Your voice stays yours.

• While you hold the hotkey, your microphone is on.
• In Cloud mode, audio is sent to a transcription service. In On-device mode, speech recognition runs on your Mac. Cloud processing and provider retention are explained below.
• On-device mode (Settings → Transcription → On your Mac): On-device transcription processes speech on an Apple Silicon Mac after the model is downloaded. It does not send that recording to the cloud transcription service. Account, licensing, and update checks have separate network behavior. Usage reporting and enabled diagnostics can also use the network outside a local dictation.
• Halopen does not record continuously. It does not transcribe in the background. It does not capture your screen.
• Halopen stores a small amount of operational metadata on the server — your account, your subscription state, and per-device data so your /account/ page can show you which Macs you’ve signed into. No transcripts, no audio.
• Your dictation text lives in the local audit log on this Mac, controlled by you. Each dictation’s transcript (and, if Polish or Editorial cleanup ran, the cleaned text) is kept in ~/Library/Application Support/Halopen/audit-log.json with owner-only file permissions, so you can copy any past dictation back if it went somewhere unexpected. Halopen never uploads this file. You control retention from Settings → Privacy (default: Keep everything; you can pick 7 / 30 / 90 days, or Off to clear everything and stop recording).
• Halopen uses service providers for cloud transcription, accounts, payments, and diagnostics. The sections below describe what those services receive and the controls available to you.

Halopen now ships two transcription pipelines, and the privacy posture is different in each. Pick the one that fits the moment.

• Cloud (default) — audio is uploaded to our transcription endpoint while you hold the hotkey, transcribed via OpenAI’s gpt-4o-transcribe, returned as text, and discarded by our endpoint. Provider retention is described under Subprocessors. Local history records transcripts and supported app events; it does not enumerate every network request.
• On your Mac (optional, opt-in) — audio is transcribed on Apple Silicon via WhisperKit. The model file (~600 MB) lives at ~/Library/Application Support/Halopen/Models/. The recording is processed locally. The audit log records the dictation with “(local)” as the endpoint so you can identify the transcription route and copy the transcript later. Requires an M-series Mac.

You can switch between the two at any time from Settings → Transcription. The choice is local to your Mac; it doesn’t affect billing.

A “(local)” dictation entry identifies the transcription route. The audit log is not a monitor of every network request made by your Mac or the app.

To dictate text, Halopen needs to hear what you say while you hold the hotkey and to know that you held the hotkey. Specifically, when the hotkey is held:

• Microphone audio — captured through the microphone and written to a temporary local WAV file during the take. The normal processing path deletes the temporary file; eligible failed takes can be copied to local recovery storage, limited to seven days or 20 entries. See the storage section below.
• Hotkey state — when you start and stop holding the key.

In Cloud mode, audio can be sent while you speak when streaming is enabled, or after release through the batch path. On-device recognition processes the recording locally. After successful transcription, Halopen attempts to insert the completed text into the intended input field.

When the hotkey is not held, the microphone is not active. Halopen does not stream audio continuously. There is no “always-on” mode.

Halopen can supply recognition hints alongside audio. In Cloud mode, available hints can be sent to the transcription service. The controls are in Settings → Transcription:

• Personal dictionary. The vocabulary-biasing switch is on by default. Dictionary entries you added can be included in the prompt.
• Foreground-app label and routing hint. When vocabulary biasing is enabled, the prompt can also identify the app or its kind (for example, a terminal) and include a per-app recognition hint. An unrecognized app can contribute its displayed app name. These hints do not depend on the separate clipboard/selection switch.
• Selected text, clipboard text and cursor-adjacent text. The switch labeled “Also bias with clipboard and selected text” is off by default. When enabled with vocabulary biasing, it also permits text immediately before the cursor to be read through Accessibility. The source limits are up to 300 characters of selected text, 200 of clipboard text and 200 before the cursor, before the combined prompt limit.

Clipboard and cursor-context reads use a heuristic credential filter; selected text does not use that same filter. None of these limits or filters guarantees that confidential material is excluded. Enable optional context only when the material in those sources is appropriate for the selected processing route.

Turn off “Bias transcription with your personal dictionary” to disable this composed bias prompt, including app/routing hints. Turning off only the clipboard/selection switch leaves dictionary and app/routing hints available. On-device recognition keeps its processing local; account, licensing, updates, enabled diagnostics and your destination app have separate network behavior.

In Cloud mode, hotkey-bounded audio is sent to our hosted transcription endpoint. The endpoint forwards the clip to a third-party automated speech recognition service, returns the text to your Mac, and discards the audio. Halopen does not retain the audio on the server. Our transcription provider does not train on it, and may hold it briefly for abuse monitoring — the exact terms are in Subprocessors below, stated plainly rather than summarised optimistically here.

The hosted transcription path does not retain audio or transcript content in its application logs. Operational logs are limited to operational metadata (timestamps, anonymous request IDs, response times) used for monitoring uptime, with no transcript content recorded.

The live transcription preview uses Apple Speech Recognition with your permission. It requires on-device recognition when Apple reports that support; otherwise Apple Speech may use its service. Halopen disables this preview in its On your Mac transcription mode. You can also turn the preview off in Settings → Transcription.

Preview text is provisional and is not the final transcription or a fallback transcript. The completed stream or selected transcription pipeline supplies final text. The preview has a separate data path from Halopen’s hosted transcription endpoint.

