MicJot Privacy Policy
Draft for legal review. Not yet in force. This text describes what the software does as of version 0.4.0 (the redesigned setup, main window and Settings; October 2026, CHANGELOG.md). Sections marked (from the first release with MicJot accounts) describe account, MicJot AI and payment features that are built but not switched on in any build shipped so far: a build without an account service shows no sign-in and continues without an account. They take effect only with the release that ships them, and that release's notes will say so. A lawyer must review the whole text before publication, and the bracketed owner details at the end must be filled in. Last updated: 2026-10-30.
MicJot is a dictation app for macOS. You hold a key, speak, and MicJot types what you said into the app you are using. This policy explains what MicJot processes, where, and what leaves your Mac. The short version: speech recognition runs on your Mac, nothing is sent anywhere unless you turn on a feature that says so, and MicJot has no analytics or telemetry. From the first release with MicJot accounts, setting up MicJot begins with a passwordless sign-in (Apple, Google or an email code); the account counts the words you dictate against the Free plan's allowance and runs MicJot AI, the one feature that works on our servers. Dictation itself happens on your Mac and never sends your audio or your text to us.
What MicJot processes on your Mac
- Audio. While you hold the dictation key (or until you stop a hands-free dictation), MicJot records from the microphone you chose. When "Keep the microphone ready" is on (the default), the microphone stays open for a standby period after each dictation (90 seconds by default; 30 seconds to 3 minutes in Settings → Dictation → Advanced) and keeps a rolling 250 milliseconds of audio, so the next dictation starts instantly and the first word is not lost. The orange macOS microphone indicator stays on for the whole standby. Standby audio is used only if you start a dictation; otherwise it is discarded continuously. Sleep, screen lock and a user switch close a standby microphone at once. Recordings are not written to disk, with one exception: a dictation that cannot be transcribed yet (the speech model is still downloading or loading, or the Mac went to sleep during a dictation) is saved as an audio file in
~/Library/Application Support/MicJot/Pending, readable only by you, and is deleted as soon as it has been transcribed. - Speech recognition. With the default on-device engine, the recording is transcribed by a Whisper model running on your Mac (Core ML / Neural Engine). The audio does not leave the Mac.
- Text around the cursor. To make dictated text fit, MicJot reads, through macOS Accessibility, the name of the frontmost app, the text before the cursor (up to 600 characters) and any selected text. It never reads password fields, apps on your excluded list, or anything while Secure Event Input is on. You can turn this off in Settings ("Use text around the cursor as context").
- Keyboard events. To notice the dictation key, Escape, Space during a dictation and the ⌃⌘V / ⌃⌘P shortcuts, MicJot installs a system-wide keyboard event tap (and, with Input Monitoring permission, a low-level key monitor for keys such as Fn). This means macOS delivers every key event to MicJot while it runs. MicJot reacts only to the keys above, keeps no record of key events, and never transmits them. Password fields turn on Secure Event Input, which hides all keys from MicJot; the dictation key is paused while they have focus.
- Insertion. Dictated text is placed on the clipboard, pasted with a synthetic ⌘V (or written through Accessibility), and the previous clipboard contents are restored afterwards. If insertion fails, the text stays on the clipboard and MicJot tells you so.
- History and statistics. Each dictation's recognized text, final text, app name, duration and insertion outcome are saved locally in
history.jsonso you can search and re-insert them, and to compute word counts. You control this: turn "Save dictation history" off, choose how long entries are kept (7, 30, 90 or 365 days or forever; 90 days by default), switch on session-only Private dictation, or exclude apps. Password managers, Keychain Access and terminals are excluded by default. Nothing dictated into a password field, under Secure Event Input or into an excluded app is stored, and it leaves no "last dictation" for ⌃⌘V. - Dictionary and snippets. Words you teach MicJot and text snippets are stored locally and used by speech recognition and, when enabled, by the AI writing step.
