Privacy Policy

Last updated: 3 September 2026, version 1.0

This privacy policy explains which personal data we process when you visit ownvox.app, use the Ownvox desktop app or use one of our cloud features. It is deliberately specific: wherever something only happens under a condition, the condition is stated.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Tristan Achebach
642 Studio
Hobrechtstraße 33
64285 Darmstadt
Germany

Email: [email protected]

No data protection officer has been appointed because neither Art. 37(1) GDPR nor Section 38 of the German Federal Data Protection Act (BDSG) is met (no employee is permanently engaged in automated processing, no large-scale monitoring, no large-scale processing of special categories of data). Please send privacy requests directly to the email address above.

2. The essentials

• Speech recognition in the Ownvox app runs entirely on your device by default. Audio only leaves your device if you enable cloud transcription or your own third-party provider.
• The free browser tools on ownvox.app process your audio files, microphone recordings and text in your browser; none of these tools uploads your content to our servers. Two connections to third parties are part of this: the one-off download of the speech model from Hugging Face and, only if you explicitly select an online voice in the read-aloud tool, the speech synthesis at that voice provider (sections 11.1 and 11.3).
• We collect usage statistics only with your consent, through PostHog with storage in the EU, without session recording and without advertising networks.
• We do not sell data, do not build profiles and do not use user content to train AI models.
• Purchases and payments are handled by Lemon Squeezy as the reseller (merchant of record). Payment details never reach us.
• An Ownvox account is voluntary. If you create one, we sync your own skills between your devices; everything else stays on your device.

3. Scope

This policy applies to

• the website ownvox.app including the blog, the download page and the free browser tools at ownvox.app/tools,
• the Ownvox desktop app for macOS and Windows (the "app"),
• the cloud features of the app operated by us, in particular licence verification, the optional Ownvox account and the optional cloud transcription ("Ownvox Cloud").

If you use language models with your own credentials (bring your own key), the privacy policy of the provider you choose applies in addition (see section 12.4).

4. Hosting, delivery and server logs

4.1 Website hosting

The website runs on the platform of Railway Corp., San Francisco, USA. When you open a page, the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, browser identifier (user agent), referrer address and the cookies we set. We do not keep our own logs containing IP addresses. Railway stores technical access and application logs for a limited period to keep the service running and to detect faults. These logs are deleted after 30 days at the latest. If a specific security incident is being investigated, we keep the affected entries until the investigation is closed.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website. A data processing agreement is in place with Railway; access from the USA is covered by the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

4.2 Content delivery network and attack protection (Cloudflare)

All requests to ownvox.app pass through the network of Cloudflare, Inc., San Francisco, USA. Cloudflare terminates the encrypted connection, filters automated attacks and speeds up delivery. In doing so, Cloudflare processes your IP address, request metadata and, for security features, possibly one technically necessary cookie. Processing usually takes place in the Cloudflare data centre geographically closest to you, so within the EU for visitors from Europe. Cloudflare deletes the raw data of these request logs after a short time; only aggregated values without any personal reference remain for security statistics.

Legal basis: Art. 6(1)(f) GDPR (security and availability of the website). Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses in the data processing agreement with Cloudflare apply.

4.3 Fonts, videos and images

Fonts, videos and images are served from our own server. No Google Fonts, no external video players and no external image servers are embedded.

5. Cookies and browser storage

The website sets only a few cookies and storage entries. A complete, continuously maintained overview with names, purpose and retention is in the cookie policy. In short:

• Technically necessary, without consent: the cookie ownvox_consent (stores your cookie choice, 12 months), the cookie NEXT_LOCALE (remembers the selected language, session), the entry theme in local storage (light or dark design) and the cache for the speech model of the browser tools (section 11).
• Only with consent: PostHog's storage entries for audience measurement plus our own two entries ownvox_checkout and ownvox_internal, which serve that statistic only (section 6 and the cookie policy).