Halopen keeps more on your Mac than it used to, and on purpose: the history and recovery features retain information locally. These records are separate from cloud processing. Retrying a retained recording in Cloud mode can send that recording for transcription again.

Preferences, in the standard macOS user defaults database:

• Your chosen hotkey, recording-pill preference, and sound-cue preference.
• A monthly transcription-minutes counter so the menu can show you usage.
• The license token associated with your subscription, after you sign in.

And in ~/Library/Application Support/Halopen/, readable only by your account:

• Your dictation history and audit log (audit-log.json) — the transcript of each dictation, alongside recorded transcription and diagnostic activity. It lets you copy back a dictation that landed in the wrong window and identify the transcription route used for that take. It is not a complete network log. You choose how long it is kept in Settings → Privacy: keep everything, 7, 30 or 90 days, or Off, which erases it and stops recording.
• Saved audio from failed takes (audio-recovery/) — when a dictation cannot be transcribed, the audio is held so the words are not simply gone. Deleted automatically after 7 days, or after 20 takes, whichever comes first. Nothing is sent anywhere unless you press “Retry transcribe & copy”, which transcribes it exactly as a live dictation would.
• Recovered text (recovery.json) — transcripts that could not be typed into the app you were using, held so you can paste them yourself.
• A crash-safety log (transcript-wal/) — when text recovery is enabled, Halopen attempts to save completed transcripts before insertion. Writes can fail. Entries are cleared when processing completes or text is preserved elsewhere; a cleared entry does not prove that the destination app accepted a paste. Remaining entries are offered on the next launch. This reduces some recovery risks but cannot guarantee survival from every crash, Force Quit or power loss. With recovery off, nothing is written here. See Settings for retention controls.
• The on-device model (Models/) — about 600 MB, only if you have downloaded it for on-device mode.

To see it and erase it: open Settings → Privacy → Stored on this Mac (Halopen 1.8.21 or later). It shows what is actually on your disk right now, with live counts and sizes, a Clear beside each one, and Show in Finder if you would rather look yourself — which is the point: this page tells you what we keep, and that pane lets you check whether it is true.

Erase all Halopen data… removes your dictation history and audit log, saved audio, recovered text and the crash-safety log in one action. It deliberately leaves three things: you stay signed in, your settings and personal dictionary are kept, and the on-device model stays installed (remove that from Settings → Model, since re-downloading it is about 600 MB). Deleting the app alone removes none of this, and neither does deleting its preferences file.

• Your screen. Halopen does not capture, share, or analyze your display.
• Your typing. Halopen does not log keystrokes apart from detecting whether the hotkey is currently held.
• Other applications. Halopen identifies the foreground app for delivery and can include an app label and routing hint in the bias prompt. The optional context switch also permits selected and cursor-adjacent text as described above.
• Your clipboard. Halopen uses the clipboard when inserting text. If you enable clipboard context, a snippet can also be used for vocabulary biasing as described above.

Halopen includes usage and error diagnostics. You can turn off app analytics and crash reporting in Settings → Privacy. This does not turn off account, licensing, or update requests.

App diagnostics use PostHog for explicit usage events and Sentry for error reporting when those services are configured and diagnostics are enabled. The event interface records operational properties such as counts, durations, and outcomes; it is not intended to collect your dictated text.

The website also uses analytics to understand page visits and actions such as trial and download clicks. Website PostHog tracking uses tab-scoped session storage and disables session recording. The footer provides a PostHog opt-out; it does not disable Plausible visit analytics. Website and app controls are separate.

On public pages, Halopen can retain the first referring website, landing-page path and recognized campaign parameters in this browser. When you are signed in on a public page, this attribution may be attached to your account. The server also records a capture time and a hash of the request IP address.

Account and checkout-return pages do not run this capture. Landing-page query strings and fragments are excluded; only recognized campaign fields are kept separately. Referrers are reduced to their website origin. Legacy browser attribution bags are discarded before forwarding. Previously saved server records are not changed by this update.

Halopen relies on the following hosted services to function. None receive identifying information beyond the minimum required for operation.

• Supabase — hosts our transcription endpoint, account database, and edge functions. Stores account email, subscription state, and per-device records so /account/ can list signed-in Macs.
• OpenAI — performs the speech-to-text transcription. OpenAI may briefly retain audio for abuse monitoring per their standard API policy (up to 30 days, then deleted). OpenAI does not train on API data sent through this endpoint. We have not negotiated a Zero Data Retention agreement; if that ever changes, this line gets updated.
• Cloudflare — serves halopen.com and the download. Sees IP addresses (anonymized in our analytics).
• Stripe — processes payments and manages subscriptions. Stripe sees the billing details you provide at checkout (name, billing address, card last-4); Halopen receives only the subscription-state events back via webhook.
• Resend — sends transactional email (sign-in confirmations, comp-grant notifications, refund receipts). Sees the recipient email address and the transactional content of each message.
• PostHog and Sentry — provide usage analytics and error diagnostics as described above. Availability depends on the relevant app or website configuration and your opt-out settings.
• Plausible — measures website visits and actions such as trial and download clicks. The footer’s PostHog opt-out does not disable this separate analytics service.

Halopen is not directed at children under 13 and we do not knowingly collect personal information from them. The product is offered to general audiences.

If we change this policy in a way that materially expands what we collect or retain, we will email subscribers and post the change at the top of this page before it takes effect. The previous version remains available on request.

Questions, deletion requests, or anything else: email [email protected]. We answer in person, usually within a day.