- Logs. MicJot writes an event log (timings, states, counts, error messages, the names of apps you dictated into, and, for AI calls, the number of tokens used) to
~/Library/Application Support/MicJot/Logs, one file per day, kept for 7 days. It never contains what you said or typed, your keys, or your dictionary. macOS may also record crashes and hangs, which MicJot stores as JSON in~/Library/Application Support/MicJot/Diagnostics. Nothing in these folders is sent anywhere unless you choose Save Diagnostics…, which writes a zip (logs, crash reports and a settings summary without keys, history, dictionary or snippets) to your Downloads folder for you to send to us yourself.
All of these files live in ~/Library/Application Support/MicJot, a folder readable only by your user and marked as excluded from backups; the data files are readable only by you.
What leaves your Mac, and when
MicJot contacts other computers only in the cases below. Each one is off until you turn it on, is clearly a download you asked for, or requires an account you chose to create.
| When | What is sent | To whom |
|---|---|---|
| AI writing is on and your own Anthropic API key is saved in MicJot (dictation cleanup, Command mode, Polish; the key field exists in QA builds only, under Settings → Writing → Advanced; customer builds have no own-key control) | The recognized transcript (or, for Command mode and Polish, your instruction and the selected text), the frontmost app's name and category, your chosen tone and language, up to 200 words from your dictionary, and, if "text around the cursor" is on, up to 600 characters before the cursor. Nothing is sent for excluded apps, password fields, or while Secure Event Input is on. | Anthropic (api.anthropic.com), using your API key, over HTTPS. Anthropic's commercial data policy applies to that data between you and Anthropic; MicJot has no account of its own there and sees none of it. |
| MicJot AI is on (from the first release with MicJot accounts) | Exactly the same data as the row above, plus a task label (cleanup, command or polish) and your device token. | Our server (api.micjot.com, a Cloudflare Worker), which forwards it to Anthropic with our key and returns the answer. Our server keeps token counts only, never your text; see "MicJot AI" below for what Anthropic keeps. |
| A settings file from version 0.3.1 or earlier still selects a cloud transcription engine (Settings no longer offers one: speech recognition is on-device only, and a new installation never uses this route) | The recording as 16 kHz mono audio, the language setting, and up to 80 words from your dictionary as a hint. | OpenAI (api.openai.com) or Groq (api.groq.com), whichever that file names, with your own API key, over HTTPS. Their policies apply. |
| Downloading a speech model (first run, or when you pick another model) | A download request for the model files. | Hugging Face (huggingface.co) or, if this build is configured for it, our own model mirror on Cloudflare. The request carries no identifier beyond your IP address and a generic user agent. |
| Checking for updates (only in builds that have an update feed configured; at most once a day, or when you choose "Check for Updates…") | A request for a small JSON file describing the newest version. No identifiers, no settings, no usage data. | Our website host (Cloudflare). When you choose to download the update, the disk image is fetched the same way and verified against a published checksum. |
| You sign in to a MicJot account (from the first release with MicJot accounts; the first setup screen) | Your device's name, Mac model, macOS version and MicJot version, and a random device identifier; afterwards, at launch, every six hours and when you open Settings → Account, a request for your plan state carrying only your device token. | Our server (api.micjot.com and account.micjot.com). |
| A dictation lands while you are signed in (from the first release with MicJot accounts) | The dictation's random identifier and the number of words in it, once per dictation (a Mac that was offline sends its queued counts at the next launch). Never the words themselves, never audio. This is how the Free plan's 3,000 words are counted across your Macs; a build without an account service counts nothing. | Our server (api.micjot.com). |
MicJot has no telemetry, analytics, crash uploading or advertising. Your own API keys are stored in secrets.json inside MicJot's support folder (a file only your user account can read, like the rest of the folder) and are sent only to the provider they belong to. Until 2026-10-30 they were login-Keychain items; a key an earlier build left there is imported on request from Settings → Writing → Advanced, which removes the Keychain item.
