the `gpt-4o-mini` and `gpt-4.1` models). The result returns to the app. OpenAI processes this data in the United States. There is no “bring your own key” and no setup step: the app already knows how to reach Sawti’s server.

4. What we know about you

Sawti asks for an email address and a password so you can create an account. We never ask for your name. Your recordings themselves carry no name: the audio we send for transcription is not labelled with who you are, and the transcription service is not told whose voice it is.

What an account means in practice:

  • Your email address. It identifies your account, it is where a confirmation link and any password-reset link are sent, and it is where we reach you about your plan. See section 5(e).
  • Your password, which we do not have. We never store the password you choose. We store only a one-way scrambled form of it (a salted `scrypt` hash), deliberately slow to compute. It cannot be turned back into your password, and nobody at Sawti can read it or tell you what it is. If our database were ever stolen, the thief would get unreadable strings, not passwords. See section 5(e).
  • A device identifier. So that one free trial cannot be taken repeatedly on the same machine, the app may send a device identifier: a one-way hash of a device value, salted so the original cannot be recovered from it. It distinguishes a device; it does not name a person. See section 5(c).

5. What data we process, why, and on what legal basis

a. Your voice recordings. When you dictate or use read-back, the app sends a recording of your voice to our server and on to OpenAI for transcription. We process it to deliver the transcription or translation you asked for. Legal basis: performance of our agreement with you to provide the service you request (Article 6(1)(b) GDPR). When you hold the hotkey and speak, you are asking us to transcribe that audio, and processing it is how we do what you asked.

b. Text content and your preferences. For modes that clean up or translate text, the request also carries the text itself, the text you select for read-back, your custom dictionary entries, your per-app tone rules, and the name of the app you are currently typing into. These are sent to OpenAI so the result respects your preferences. Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).

c. Technical data (server logs, rate limits, device identifier, update checks). Our server keeps standard access logs: your IP address, the date and time, which endpoint was called, and the response status. These logs do not contain the content of your recordings or text. We use your IP address to apply rate limits that keep the service available for everyone; those counters are held briefly in a Redis store and expire on their own.

Where a free trial is offered, the app may also send a device identifier: a one-way, salted hash of a value that identifies your device. The original value never leaves your machine and cannot be recovered from the hash. Its only purpose is to stop one free trial being taken over and over on the same device. It is pseudonymous personal data, which is why we describe it here.

Separately, the Mac app periodically checks our server for updates (using Sparkle); this reveals your IP address and the app version, and nothing else.

Legal basis: our legitimate interest in keeping the service secure, available, and free from abuse, and in delivering software updates (Article 6(1)(f) GDPR).

d. Data that stays on your own device. Your transcription history, personal dictionary, snippets, per-app tone rules, settings, and usage statistics are stored on the device you are using, and nowhere else:

  • Mac: `~/Library/Application Support/Sawti/`
  • Windows: `%APPDATA%\Sawti\`
  • iPhone and iPad: inside the app’s own container, shared with the Sawti keyboard through a private app group
  • Android: inside the app’s own private storage

We do not receive or process this data; it never leaves your device unless it forms part of a request you send (see point b). You control it and can erase all of it at any time from the app’s settings (“Delete all local data”).

e. Your account: email address and password. To create an account we process your email address and a password. We never store the password itself — only a one-way salted `scrypt` hash of it, which cannot be reversed. We also store short-lived, hashed tokens for confirming your address and for resetting a forgotten password. We use all of this to let you sign in, to keep your account secure, to send you a confirmation link and any reset link you ask for, and to tell which plan is yours. Legal basis: performance of our agreement with you to provide the service (Article 6(1)(b) GDPR), and our legitimate interest in keeping accounts secure against guessing and abuse (Article 6(1)(f) GDPR).

f. Purchase data, if you buy a paid plan. Paid plans are sold through Paddle, which acts as merchant of record. Paddle collects your payment details and your billing information; we never see or hold your card details. From Paddle we receive the email address you paid with, the plan you bought, and its status, so that we can deliver your access, answer support, and honour refunds. Legal basis: performance of the sale contract, and compliance with our accounting and tax obligations (Articles 6(1)(b) and 6(1)(c) GDPR).

We use no analytics tools, no advertising identifiers, no crash reporter that sends data to us, and no A/B testing framework.

6. Who else processes your data

We use the following service providers (“processors”) to run Sawti. A data processing agreement under Article 28 GDPR is in force with each of them: every one of these providers incorporates its data processing terms into the contract we entered into when opening our account. Paddle is different in kind: for the sale itself Paddle is the seller, not our processor, and its own privacy notice governs the payment data it collects.