The legal basis for technically necessary storage is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR. For storage requiring consent it is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can change your choice at any time via the "Cookie settings" link in the footer.

6. Audience measurement with PostHog (only with consent)

If you choose "Accept all" in the cookie banner or switch on the statistics option, we load the PostHog analytics library and record how the website is used. Without consent the library is not even downloaded.

Provider: PostHog, Inc., San Francisco, USA. We use PostHog's EU instance; the data is stored on servers in Frankfurt am Main, Germany. Your browser's requests go to our own domain (ownvox.app/ingest) and are forwarded to PostHog by our server.

What is recorded: page views and page exits (for time on page and bounce rate), clicks on selected elements such as download buttons, pricing buttons and FAQ entries, the selected language, browser and device type, screen size, referrer address and the IP address, from which PostHog derives the approximate location (country, region). In the browser tools we additionally record technical metrics such as the length of a recording or the selected language, but never the content: no audio, no transcripts, no entered text, no file names.

What does not happen: no session recording (screen recording), no heatmaps, no surveys, no A/B tests, no link to your name or email address, no sharing with advertising networks. Events are stored without a person profile.

Browser storage: PostHog stores a random identifier in a cookie and in local storage (name starting with ph_, lifetime 12 months) and a session identifier in session storage. If you withdraw consent, we delete these entries immediately.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent is voluntary and can be withdrawn at any time via "Cookie settings" in the footer. A data processing agreement is in place with PostHog; possible support access from the USA is covered by the standard contractual clauses.

Retention: event data is deleted at PostHog after 12 months.

7. Purchase, licence and payment processing

7.1 Lemon Squeezy as reseller

Ownvox subscriptions are sold through Lemon Squeezy. Your contracting party for the purchase is Lemon Squeezy, LLC, USA, as reseller (merchant of record). Lemon Squeezy issues the invoice, collects the payment, remits VAT and manages your subscription.

When you click a purchase button, the Lemon Squeezy checkout opens in an embedded frame on our page; if it fails to load, we open the Lemon Squeezy checkout page in a new tab. In the checkout, Lemon Squeezy processes the data you enter there: name, email address, billing address, VAT identification number where applicable and your payment details. Payment details are processed exclusively by Lemon Squeezy and its payment providers and never reach us. Lemon Squeezy sets its own cookies in its checkout frame; details are in Lemon Squeezy's privacy policy.

Legal basis: Art. 6(1)(b) GDPR. Lemon Squeezy is an independent controller for payment processing. The transfer to Lemon Squeezy in the USA is covered by the standard contractual clauses that form part of the agreement with Lemon Squeezy.

7.2 Which data we receive from the purchase

After the purchase we receive the order data from Lemon Squeezy: name, email address, purchased product and term, order number, price, subscription status (trial, active, cancelled, expired) and the generated licence key. We use this data to give you access to the app, to provide support and to handle claims arising from the contract.

Retention: we keep the order data received from Lemon Squeezy for three years from the end of the year in which the subscription ends, i.e. for the standard limitation period of possible claims under the contract (Sections 195 and 199 German Civil Code); after that we delete it. Invoices and accounting vouchers towards you are issued and retained by Lemon Squeezy as the reseller under the periods applicable to Lemon Squeezy; our own bookkeeping relies on Lemon Squeezy's statements to us (section 14). Legal basis: Art. 6(1)(b) GDPR for performing the contract and Art. 6(1)(f) GDPR for retention until the limitation period expires; our legitimate interest is asserting and defending claims under the contract.

7.3 Server-side purchase statistics

Lemon Squeezy notifies our server about completed orders, successful payments and subscription changes (start, cancellation, expiry). From these notifications we create pseudonymised statistics in PostHog (section 6): we transmit product, term, amount, currency, status, the order, subscription and invoice numbers, the billing reason and the start, renewal and end dates of the subscription, but not your email address. A SHA-256 hash of the email address serves as the identifier so that we can count the trial and the later payment of the same order together without storing the address. These statistics are created regardless of your cookie choice because they do not require access to your browser.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to understand revenue and cancellations without creating person profiles.

