Your voice stays yours.

• While you hold the hotkey, your microphone is on.
• When you release the hotkey, your audio is sent to a transcription service, returned as text, and immediately discarded. Audio is never stored on the server.
• On-device mode (Settings → Transcription → On your Mac) skips the server entirely. Your audio is transcribed locally on Apple Silicon. Nothing leaves the device. The audit log inside Halopen still records the dictation locally so you can recover the text, but the endpoint shows "(local)" — confirming no network call happened.
• Halopen does not record continuously. It does not transcribe in the background. It does not capture your screen.
• Halopen stores a small amount of operational metadata on the server — your account, your subscription state, and per-device data so your /account/ page can show you which Macs you’ve signed into. No transcripts, no audio.
• Your dictation text lives in the local audit log on this Mac, controlled by you. Each dictation’s transcript (and, if Polish or Editorial cleanup ran, the cleaned text) is kept in ~/Library/Application Support/Halopen/audit-log.json with owner-only file permissions, so you can copy any past dictation back if it went somewhere unexpected. Halopen never uploads this file. You control retention from Settings → Privacy (default: Keep everything; you can pick 7 / 30 / 90 days, or Off to clear everything and stop recording).
• Halopen does not sell or share your data. Nothing you dictate is kept on our servers, and what is kept on your Mac never leaves it.

Halopen now ships two transcription pipelines, and the privacy posture is different in each. Pick the one that fits the moment.

• Cloud (default) — audio is uploaded to our transcription endpoint while you hold the hotkey, transcribed via OpenAI’s gpt-4o-transcribe, returned as text, and discarded. Highest accuracy. Audit log records each call, including the resulting transcript text (locally, on your Mac).
• On your Mac (optional, opt-in) — audio is transcribed on Apple Silicon via WhisperKit. The model file (~600 MB) lives at ~/Library/Application Support/Halopen/Models/. Nothing about the audio leaves the device. Audit log records the dictation with “(local)” as the endpoint so you can confirm at a glance that no network call happened, and so you can copy the transcript again later if you need to. Requires an M-series Mac.

You can switch between the two at any time from Settings → Transcription. The choice is local to your Mac; it doesn’t affect billing.

To dictate text, Halopen needs to hear what you say while you hold the hotkey and to know that you held the hotkey. Specifically, when the hotkey is held:

• Microphone audio — captured by the operating system and held in memory in a temporary buffer.
• Hotkey state — when you start and stop holding the key.

When the hotkey is released, the buffered audio is compressed and uploaded to our transcription service (Cloud mode) or transcribed entirely on your Mac (on-device mode), and the resulting text is placed at your cursor in the active app.

When the hotkey is not held, the microphone is not active. Halopen does not stream audio continuously. There is no “always-on” mode.

Halopen can pre-feed context to the transcription engine so proper nouns, brand names, and technical terms land on the first pass. Two sources, with different privacy properties:

• Personal dictionary — words you've added yourself in Settings → Vocabulary. Default ON. When biasing is enabled, your dictionary entries are sent to the transcription engine alongside the audio in Cloud mode; in on-device mode they stay on your Mac. This is content you explicitly authored, so we surface it by default.
• Clipboard contents and currently-selected text — up to 200 characters of the macOS clipboard and 300 characters of the focused app's selected text. Default OFF. When this toggle is on, in Cloud mode Halopen sends those snippets to the transcription service alongside the audio as a spelling hint. We default it off because clipboard contents can contain passwords, API keys, or other material a user copied for a different purpose and would not want sent to a transcription service. A heuristic filter rejects content that looks like a credential (long high-entropy strings, common credential prefixes, password-like words), but the filter is defense in depth — the primary safeguard is leaving the toggle off until you decide otherwise.

The biasing toggles are in Settings → Transcription. Switch the transcription mode to On your Mac if you want the clipboard / selection bias without any network exposure.

Audio leaves your Mac in only one circumstance: a hotkey-bounded clip is sent to our hosted transcription endpoint. The endpoint forwards the clip to a third-party automated speech recognition service, returns the text to your Mac, and discards the audio. Halopen does not retain the audio on the server. Our transcription provider does not train on it, and may hold it briefly for abuse monitoring — the exact terms are in Subprocessors below, stated plainly rather than summarised optimistically here.

