Dicta
Join the waitlist

Privacy

Your voice is the most personal data you produce. By default, Dicta never sends it anywhere: not to us, not to a cloud, not to a model provider. Speech recognition, vocabulary correction and AI rewriting all run on your machine, unless you deliberately turn on the one opt-in exception described below. This page explains that in plain language, covers that exception, the usage statistics Dicta does collect, and the little that the website itself handles.

The one exception: Dicta Pro lets you connect an external AI provider (Claude, OpenAI, Mistral) or your own custom endpoint for the AI rewrite, instead of the built-in on-device model. It is off by default. If you explicitly turn it on, the text being rewritten, your dictated text today, and your selected text once Select & Speak ships, is sent to that provider for the rewrite, under that provider's own terms. Until you turn it on, Dicta sends nothing: the rewrite stays on your Mac exactly as described above.

Who is responsible

The controller for this website and for the limited data described below is GetDicta UG (haftungsbeschraenkt), Leonhardweg 8, 86842 Tuerkheim, Germany. You can reach us at hello@getdicta.ai. Company details are in the Imprint.

What never leaves your Mac

To make "My Words" useful faster, Dicta can read the words you have taught the macOS spell checker (the user dictionary in ~/Library/Spelling) and suggest them for import. The suggestion is shown to you in Settings first, nothing is imported without your confirmation, and these words stay on your Mac either way.

Syncing across your devices

While your license is active, Dicta syncs your settings, your personal dictionary ("My Words"), replacement rules, styles and analysis frameworks between your own devices, so switching Macs keeps them in step. This is on by default; turn it off in Settings > Sync to keep any one device local-only.

This plane is end-to-end encrypted: your device derives the encryption key from a random secret that is minted on your device and shared only with your own other devices, via iCloud Keychain, never with our server. Our server stores and relays only the resulting ciphertext, an opaque blob it cannot decrypt, alongside a hash of your license key used only to address it. Your dictated audio, transcripts and dictation history are never part of this plane; they stay local and are never uploaded to our server in any form.

The only network calls the app ever makes

Dictation itself needs none of these. You can verify it yourself: with the default on-device setup, run Dicta with a firewall in block-all mode and dictation, corrections and the AI rewrite keep working.

Model download
Downloads the speech and rewrite model files from the model host (Hugging Face CDN) the first time you need them. Carries no audio or text.
Update check
Checks for a new app version (Sparkle). Carries no audio or text.
License activate / refresh
Sends a hashed license key and a device id, at most weekly. Your license validates offline for its whole paid or trial term, so no call is ever required mid-term; after the term ends there is a 3-day offline grace period on a paid subscription and none on a trial. Never carries audio or text.
Usage statistics
A daily rollup of aggregate counters, linked to your license: dictations, words, audio duration, model usage, app version and platform. Never your audio, transcripts or clipboard content. On by default, with an off switch in Settings > Data & Privacy; see "Usage statistics" below for the full detail.

Usage statistics

Dicta measures product usage so we can improve it. Each day, your Mac uploads a small set of aggregate counters, linked to your license, never your content:

That is the entire payload. Your audio, transcripts, dictation history and clipboard content are never included and never leave your device, in any form; usage statistics are a separate, additional feature and do not change that promise.

Usage statistics are on by default, and upload only from a paid, activated install: a Free install or a running trial sends none at all, whatever the setting shows. You can turn them off at any time in Settings > Data & Privacy, and the change takes effect immediately. If you are on a Team plan, an admin may centrally enable and lock this setting for your seat, the same way they can lock other centrally managed settings. We rely on our legitimate interest in maintaining and improving Dicta for this collection (Art. 6(1)(f) GDPR).

We retain usage statistics for 13 months, then delete them. You can request erasure of your usage-statistics history at any time by e-mailing hello@getdicta.ai, separately from any request about your dictation content, which we never held to begin with.

The website: what we handle here

The site is hosted on Cloudflare. Like any web host, Cloudflare processes technical request data (such as your IP address and the page requested) to deliver pages and keep the service secure. We rely on our legitimate interest in a working, secure site for that (Art. 6(1)(f) GDPR), and this data is kept only briefly.

For visitor numbers we use Cloudflare Web Analytics: cookieless, no fingerprinting, no cross-site tracking. There is no Google Analytics, no advertising pixel, no third-party tag. Fonts are self-hosted, so your browser never calls a font CDN.

Cookies and consent

Today this site sets no tracking cookies. The only thing we store in your browser is your choice on the consent banner itself, which is strictly necessary so we do not ask you again. Visitors from the EU/EEA, Switzerland and the UK see that banner, with Accept and Reject offered equally. If you reject, or never decide, nothing beyond the strictly necessary runs. The banner is here so that if we ever add anything that would need cookies, it loads only after you say yes, and never before.

Waitlist

If you join the waitlist, we store your e-mail address and a record of your opt-in (a timestamp) so we can e-mail you about the launch, and for nothing else. The legal basis is your consent (Art. 6(1)(a) GDPR). This is kept in a Cloudflare D1 database hosted in the EU, for up to 730 days or until you unsubscribe, whichever comes first. Unsubscribing is a hard delete: we remove the record. There is no marketing automation and no sharing with third parties.

Buying at launch

There is no checkout yet, so no payment data is collected today. When purchasing goes live, payment, invoicing and tax will be handled by Stripe as our payment processor; card and billing details stay with Stripe, and on our side we keep only what licensing needs (a Stripe customer id, a hashed license key, device activations, and referral state) in the EU-hosted D1 database. Full detail will be added here before checkout opens.

Who we share data with

We keep the list of processors deliberately short: Cloudflare (website hosting, cookieless analytics, and the EU database), the model host (Hugging Face CDN, which serves model files to the app and receives no account data), and, once purchasing is live, Stripe (payments and invoicing). We do not sell data, and there are no advertising or tracking partners.

Where data is stored

The waitlist and licensing database runs in Cloudflare's EU jurisdiction. Model files are fetched from a content delivery network that may serve them from outside the EU; that download carries no account data. Where a transfer outside the EU happens, it is covered by the standard safeguards the provider offers.

Your rights

You have the usual GDPR rights over any personal data we hold:

To exercise any of these, e-mail hello@getdicta.ai. You also have the right to complain to a data protection authority, for example the one for our region, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

GDPR-friendly by architecture

By default, Dicta processes your voice and text entirely on your device, under your control: your audio, transcripts and dictation history never establish a processor relationship with us, because we never receive them. The usage statistics described above are the one deliberate exception, they are not a side effect of how the app works, and you can turn them off at any time. We phrase this as "GDPR-friendly by architecture" for your content, never as "GDPR certified" overall, and this page is not legal advice.

This page describes the architecture as built. The final legal copy is pending a lawyer's review before launch; nothing above is legal advice.