  • OpenAI: transcription (`gpt-4o-transcribe`) and text processing (`gpt-4o-mini` and `gpt-4.1`), carried out in the United States. Under OpenAI’s API terms, OpenAI does not use data submitted through its API to train its models, and retains data only transiently, for a limited period, to monitor for misuse, after which it is deleted.
  • Vercel: hosting for the Sawti server and the sawti.io website. Vercel Inc. (a Delaware corporation), 440 N Barranca Avenue #4133, Covina, CA 91723, United States.
  • Neon: the managed database that stores account data (an email address and a session record) if and when accounts are enabled. Neon, Inc., United States, database hosted in Washington, D.C.
  • Upstash: a Redis store holding short-lived technical values: rate-limit counters keyed to an IP address, and one-time sign-in codes. Entries expire automatically.
  • Resend: sending our transactional and service emails. Resend (Plus Five Five, Inc.), United States, sending from a data region in Ireland (EU).
  • Paddle: selling paid plans as merchant of record, and handling payment, invoicing, tax and refunds. Paddle.com Market Ltd, United Kingdom. For the sale itself Paddle is the seller and its own privacy notice applies to the payment data it collects.

We do not sell your data, and we do not share it with anyone other than the providers above.

7. Sending data outside the European Union

OpenAI processes your audio and text in the United States, and our hosting provider may process technical data outside the European Union. These transfers are protected by appropriate safeguards: the European Commission’s Standard Contractual Clauses, and/or the EU-US Data Privacy Framework where the recipient is certified under it. You can ask us, through the contact form, which safeguard applies to a given provider.

8. How long we keep data

  • Voice recordings: not stored. On our server the audio is held in memory only, for the few seconds transcription takes. It is never written to disk, and no copy is kept after the request finishes.
  • Text content and preferences sent for processing: not stored on our server beyond the request. OpenAI may retain a transient copy for a limited period for misuse monitoring, as described above.
  • Server access logs: kept for up to 6 months, then deleted.
  • Rate-limit counters and sign-in codes: short-lived, and deleted automatically when they expire.
  • Device identifier: kept for as long as needed to prevent repeated free trials.
  • Account data (email address, password hash): kept while your account exists. Delete your account and it goes, subject only to any purchase records French accounting law requires us to keep.
  • Confirmation and password-reset tokens: short-lived. A reset link expires after one hour, and a confirmation link is consumed the first time it is used.
  • Purchase records (email address, plan, status): kept for the life of the plan, and afterwards for as long as French accounting and tax law requires us to keep records of a sale.
  • Data on your own device: kept until you delete it. This is entirely under your control.

9. Your rights

Under the GDPR and the French Data Protection Act you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability. Where we rely on consent for any processing, you may withdraw it at any time.

One honest limitation: because Sawti does not ask who you are, and requests carry no name, we usually cannot connect a request to a particular person, and the audio is not kept at all. For much of the data described here there is therefore nothing for us to retrieve or delete on our side, because it no longer exists or cannot be identified as yours (Article 11 GDPR). The most complete control you have is the “Delete all local data” button in the app, which erases everything held on your own device.

If you have bought a paid plan, we do hold your email address, and there your rights apply in the ordinary way: write to us and we will act on them.

To exercise a right, or to ask a question, use the contact form at https://sawti.io/contact or write to support@sawti.io.

You also have the right to lodge a complaint with the French supervisory authority: the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. Website: www.cnil.fr.

10. Please be careful what you dictate

Depending on what you say, your voice and the words you dictate may include sensitive information, for example about health, beliefs, or other people. Sawti sends what you dictate to OpenAI for transcription. We do not ask you to provide sensitive information, and we recommend that you do not dictate anything you would not want processed by a transcription provider in the United States. Sawti does not identify you from your voice and does not create a voiceprint; it only transcribes what is said.

11. Children

Sawti is not directed at children. In France, the minimum age to consent on your own to the processing of personal data by an online service is 15. If you are under 15, please use Sawti only with the involvement of a parent or guardian.

12. Automated processing

Sawti uses automated language models to transcribe, clean up, and translate text. This is automated processing, but it does not make any decision that produces legal effects for you or that significantly affects you; it simply produces the text you asked for.

13. Cookies and the website

The sawti.io website is informational. It is designed to use no advertising or analytics cookies and no third-party tracking, so no cookie consent banner is shown. If the site ever needs cookies that are not strictly necessary, we will ask for your consent first and update this policy.

14. Security

Data sent between the app and our server travels over encrypted HTTPS, and the app authenticates to the server over that encrypted connection. Audio is processed in memory and not stored. No system is perfectly secure, but Sawti is designed to hold as little data as possible in the first place.

15. Changes to this policy

If we change how Sawti handles data, we will update this policy and change the date at the top. For significant changes we will post a clear notice on the website.

16. Contact

For any question about this policy or your personal data, use the contact form at https://sawti.io/contact or write to support@sawti.io.