1. Who we are
Whisper Master is operated by Corkkam, based in India (“we”, “us”). For anything in this policy, including any request to access or delete your data, write to corkkam.info@gmail.com. We are the data controller for the information described below.
2. The core principle
Whisper Master transcribes speech entirely on your device. The speech-recognition model runs on your Mac’s own processor. Your audio is held in memory only for as long as it takes to transcribe, then discarded. It is never written to disk, never transmitted to us, and never transmitted to any third party.
We therefore hold no recordings of you and no transcripts of what you dictate. This is an architectural fact, not a policy choice: we could not hand over your dictation in response to a legal demand, because we have never had it.
Specifically, the following never leave your Mac under any setting:
- Your audio. It is processed in memory on your Mac and discarded. It is never written to disk, never uploaded, and we could not produce a recording of you if we were asked to.
- Your transcribed text. What you dictate goes to your cursor and nowhere else.
- Your clipboard, your screen contents, or the contents of any window you dictate into.
- Your custom vocabulary and replacement rules. They stay in your local settings.
3. What we do collect
There are 5 occasions on which the app uses the network. Each is listed below with the data involved, why we need it, and our lawful basis for processing it under the GDPR and the UK GDPR.
3.1 Sign-inRequired
- Recipient
- Clerk (authentication provider, United States)
- Data
- Your email address, your name if you provide one, and a session token. Nothing about your dictation.
- Your control
- Required to use the app. Delete your account to remove it.
- Lawful basis
- Performance of our contract with you — the app cannot function without it.
3.2 Model downloadRequired
- Recipient
- Cloudflare R2 (our file storage)
- Data
- A standard file request. No account data is attached. Your IP address is visible to Cloudflare, as it is to any website you load. Happens once, at roughly 1.5 GB.
- Your control
- Required once. Afterwards the app works fully offline.
- Lawful basis
- Performance of our contract with you — the app cannot function without it.
3.3 Update checksOptional
- Recipient
- Cloudflare R2 (our file storage)
- Data
- Your app version and macOS version, so we can offer the right update. Your IP address is visible to Cloudflare.
- Your control
- Disable automatic updates in Settings.
- Lawful basis
- Our legitimate interest in maintaining and improving the app, which you may object to at any time using the control above.
3.4 Product analyticsOptional
- Recipient
- PostHog and Google Analytics
- Data
- Content-free events recording which features you use — app launched, dictation completed, a note created, a reminder ticked, a connector approved, and similar — each tagged with the feature area, your app version, your macOS version and your release channel. These are linked to your account: your Clerk user ID, email and name are held on your analytics profile so we can see which features a given customer relies on. Word counts and durations are sent as ranges (“10–24 words”, “15–30s”), never exact figures. Your transcripts, notes and recordings are never sent.
- Your control
- Settings → General → “Share usage data”. On until you turn it off.
- Lawful basis
- Our legitimate interest in maintaining and improving the app, which you may object to at any time using the control above.
3.5 Stats backupOptional
- Recipient
- Our own dashboard (MongoDB Atlas)
- Data
- A daily summary tied to your account: date, words dictated, number of dictations, total duration, corrections made, and the names of the applications you dictated into. This one is not anonymous — it is how your stats survive a reinstall.
- Your control
- Settings → General → “Back up my stats”. On until you turn it off.
- Lawful basis
- Our legitimate interest in maintaining and improving the app, which you may object to at any time using the control above.
Our website additionally uses cookies for analytics only after you accept them in the consent banner, and Cloudflare Turnstile to distinguish humans from bots on sign-up. Declining analytics cookies does not affect any feature of the site.
4. What we never do
- We do not sell your personal data. We have never done so and have no mechanism to.
- We do not share your data with advertisers or data brokers.
- We do not use your dictation to train speech models. We could not: we do not receive it.
- We do not build advertising profiles or track you across other websites.
5. How long we keep things
Account details are kept for as long as your account exists, and deleted within 30 days of you closing it. Product analytics are linked to your account and are deleted along with it. Daily statistics rollups — if you have left “Back up my stats” on — are kept until you delete your account or ask us to remove them.
6. Your rights
Depending on where you live, you have some or all of the following rights: to access the data we hold about you, to correct it, to delete it, to receive a portable copy, to object to processing based on legitimate interests, and to withdraw consent. Residents of the EEA and UK hold these under the GDPR; residents of California hold comparable rights under the CCPA, including the right not to be discriminated against for exercising them; residents of India hold rights under the Digital Personal Data Protection Act, 2023.
Exercise any of them by writing to corkkam.info@gmail.com. We will respond within 30 days and will not charge you for it. If you believe we have handled your data improperly you may complain to your local data protection authority.
7. International transfers
We operate from India, and the providers listed in section 3 process data in the United States and the European Union. Where data moves between jurisdictions, it does so under the standard contractual clauses or equivalent safeguards offered by those providers. Because your audio and transcripts never leave your device, the data crossing borders is limited to your account identity and the operational data described above.
8. Children
Whisper Master is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
9. Security
Traffic between the app and our providers uses TLS. Account data sits with providers that maintain their own security programmes. The strongest security property of this product, though, is structural: the sensitive material — your voice and your words — is never in our custody in the first place.
10. Changes
If we change this policy in a way that affects what we collect, we will update the date at the top and tell account holders by email before the change takes effect. We will not quietly broaden what we collect.