The local recording, the network upload, and the returned text are all ephemeral. None of them are written to disk on the server. Logs are limited to operational metadata (timestamps, anonymous request IDs, response times) used for monitoring uptime, with no transcript content recorded.

Halopen keeps more on your Mac than it used to, and on purpose: the features that stop a finished dictation from ever being lost all work by writing it down. None of it is ever uploaded. This is your disk, not ours.

Preferences, in the standard macOS user defaults database:

• Your chosen hotkey, recording-pill preference, and sound-cue preference.
• A monthly transcription-minutes counter so the menu can show you usage.
• The license token associated with your subscription, after you sign in.

And in ~/Library/Application Support/Halopen/, readable only by your account:

• Your dictation history and audit log (audit-log.json) — the transcript of each dictation, alongside a record of every cloud call Halopen made. It is what lets you copy back a dictation that landed in the wrong window, and what lets you check for yourself that on-device mode makes no network call. You choose how long it is kept in Settings → Privacy: keep everything, 7, 30 or 90 days, or Off, which erases it and stops recording.
• Saved audio from failed takes (audio-recovery/) — when a dictation cannot be transcribed, the audio is held so the words are not simply gone. Deleted automatically after 7 days, or after 20 takes, whichever comes first. Nothing is sent anywhere unless you press “Retry transcribe & copy”, which transcribes it exactly as a live dictation would.
• Recovered text (recovery.json) — transcripts that could not be typed into the app you were using, held so you can paste them yourself.
• A crash-safety log (transcript-wal/) — in the one to three seconds between a transcript existing and it reaching your cursor, the text is written here so that a crash, a Force Quit or a power loss cannot make your words disappear. It is deleted the moment the text lands, so in normal use this folder is empty; anything left behind is picked up and offered back to you on the next launch. It follows the same retention setting as recovered text — with recovery off, nothing is written here at all.
• The on-device model (Models/) — about 600 MB, only if you have downloaded it for on-device mode.

To see it and erase it: open Settings → Privacy → Stored on this Mac (Halopen 1.8.21 or later). It shows what is actually on your disk right now, with live counts and sizes, a Clear beside each one, and Show in Finder if you would rather look yourself — which is the point: this page tells you what we keep, and that pane lets you check whether it is true.

Erase all Halopen data… removes your dictation history and audit log, saved audio, recovered text and the crash-safety log in one action. It deliberately leaves three things: you stay signed in, your settings and personal dictionary are kept, and the on-device model stays installed (remove that from Settings → Model, since re-downloading it is about 600 MB). Deleting the app alone removes none of this, and neither does deleting its preferences file.

• Your screen. Halopen does not capture, share, or analyze your display.
• Your typing. Halopen does not log keystrokes apart from detecting whether the hotkey is currently held.
• Other applications. Halopen reads the bundle identifier of the foreground app to send your typed text there. It does not read other applications’ content.
• Your clipboard. Halopen briefly snapshots and restores your clipboard around an injection so it isn’t clobbered. The snapshot is discarded immediately.

Halopen relies on the following hosted services to function. None receive identifying information beyond the minimum required for operation.

• Supabase — hosts our transcription endpoint, account database, and edge functions. Stores account email, subscription state, and per-device records so /account/ can list signed-in Macs.
• OpenAI — performs the speech-to-text transcription. OpenAI may briefly retain audio for abuse monitoring per their standard API policy (up to 30 days, then deleted). OpenAI does not train on API data sent through this endpoint. We have not negotiated a Zero Data Retention agreement; if that ever changes, this line gets updated.
• Cloudflare — serves halopen.com and the download. Sees IP addresses (anonymized in our analytics).
• Stripe — processes payments and manages subscriptions. Stripe sees the billing details you provide at checkout (name, billing address, card last-4); Halopen receives only the subscription-state events back via webhook.
• Resend — sends transactional email (sign-in confirmations, comp-grant notifications, refund receipts). Sees the recipient email address and the transactional content of each message.

Halopen is not directed at children under 13 and we do not knowingly collect personal information from them. The product is offered to general audiences.

If we change this policy in a way that materially expands what we collect or retain, we will email subscribers and post the change at the top of this page before it takes effect. The previous version remains available on request.

Questions, deletion requests, or anything else: email hello@halopen.com. We answer in person, usually within a day.