Privacy policy

The short version

• The app works on your Mac. Your audio and your transcripts are processed locally and are never sent to us or to anyone else.
• The website sets no cookies and stores nothing on your device. We count visits with PostHog, without cookies, without visitor profiles and without recordings; you can switch it off.
• Payments are handled by Polar. We never see your card details.
• We store what is needed to run your licence: the licence key, the Macs it is activated on, and your email address.
• We send the newsletter only if you asked for it and confirmed your address.
• We do not sell personal data and we do not use it for advertising by others.

Who is responsible

The controller within the meaning of the GDPR is Dylan Ryan, Gdańsk, Poland, the maker of OptionSpace (“we”). The full postal address is in the Imprint. For anything about your data, write to support@optionspace.app.

We have not appointed a data protection officer, because the law does not require one for us.

Visiting the website

The website consists of static files that are delivered by Cloudflare. To deliver a page, Cloudflare has to process your IP address and the usual technical details of the request (time, the page requested, browser type). It keeps this data for a short time in its logs to operate and protect its network. We do not combine it with anything else and we do not create visitor profiles.

The website stores nothing on your device: no cookies, no local storage, no session storage. Fonts and scripts are loaded from optionspace.app only.

Legal basis: our legitimate interest in running a secure and reliable website (Art. 6(1)(f) GDPR).

Website statistics

We use PostHog to see how the website is used: how many people visit, where they come from and whether the page does its job. PostHog (PostHog Inc., USA) processes the data on our behalf and stores it in the European Union (Frankfurt, Germany).

How it is set up

• No cookies and nothing stored on your device. A random number is created each time the site loads and kept in the memory of the page only. When you reload or come back, you count as a new, unknown visitor. We cannot recognise you across visits or across websites.
• No visitor profiles, no recordings of your screen or your input, no advertising.
• Only the events listed below are recorded; nothing else on the page is captured automatically. Advertising click identifiers that some links carry are dropped.
• The data is sent to an address on optionspace.app, which passes it on to PostHog’s servers in the EU.
• If your browser sends a Global Privacy Control or Do Not Track signal, the statistics script is not loaded at all.

What is collected

• the pages you view, the page you came from and campaign parameters in the link (UTM);
• clicks on the Buy and Download buttons, that the newsletter form was sent (never the email address), and a few interactions such as opening a question in the FAQ or pausing the demo;
• general details of your device and browser, such as device type, browser, operating system and screen size;
• your IP address, which reaches PostHog with every request. It is used to work out an approximate location, such as the country, and is then discarded; it is not stored with the data.

Purchases and newsletter confirmations

To learn which campaigns lead to purchases, the campaign parameters (UTM) you arrived with are added to the link to the checkout when you click “Buy”, so Polar receives them with your order. No number that identifies you or your visit is added.

After a completed purchase our licence service sends PostHog one entry: the amount and currency, the country of the billing address, whether a discount code was used and whether it was a newsletter code, and the campaign parameters if there were any. When a newsletter subscription is confirmed, it sends an entry that says only that. Both are sent under one fixed sender name that is the same for everyone, without name, email address, IP address, customer number or order number, so PostHog cannot link them to a visit or to a person.

Legal basis and storage period

Our legitimate interest in understanding and improving the website and in knowing which channels lead to purchases (Art. 6(1)(f) GDPR). The data is kept for up to 12 months and then deleted.

How to switch it off

You can object to this at any time. Turn on Global Privacy Control or Do Not Track in your browser: the statistics are then switched off for you, and nothing is added to the checkout link. A content blocker stops the statistics as well. The website works exactly the same without the statistics. Purchases and confirmed newsletter subscriptions are still counted in the anonymous form described above.

Buying a licence

When you click “Buy”, you leave this website and go to the checkout of Polar (Polar Software, Inc., USA). Polar is the merchant of record: it sells you the licence, takes the payment, calculates and pays the tax, sends your receipt and delivers your licence key. For this it collects your name, email address, billing address and payment details and is responsible for that data itself. Its privacy policy explains the details. We never receive your card or bank details.

After the payment Polar sends you back to a page on this website. The address of that page contains a checkout number, which the page neither reads nor stores and which is left out of the website statistics.