7.4 Customer portal

You manage invoices, payment method and cancellation in the Lemon Squeezy customer portal, which we link in the footer and on the page after purchase. Lemon Squeezy's privacy policy applies there.

8. Contact by email

If you write to [email protected], we process your email address, the details in your message and the time in order to answer your request. Our mailbox is operated by IONOS SE, Montabaur, Germany.

Legal basis: Art. 6(1)(b) GDPR if the request concerns a contract, otherwise Art. 6(1)(f) GDPR (answering requests). Retention: we delete the correspondence once the matter is settled and no statutory retention obligation applies, at the latest after three years.

9. Forms: cancellation, withdrawal and bug report

The website has three forms: the cancellation button under Section 312k German Civil Code, the withdrawal button under Section 356a German Civil Code and a bug report.

Data collected: for the cancellation and withdrawal forms, name, email address, optionally the order number and a message. For the bug report, email address, title and description, optionally name, operating system, app version and the affected page or feature. Plus the time of submission and the website language.

What happens with it: we send you a confirmation by email and a notification to our support mailbox. Delivery goes through Mailjet SAS, Paris, France, or the mail server of IONOS SE, Montabaur, Germany. Cancellations and withdrawals may additionally be handed to an internal notification system we operate so that no declaration is lost.

Abuse protection: the forms contain an invisible field that only automated programs fill in (honeypot). We also limit the number of submissions per email address and in total within 15 minutes. For this we hold a SHA-256 hash of the email address in the server's memory and, where our hosting provider reliably passes us the address of the connection used, additionally a SHA-256 hash of that IP address. Both values are discarded after 15 minutes at the latest, are never written to disk and are not linked to any other processing. Your IP address is not included in the emails we send from the forms. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is protecting the forms and our support mailbox against automated bulk submissions.

Legal basis: Art. 6(1)(b) GDPR for cancellation and withdrawal, Art. 6(1)(f) GDPR for the bug report (fixing defects) and for abuse protection. Retention: we keep cancellation and withdrawal declarations for the duration of the statutory retention periods; bug reports are deleted once the defect is fixed, at the latest after twelve months.

10. Downloading the app (GitHub)

The app's installation files are hosted on GitHub. When you click a download button, your browser downloads the file directly from github.com or GitHub's storage service. GitHub, Inc., San Francisco, USA, thereby receives your IP address, browser identifier and referrer address. Independently of this, our server periodically asks GitHub which version is current; that request contains no data about you.

Legal basis: Art. 6(1)(b) GDPR (providing the download you requested). GitHub is part of Microsoft and is certified under the EU-US Data Privacy Framework.

11. Free browser tools (ownvox.app/tools)

The tools at ownvox.app/tools run in your browser. You need no account, and your content is not uploaded to or processed on our servers. The two third-party connections described in sections 11.1 and 11.3 are the exception. In detail:

11.1 Speech recognition in the browser (audio to text, voice message to text, speech to text, dictation stage of the typing test)

These four pages recognise speech with the Whisper AI model, which runs in the browser. For this, your browser loads the model files (about 77 MB) directly from the Hugging Face Hub, operated by Hugging Face, Inc., Brooklyn, New York, USA (domains huggingface.co and hf.co). The download starts only when you actually start the tool: when you select a file or drag it onto the upload area, press the microphone button or finish typing the text in the typing test. Merely opening the page loads nothing. If your browser's data saver mode is on, preloading is skipped. The runtime that executes the model is served from our own server, not from a third-party CDN. Hugging Face receives the usual technical access data: IP address, browser identifier, time and the requested file.

Audio files, microphone recordings, the generated text and the selected language never leave your device and are transmitted neither to Hugging Face nor to us. After the first download, the model is stored in your browser's Cache Storage (named transformers-cache) so that later uses work without a new download and also offline. You can delete this cache at any time via your browser's site data.

Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested). Your browser fetches the model directly from Hugging Face once you have started the tool; we are not involved in that connection and receive no data from it. Hugging Face, Inc. is based in the USA, so the connection data involved (IP address, browser identifier, time, requested file) is transferred to the USA. This single, user-triggered transfer is necessary for the performance of the service you requested (Art. 49(1)(b) GDPR). There is no European Commission adequacy decision covering this request; there is therefore a risk that US authorities access the connection data and that you have no equivalent legal remedies against those authorities. You can avoid the transfer entirely by not starting the tool; merely opening the page establishes no connection to Hugging Face. After the first download the model stays in your browser, so no further transfer takes place.

11.2 Microphone access

"Speech to Text" and the dictation stage of the typing test access the microphone after you grant permission in the browser. The recording is processed solely in your browser's memory and converted to text there. No audio file is stored, and neither audio nor text is transmitted. Access ends as soon as you stop the recording or leave the page; you can revoke the permission in your browser settings. Legal basis: Art. 6(1)(b) GDPR (providing the dictation feature you started). Granting microphone access is a permission of your operating system or browser; we receive neither the audio nor the text produced from it, so no processing takes place on our side in this respect.

11.3 Text to speech

The read-aloud tool uses your browser's speech output (Web Speech API). By default it selects a voice provided by your operating system; the text then stays on your device. Some browsers also offer online voices, in Google Chrome those labelled "Google". If you select such a voice, your browser sends the text to the voice provider for synthesis, in Chrome to Google LLC, Mountain View, USA. The tool labels online voices and always lists your device's voices first; as soon as your device has a voice for the selected language, that voice is preselected. Only if a language has online voices exclusively is the first of them preselected, labelled as an online voice and accompanied by the notice about the transfer before you start playback. We do not receive any data in this process.

Legal basis: Art. 6(1)(b) GDPR on the basis of your explicit selection; processing by the voice provider is governed by its privacy policy.

11.4 Speaking time calculator

The speaking time calculator converts words to minutes and back. It processes no personal data and loads no external resources. Pasted text is only counted in the browser's memory.

11.5 Usage statistics in the tools

With your consent (section 6) we record that a tool was started, completed or aborted, together with technical metrics such as audio length, processing time, file type, language or word count. Content is never recorded.

12. The Ownvox desktop app

12.1 Local processing

The app records speech, recognises it with a model stored on your device and inserts the text at the cursor position. By default this happens entirely offline; cloud transcription and cloud language models are switched off as delivered and only become active once you enable them in the settings. Recordings are discarded after recognition and are not stored. The app keeps a history of your transcripts that lives exclusively on your device and deletes entries automatically after one year. Prompts, skills and settings are likewise stored locally. None of this is transmitted to us as long as you do not use an Ownvox account; with an account the app syncs your own skills between your devices (section 12.8). The app contains no usage analytics and no automatic crash reporting. For this purely local processing on your device we are not the controller within the meaning of Art. 4(7) GDPR: we do not receive that data, cannot access it and determine neither the purposes nor the means of its processing. You are responsible for the content of your recordings, transcripts, prompts and skills.

12.2 Licence activation and verification

When you activate the app and at regular intervals, the app checks whether your licence key is valid. For this it sends the licence key, a randomly generated identifier of the installation, the fixed label "Ownvox Desktop" and, on activation, the app's version number to our licence server at proxy.ownvox.app. Device name, user name or hardware characteristics are not transmitted. This server is operated by Hetzner Online GmbH, Gunzenhausen, Germany, in a data centre in the EU and verifies the key with Lemon Squeezy (section 7). For technical reasons your IP address and the time of the request are processed as well. When you deactivate an installation, the identifier is released again.

Legal basis: Art. 6(1)(b) GDPR (providing the licensed software). Retention: activation data is stored for the term of the licence.