Where your data is stored on your Mac and how to delete it
| Data | Location | How to delete |
|---|---|---|
| Settings | ~/Library/Application Support/MicJot/settings.json | Delete the file, or run the uninstaller |
| History (your dictations' text) | ~/Library/Application Support/MicJot/history.json | Delete a transcript from its "…" menu on Home, use Clear history… in Settings → Privacy, or delete the file |
| Pending dictations (audio waiting for the speech model) | …/MicJot/Pending/*.wav | Deleted automatically once transcribed; Clear history removes the folder |
| Dictionary, snippets | …/MicJot/dictionary.json, …/MicJot/snippets.json | Edit in MicJot, or delete the files |
| Speech models | …/MicJot/Models | Delete the folder; MicJot re-downloads when needed |
| Event log, crash reports | …/MicJot/Logs, …/MicJot/Diagnostics | Delete the folders; logs expire after 7 days anyway |
| Compiled model cache | ~/Library/Caches/com.micjot.MicJot | Delete the folder; macOS rebuilds it |
| Window position | ~/Library/Preferences/com.micjot.MicJot.plist | Delete the file |
| API keys you added (QA builds) | …/MicJot/secrets.json (mode 0600; before 2026-10-30: macOS login Keychain, service com.micjot.MicJot) | Settings → Writing → Advanced → Remove (QA builds), or delete the file; an old Keychain item: Keychain Access |
| Cached account record (from the first release with MicJot accounts): email, plan, dates, word count | …/MicJot/account.json | Settings → Account → Sign out of this Mac |
| Word counts not yet confirmed by the server (from the first release with MicJot accounts): dictation identifiers and word numbers, no text | …/MicJot/word-reports.json | Sent and emptied at the next launch or landing; Sign out of this Mac |
| Device token (from the first release with MicJot accounts) | …/MicJot/secrets.json, key session | Sign out, or delete the file |
The uninstaller (Uninstall MicJot.command in the transfer package) removes all of the above on request and resets the permissions you granted. We hold no copy of anything in this table.
Permissions MicJot asks for
- Microphone: to hear you.
- Accessibility: to insert text into other apps and to read the text around the cursor.
- Input Monitoring (optional): to notice the dictation key on keyboards where the event tap cannot see it. All three can be revoked at any time in System Settings → Privacy & Security.
MicJot accounts (from the first release with MicJot accounts)
Setting up MicJot begins with signing in: the first setup screen offers Apple, Google or an email code and nothing else, and the Free plan's 3,000 words are counted on the account, across every Mac you sign in. The account is what runs MicJot AI (hosted AI writing, included for the Free plan's first 3,000 words, during the 7-day Pro trial and on Pro) and what counts the words; once the free words and the one trial are used, dictation pauses until Pro. Everything in the sections above still happens on your Mac: dictation itself never contacts the server, and only the word counts described in the table leave it. A build without an account service (every build shipped so far) shows no sign-in, counts nothing and continues without an account. [Lawyer: sign-in is required to set up a build with an account service; confirm the wording of this paragraph and of the Free plan's word count as a condition of use.]
- Passwordless. You sign in with a one-time code sent to your email, with Google, or with Apple. We never store a password. The code is valid for 10 minutes, works once, and is stored only as a hash.
- What an account stores, on Cloudflare's D1 database: your email address; the identifier your sign-in provider gives us (Google or Apple "subject"), never your Google or Apple password; for each Mac you sign in, its name, Mac model, macOS version, MicJot version, when it was last seen, and a hash of its device token; your plan, trial and billing-period dates and the identifiers our payment provider assigns; the number of words your account has dictated, with one row per reported dictation (its random identifier, the Mac it came from, the word count and the time; what makes a retried report count once); and, per day, the number of AI requests and tokens your account used (see MicJot AI). Nothing in the database can hold a transcript, a prompt, an AI answer, audio, a card number or a password.
- Emails we send: sign-in codes; a notice when a new Mac signs in; trial and renewal reminders; a notice (with a revert link) when the account's email address is changed; receipts, which come from our payment provider. No marketing email without your separate opt-in.
- Retention. Account data is kept while the account exists. Payment-event identifiers are kept for 90 days and daily usage counts for 13 months [owner may change; configuration]. Devices you sign out are removed at once.