Polar passes the following order data on to us: your email address, your name, your country, the order number and the licence key that belongs to the order. Customer and licence records in our Polar account are kept by Polar on our behalf.

We use the order data to:

• give you the licence, help you with it and handle a refund (performance of a contract, Art. 6(1)(b) GDPR);
• keep the business records that tax and accounting law require (legal obligation, Art. 6(1)(c) GDPR);
• prevent misuse of licence keys and deal with legal claims (our legitimate interest, Art. 6(1)(f) GDPR).

Storage period: accounting records are kept for five years from the end of the calendar year in which the tax was due, as Polish tax law requires. Order data that is linked to your licence is kept as described in the next section.

Activating and checking your licence

OptionSpace has to be activated with a licence key. For this the app contacts our licence service at api.optionspace.app, which runs on Cloudflare. After that the app checks the licence there about every 7 days, and when you open the licence settings. The licence service stores:

• your licence key (as a cryptographic hash where possible) and its status, for example active or refunded;
• for each activated Mac: an identifier of the Mac in hashed form, which we cannot turn back into the original, the name of the Mac as set in macOS (for example “Anna’s MacBook Pro”), the app version, and the times of the activation and of the last check;
• for a licence bought through Polar: your email address as Polar sends it to us, and Polar’s customer and order numbers.

For licences bought through Polar, each activation (the name of the Mac and its hashed identifier) is also recorded at Polar, which keeps the list of Macs per licence. You can see the names there in Polar’s customer portal.

Your IP address is processed when the app contacts the service, as with any request on the internet. We use it to limit abusive requests: for this, only a shortened hash of the address is kept in a counter, which is deleted after about a day (25 hours at most). We keep no logs of the individual requests, and we do not store IP addresses with your licence.

Legal basis: performance of the licence agreement (Art. 6(1)(b) GDPR) and, for protection against misuse, our legitimate interest (Art. 6(1)(f) GDPR). Without this data a licence cannot be activated.

Storage period: the entry for a Mac is deleted when you deactivate that Mac. The licence record is kept for as long as the licence exists. If a licence is refunded or revoked, we keep the record with that status so that the key cannot be used again, and delete it when it is no longer needed for that or for legal claims.

Using the app

Speech recognition runs on your Mac. Your audio, your transcripts, your dictation history, the screenshots and files you attach and your usage statistics are stored only on your Mac. They are not sent to us, to Cloudflare or to anyone else, and we cannot access them. The app contains no analytics and no crash reporting that sends data to us.

The app itself is a public download from our server. Downloading it needs no account, no licence key and no email address.

The app connects to the internet in three cases only:

• Licence activation and checks, as described above.
• One-time download of the speech model (about 600 MB) the first time you start the app. The file is downloaded directly from Hugging Face (Hugging Face, Inc., USA). As with any download, Hugging Face sees your IP address and technical details of the request and is responsible for that data itself; see its privacy policy. Nothing about you or your dictations is sent, and we receive no data from this download. The download is needed for the app to work (Art. 6(1)(b) GDPR).
• Updates. To find out whether there is a new version, the app fetches a public file from our server, on its own from time to time or when you ask it to check, and downloads the update from there if you install it. These are plain file requests. Like any request they carry your IP address and the version of the app, but no licence key, no identifier of your Mac and no information about your system or your use of the app. We keep no record of them. Legal basis: our legitimate interest in keeping the app secure and up to date (Art. 6(1)(f) GDPR).

Newsletter

If you subscribe, we send you the OptionSpace newsletter by email: product news, tips and occasional offers. Subscribing is voluntary and is not needed to buy or use OptionSpace.

How it works

You enter your email address on the website. We then send one email with a link to confirm the address (double opt-in). That email contains nothing but the request to confirm. Only after you click the link are you subscribed. Sign-ups that are not confirmed are deleted after 7 days.

After the confirmation we create a personal, single-use 20% discount code in our Polar account and email it to you. Your email address is not passed to Polar for this. The code has no expiry date.

What we store

• your email address;
• the times of the sign-up and of the confirmation and, if you unsubscribe, the time of that;
• the wording of the consent you gave (its version);
• your IP address at the sign-up and at the confirmation, in shortened form (an IPv4 address without its last part, an IPv6 address cut to its first three groups), as part of the proof that the consent was given. The full IP address is not kept;
• the discount code that was issued for your address, together with a hash of the address, when the code was sent, and whether and when it was used for a purchase.