12.3 Cloud transcription and cloud language models (Ownvox Cloud)

If you select cloud transcription or a cloud language model in the settings, the app sends the respective recording or prompt together with your licence key and the installation identifier (section 12.2) via our server proxy.ownvox.app (Hetzner Online GmbH, Germany) to Scaleway S.A.S., Paris, France. Scaleway runs the speech recognition or the language model in a data centre in Paris and returns the result to the app. Our server counts your usage quota in the process (see "Fair use" in the AI transcription terms).

Audio, transcripts and prompts are held by us and by Scaleway only for the duration of processing and are not stored permanently. Neither we nor Scaleway use your content to train AI models. Processing takes place exclusively in the EU.

Legal basis: Art. 6(1)(b) GDPR (the feature you chose). Data processing agreements are in place with Scaleway and Hetzner. You are responsible for the lawfulness of the recording itself, for example in conversations with third parties.

Role: for the processing of your content through Ownvox Cloud we are the controller within the meaning of Art. 4(7) GDPR in relation to you. If you use the feature professionally or commercially and thereby process personal data of third parties, we act as a processor in that respect; in that case a data processing agreement under Art. 28(3) GDPR is required before use, which you can request informally at [email protected] (see also the section "Business Use and Data Processing Agreements" of the AI transcription terms).

12.4 Your own third-party access (bring your own key)

For prompts and skills you can store your own credentials for a language model provider, for example OpenRouter or an OpenAI-compatible endpoint, or use a local model server such as Ollama or LM Studio. In that case the app sends your input directly from your device to the endpoint you chose. We are not involved in this transfer and receive no data. The privacy policy of the respective provider applies. Local model servers never leave your device.

12.5 Downloading speech models

Local recognition models are downloaded by the app, on your instruction, from the Hugging Face Hub (Hugging Face, Inc., USA). Hugging Face receives the IP address, the app identifier and the requested file. The app verifies the integrity of downloaded files using checksums. Legal basis: Art. 6(1)(b) GDPR.

12.6 Update check

If you have allowed network access in the settings, the app checks shortly after start and then every 15 minutes whether a new version is available by fetching a version file from GitHub (GitHub, Inc., USA). As delivered (strictly offline), this check does not take place. GitHub receives the IP address and app identifier. Updates are cryptographically signed; the app installs only versions signed by us. Legal basis: Art. 6(1)(f) GDPR (security and currency of the software).

12.7 Ownvox account (optional)

In the app settings you can create an Ownvox account to sync your own skills between your devices and to use your subscription on several devices. The account is voluntary: the app works fully without one, and none is created without your action. Sign-in runs through our sign-in service at auth.ownvox.app (Hetzner Online GmbH, Germany), either with a six-digit code that we send to your email address or via "Sign in with Apple". In the first case the app transmits only your email address and the code you enter. In the second case Apple Inc. confirms your identity to us and transmits the email address held at Apple or a relay address generated by Apple; Apple learns that you are signing in to Ownvox, and Apple's privacy policy applies. For technical reasons our sign-in service also processes the IP address and time of the request. Signing in transmits no device identifier, no licence key and no app version.

For your account we store the email address and the data described in sections 12.8 and 12.9. On your device the app stores a session token in the operating system's keychain and your email address in its settings; both are deleted when you sign out.

Legal basis: Art. 6(1)(b) GDPR (the account feature you chose). Retention: until you have the account deleted (an email to [email protected] is sufficient).

12.8 Syncing your skills (account only)

If you are signed in and have allowed network access in the settings, the app syncs the skills you created yourself with our server proxy.ownvox.app on every start and on request in the account settings. For each skill it transmits the name, icon, description, the full instruction text (prompt), the selected action and its assignment to the radial menu, plus the time of the last change. We store this data on our server so that all your devices receive the same state; where versions differ, the newer one wins. The built-in default skills, your transcripts, your history and your other settings are not synced. Please note that a skill prompt can contain personal data if you write it in. Syncing stops as soon as you sign out or set network access back to "strictly offline" in the settings. The sync starts automatically on every app start as long as you are signed in and have allowed network access; skills already synced are deleted on request or together with the account.

Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the skill or your account is deleted.

12.9 Linking licence and account

A button in the account settings lets you link your licence key to your account so that your subscription applies on every device where you are signed in. The app then sends the licence key together with your session token to proxy.ownvox.app, and we store the association between account and licence. As long as you do not use this button, licence verification (section 12.2) and the account are processed separately. Legal basis: Art. 6(1)(b) GDPR. Retention: for the term of the licence or until the account is deleted.

13. Recipients and transfers to third countries

The following overview summarises which service providers process data on our behalf or receive data as independent controllers:

We will provide you, on request, with the European Commission's standard contractual clauses on which we rely in this overview, together with the associated data processing agreements; an informal email to [email protected] is sufficient. Certifications under the EU-US Data Privacy Framework can be inspected at any time in the US Department of Commerce's public list at https://www.dataprivacyframework.gov.

Beyond this, we only disclose personal data if we are legally obliged to or if you have consented.

14. Retention

Unless stated otherwise above, we store personal data only for as long as necessary for the respective purpose. Order data we receive from Lemon Squeezy is deleted three years after the end of the year in which the subscription ends (section 7.2). The commercial and tax retention periods (accounting vouchers eight years, commercial books and annual accounts ten years, Section 257 German Commercial Code, Section 147 German Fiscal Code as applicable since 1 January 2025) apply on our side only to our own statements with Lemon Squeezy; the invoices to you are retained by Lemon Squeezy itself as the reseller. Each period starts at the end of the calendar year in which the document was created. Usage statistics at PostHog are deleted after twelve months. Account data and synced skills are stored until you have the account deleted. Content processed by the browser tools or the app is not stored by us at all.

Whether provision is required: you are under no statutory obligation to provide your data. For entering into and performing a subscription, for a cancellation or withdrawal, and for an Ownvox account, however, the mandatory fields are a contractual requirement: without them we cannot conclude or perform the contract, cannot attribute your declaration and cannot provide you with an account. All other data, in particular the optional fields in the bug report and the audience measurement, is voluntary; not providing it has no disadvantages for you.

Children: our offering is directed at adults. We do not knowingly process data of children under 16; if we learn of such data, we delete it without delay.

15. Your rights

You have the following rights towards us:

• Access (Art. 15 GDPR) to the data stored about you,
• Rectification (Art. 16 GDPR) of inaccurate data,
• Erasure (Art. 17 GDPR), unless a retention obligation prevents it,
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future, for audience measurement directly via "Cookie settings" in the footer.

To exercise your rights, an email to [email protected] is sufficient.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, https://datenschutz.hessen.de. You may also contact the supervisory authority of your place of residence.

16. Right to object (Art. 21 GDPR), please note separately

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). In this policy that concerns sections 4.1 (hosting), 4.2 (Cloudflare), 5 (technically necessary storage), 7.2 (retention of order data until the limitation period expires), 7.3 (server-side purchase statistics), 8 (contact by email), 9 (bug report and abuse protection) and 12.6 (update check). If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal email to [email protected] is sufficient; no particular form is required.

17. No automated decisions, no sharing for advertising

We make no automated decisions within the meaning of Art. 22 GDPR and do no profiling. We do not sell personal data and do not share it for advertising purposes.

18. Security

All connections to ownvox.app and to our servers are encrypted with TLS. The website uses, among other things, HTTP Strict Transport Security and a Content Security Policy that restricts the loading of third-party scripts to the services named here. Form input is validated on the server.

19. Changes to this policy

We update this policy when our processing, the service providers we use or the legal situation change. The current version with date and version number is always available at ownvox.app/en/privacy. For material changes that affect you as a customer, we will additionally inform you by email.