- Deletion. Settings → Account → Open account page → Delete account (confirmed with a fresh email code). This cancels any subscription, signs out every Mac, and deletes your email, identities, devices, codes and usage counts. A tombstone with the account id, our payment provider's identifiers and the deletion date stays for 90 days after the last subscription period ends, so that billing events still in flight (a scheduled cancellation taking effect, a refund) can be matched and recorded without granting anything; then it is purged. Our payment provider keeps its own tax and transaction records as the merchant of record. The same email address can create a new, unrelated account afterwards.
- Cookies. The account pages (
account.micjot.com) set one essential session cookie; the checkout page (pay.micjot.com) sets one short-lived checkout cookie. The sign-in form uses Cloudflare Turnstile to stop automated sign-ups. There are no analytics cookies anywhere.
MicJot AI (from the first release with MicJot accounts)
MicJot AI runs the same AI writing features (cleanup, Command mode, Polish) without your own key. The app sends the data listed in the table above to our server, which forwards it to Anthropic with our key, returns the answer, and records token counts. What each party keeps:
- Our server keeps the token counts, the task label, the model used, the status and the latency of each request, attached to your account and device. It never stores, logs or samples your text; request bodies are not written to any log.
- Anthropic processes the text under its commercial terms. By its published policy, "For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation", with these exceptions: inputs and outputs that Anthropic's automated trust-and-safety systems flag as violating its Usage Policy are kept "for up to 2 years and trust and safety classification scores for up to 7 years"; data may be kept longer "in compliance with the law"; and different terms apply where a customer has agreed otherwise, such as a zero-data-retention agreement (source, page dated July 1, 2026, read 2026-10-28). Anthropic states that "by default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models"; the exception is feedback or bug reports explicitly submitted to Anthropic, which may be used for training and is kept for up to 5 years (source, page dated August 18, 2026, read 2026-10-28). Our server never submits feedback to Anthropic, so that exception cannot apply to your text through MicJot AI.
- Zero data retention. Anthropic grants zero-data-retention terms per organization, "subject to Anthropic's approval", through its sales team, and even then "still retains User Safety classifier results in order to enforce our Usage Policy" (source, read 2026-10-28). Status for MicJot's organization: [not requested as of 2026-10-28; the owner replaces this with "requested on <date>" or "granted on <date>", and never with wording that implies it is on offer]. Until it reads "granted", the 30-day default with its exceptions above is what applies.
- Fallback. If MicJot AI is unavailable, over its daily budget, or your plan does not include it, MicJot inserts the rule-based text instead and shows one notice. Your dictation is never lost and never blocked.
Payments (from the first release with MicJot accounts)
Subscriptions are sold by Paddle.com Market Ltd / Paddle.com Inc. ("Paddle") as merchant of record: Paddle states in its buyer terms that it "is an authorised reseller of Products for Suppliers, which means you purchase the Product from Paddle" (Paddle Checkout Buyer Terms, dated 31 March 2026, read 2026-10-28). Paddle collects your name, email, billing country, payment details and tax information, issues the receipt and invoice, calculates and remits sales tax or VAT, and handles refunds and chargebacks under its own privacy policy, as the controller of that data. MicJot never sees your card number. From Paddle we receive and store: your account id (which we gave Paddle), Paddle's customer, subscription, transaction and adjustment identifiers, the plan and price, the subscription status and billing-period dates, and the billing email. Paddle's checkout runs on a dedicated page (pay.micjot.com), the only page on our hosts that loads Paddle's script.