So that the form cannot be misused to send email to other people, sign-ups are limited: a counter under a hash of the email address and a counter under a shortened hash of the IP address are kept for about a day.

The newsletter and the discount code are stored in our own database on Cloudflare and sent with Cloudflare’s email service from hello@optionspace.app. Replies go to support@optionspace.app. We use no separate newsletter tool. The emails contain no tracking pixels and no tracked links: we do not measure whether you open an email or what you click.

Legal basis

Your consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). We keep the proof of your consent because we must be able to demonstrate it (Art. 7(1) GDPR; our legitimate interest, Art. 6(1)(f) GDPR). Limiting sign-ups and keeping the record of the issued code rest on our legitimate interest in preventing misuse of the form and of the discount (Art. 6(1)(f) GDPR).

Unsubscribing and storage periods

You can withdraw your consent at any time, with one click on the unsubscribe link in every newsletter email or by writing to support@optionspace.app. We then stop sending at once. Emails sent before that remain lawful.

• While you are subscribed, your data is kept until you unsubscribe.
• After you unsubscribe we keep the record of your consent for 3 years, only to be able to show that we were allowed to write to you, and then delete it.
• The record of the issued code (the hash of your address and the code, not the address itself) is kept for 3 years after the code was issued, or for as long as you are subscribed if that is longer, so that one address cannot collect a second code. It stays even if your subscription is deleted earlier.

Writing to us

When you email us, we process your email address, your name and whatever you write, in order to answer you. Mail to support@optionspace.app is received through Cloudflare Email Routing and forwarded to our mailbox, which is hosted by our email provider. Both process the messages on our behalf.

Legal basis: performance of a contract or steps before one, if your message is about a purchase or a licence (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Storage period: up to three years after the conversation has ended, in case questions or claims come up later. Messages that belong to the accounting records, such as refund requests, are kept for as long as those records.

Who receives data

We share personal data only with the companies we need to provide OptionSpace:

• Cloudflare (Cloudflare, Inc., USA) hosts the website, the app downloads, the licence service with its database and the newsletter, sends the newsletter emails and forwards mail sent to our support address. It processes data on our behalf under a data processing agreement.
• Polar (Polar Software, Inc., USA) sells the licence as merchant of record, takes the payment with the help of its own payment providers, delivers the licence key and records activations and discount codes.
• PostHog (PostHog Inc., USA) provides the website statistics. It processes data on our behalf under a data processing agreement and stores it in the European Union (Frankfurt, Germany). The companies it uses in turn are listed on its sub-processor page.
• Hugging Face (Hugging Face, Inc., USA) delivers the speech model to your Mac.
• Our email provider hosts the mailbox in which we read and answer your messages.
• Tax advisers and public authorities, where the law requires it, for example for accounting or a tax audit.

Data outside the European Economic Area

Cloudflare, Polar, PostHog and Hugging Face are companies from the United States, so personal data can be processed there and in other countries outside the European Economic Area. Cloudflare is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing adequate protection, and its agreement with us also contains the EU standard contractual clauses. The agreement with Polar contains the EU standard contractual clauses. PostHog stores the statistics in the EU; for the case that its staff outside the EU need access, its agreement with us also contains the EU standard contractual clauses. The model download from Hugging Face is a direct connection between your Mac and Hugging Face that is necessary to provide the app to you.

You can ask us for a copy of these safeguards.

Your rights

Under the GDPR you have the right to:

• ask whether we process data about you and get a copy of it (access);
• have wrong data corrected (rectification);
• have data deleted, unless we must or may keep it (erasure);
• have the processing restricted;
• receive the data you gave us in a common, machine-readable format (portability);
• object at any time, for reasons arising from your situation, to processing that is based on our legitimate interest;
• withdraw a consent at any time, with effect for the future.

To use these rights, write to support@optionspace.app. It costs nothing. We answer within one month.

You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. The authority responsible for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland (uodo.gov.pl).

We make no decisions about you by automated means alone, and we do no profiling. You are not obliged to give us any data; but without an email address and a licence activation we cannot provide a licence.

Changes to this policy

We update this page when the app, the website or the companies we work with change. The date at the top shows the last change.