You can vote for a feature on GitHub, or here with your email address. With the address, our server keeps:

• Your address, encrypted (AES-256-GCM), and only while we still have to write to you: a confirmation link is open, you asked to hear when the feature ships, or a letter to you is waiting to go out. Once none of that is true, the address is erased within the hour.
• A keyed fingerprint of the address (HMAC-SHA-256). It can't be turned back into the address without our key. It is how one address counts once, and how we know it's you when you vote again or change a vote. It stays until you delete your address.
• Your votes: which features, and when you voted. With “Tell me when it ships”, which features you want to hear about.
• The links we send, as hashes only. A confirmation link counts your vote once and stops working after 30 minutes. The link to manage your votes works until you delete your address.
• The letters we send: waiting in a queue until they go, then a short record of each sent one (its kind and feature, not the address) for 30 days. A letter that still fails after five tries keeps its address for up to 7 days, so we can send it again, then it is deleted.

Why: to count your vote once, to send the letters you asked for, and nothing else. We send one email to confirm and, if you ask, one more when the feature ships or if it's dropped. No newsletter, ever. We don't accept any text from you, only the address and the feature.

An address that is never confirmed is deleted, with its vote, 24 hours after it last voted.

Every email we send has a link to your votes. There you can take a vote back, stop an email, or press Delete my address: the address, its fingerprint, its links and any letter still waiting go at once, and can't be brought back.

Lost the email? Vote again with the same address: the email that comes carries the link again. Or write to us at [email protected], and we'll delete it for you.

What stays: a vote you confirmed still counts, as a number on the feature, with nothing to tie it to you: no address, no fingerprint, no date. If you come back with the same address, you vote again as someone new.

Our database is backed up once a day and the copies are kept for 14 days, so a deleted address is gone from them within two weeks.

Our letters go out through Resend. To send one, Resend gets your address and the letter. Open and click tracking are off: no pixel in the letter, and every link in it goes straight to speech-text.app or GitHub. Every letter can be unsubscribed from with one click.

• No cookies. We set none. Your browser keeps three small choices of yours, on your device only: light or dark, the display colour you picked, and the typing speed you entered. They are never sent anywhere.
• No IP addresses stored. Our server uses yours for a moment, in memory, to limit how many votes can come from one place, and doesn't write it down.
• Visits. We count visits with GoatCounter on our own server: no cookies, no IP addresses stored, nothing shared. Besides page views it counts a few actions by name, like Download or Vote, never with anything you typed.
• No CAPTCHA service. To keep bots from voting, your browser solves a small puzzle for a fraction of a second. It's our own server that sets and checks it.
• Cloudflare sits in front of speech-text.app, to keep the site fast and up under load. It decrypts the connection on its way to us, so what you send here passes through it, your IP address and, when you vote, your email address included. It handles that under its own privacy policy. Its analytics and the scripts it could add to pages are off.
• The video on the home page comes from our storage at DigitalOcean, in Frankfurt. Your browser fetches it from there once the rest of the page has loaded, so DigitalOcean sees your IP address, under its own privacy policy. Its CDN may set a short-lived cookie of its own (__cf_bm, from Cloudflare, which runs it) to tell bots from people; we don't read it.
• Nothing else. The fonts and every image are served from speech-text.app. No ads, no social buttons, no third-party scripts.

The roadmap is built from public GitHub data; your browser never talks to GitHub from this page. It talks only to our own server, for the live vote counts and to vote. Voting on GitHub happens on GitHub, under its terms.

None of the above is about the app. SpeechText has no account, no telemetry and no analytics, and the app talks to no server of ours. With a local model, your audio never leaves your Mac, and with Apple's engine it stays there while you dictate. With Groq, ElevenLabs or OpenAI, it goes to that provider, with your key, under their privacy policy. AI Rewrite sends text, never audio, to the provider you chose, unless it runs on your Mac. History stays on your Mac, and your keys go only to the provider they belong to.

The details are in the app's README and SECURITY.md, and the code is open to check.