Our processors
| Processor | What for | What it receives | Where to read more |
|---|---|---|---|
| Cloudflare | Website, downloads, update feed, model mirror; and, from the first release with accounts, the account server and database | IP address and user agent of every request to our hosts (standard web server logs); account data as described above, stored in Cloudflare D1 | Cloudflare privacy policy |
| Hugging Face | Speech-model download when our mirror is not configured or unavailable | IP address, generic user agent | Hugging Face privacy policy |
| GitHub | Alternative download of the disk image and release notes | IP address, user agent | GitHub privacy statement |
| Anthropic (from the first release with accounts) | MicJot AI | The AI writing payload described above, under Anthropic's commercial terms | Retention and training policies linked in "MicJot AI" |
| Paddle (from the first release with accounts) | Merchant of record: checkout, tax, receipts, refunds | Your payment and billing details, as controller | Paddle privacy policy |
| Resend (from the first release with accounts) | Sending sign-in codes and account emails | Your email address and the email's contents (a code or a notice; never a dictation); Resend retains email data for 30 days on every tier (Resend pricing, read 2026-10-28) | Resend privacy policy |
| Google (from the first release with accounts) | "Continue with Google" sign-in, if you choose it | Google tells us your Google account's stable identifier and email address; we request the openid and email scopes only | Google privacy policy |
| Apple (from the first release with accounts) | "Continue with Apple" sign-in, if you choose it | Apple tells us a stable identifier and your email or a private relay address | Apple privacy policy |
Anthropic, Cloudflare, Paddle, Resend, Google and Apple process data in the United States and elsewhere. [Lawyer: confirm the transfer mechanism and wording required for EU/EEA/UK users, and whether a representative is required.]
The website
The marketing site is static files. It uses no analytics, no tracking scripts and no cookies. Our host sees the IP address and user agent of each request. The only cookies on any of our hosts are the essential session cookie on account.micjot.com and the checkout cookie on pay.micjot.com, both described under "MicJot accounts", and both only after you choose to sign in.
Your rights
Everything on your Mac is yours to read, export, edit or delete with the tools above; we hold no copy. For a MicJot account, from the first release with accounts: the account page shows every field we store about you and lets you download it as JSON (access and portability), change your email address (rectification), sign out any Mac, and delete the account (erasure; see "Deletion" for the tombstone). You may object to or restrict processing, and withdraw consent for anything based on it, by deleting the account or turning the feature off. If you are in the EU/EEA or the UK you may also complain to your data-protection authority. Contact details are at the end. [Lawyer: legal bases per processing activity (contract, legitimate interests, consent), and the response time we commit to.]
Children
MicJot is not directed at children under 16 and we do not knowingly process their data. If you believe a child has created an account, contact us and we will delete it.
Changes
We will post changes to this policy on the website and in the app's release notes before they take effect, and the "Last updated" date above will change. Features marked "from the first release with MicJot accounts" become effective with the release that ships them.
Contact
Ram Deshmukh, [postal address], [privacy contact email]. (Owner: fill in before publication.)
Sources read for this draft (2026-10-28)
- Anthropic, "How long do you store personal data?" (page dated July 1, 2026): https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-personal-data
- Anthropic, "Is my data used for model training?" (page dated August 18, 2026): https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training
- Anthropic, "I have a zero retention agreement with Anthropic. What does this mean for me?": https://privacy.claude.com/en/articles/8956058-i-have-a-zero-retention-agreement-with-anthropic-what-does-this-mean-for-me
- Paddle Checkout Buyer Terms (31 March 2026): https://www.paddle.com/legal/checkout-buyer-terms
- Paddle pricing ("Paddle as your Merchant of Record"; 5% + 50¢ per checkout transaction): https://www.paddle.com/pricing
- Resend pricing (30-day data retention on every tier; Free 3,000 emails/month, 100/day): https://resend.com/pricing
- The behaviour described above was checked against the source files
Sources/MicJot/Disclosures.swift,Sources/MicJot/Persistence.swift,Sources/MicJotCore/HistoryPolicy.swift,Sources/MicJotCore/Settings.swift,Sources/MicJotCore/PromptBuilder.swift,Sources/MicJot/Log.swiftandREADME.md; the account sentences (2026-10-30) againstSources/MicJotCore/OnboardingFlow.swift,Sources/MicJotCore/FreeWords.swift,Sources/MicJot/AccountClient.swiftandworkers/account/migrations/0003_free_words.sql.
Rendered from docs/PRIVACY.md by scripts/make-site.sh; the Markdown is the source of truth.