Privacy Policy

1. Privacy at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Data Controller

org Gräfendorf, GbR
Pappelweg 27
39576 Stendal
Email: contact@whispaste.de

3. Hosting

This website is hosted on GitHub Pages, a service provided by GitHub Inc. (88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA), a subsidiary of Microsoft Corporation.

When you visit this website, GitHub automatically collects the following data:

• IP address
• Browser type and version
• Referrer URL
• Time of access

This is technically necessary for operating the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). GitHub processes this data in accordance with the GitHub Privacy Statement. Data transfers to the USA are safeguarded by Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR.

GitHub stars in the navigation: Your browser loads the displayed GitHub star count from our own interface api.whispaste.de (netcup GmbH, Germany, see section 17), not directly from GitHub. The interface itself asks GitHub for the number at most every 15 minutes and passes on no data about you. For technical reasons the server receives your IP address to deliver the response; the interface does not store it. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing current project information).

4. Cookiefree Web Analytics (Matomo)

This website uses the cookiefree web analytics software Matomo (endpoint: matomo.silvio-und-maik.de) to produce aggregated, anonymous usage statistics. No cookies are set and no information is stored on or read from your device; because tracking is cookieless and IP-anonymised, § 25 TDDDG requires neither consent nor a cookie banner. Recorded are, among others, the anonymised IP address, browser and device type, screen resolution, language, region of origin, the referrer and the subpages visited, plus anonymous technical performance metrics (Core Web Vitals: loading time, layout stability, response time). There is no profiling, no cross-device tracking and no sharing with third parties; the data cannot be linked to individuals. No external fonts or CDN services are loaded; all other resources are served locally from GitHub Pages. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in needs-driven improvement). You may object to this processing at any time (Art. 21 GDPR). Tick the opt-out option in the field below.

This website sets no cookies. In browser storage (localStorage/sessionStorage) we keep only what a feature you use needs: your chosen language, whether the automatic language redirect already happened in this session, and whether you have already opened or closed the contact notice (so it does not appear again). This stays on your device and is never sent to any server; it is strictly necessary for the feature you asked for (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

5. External Links

This website contains links to external services:

• GitHub — Source code repository and releases
• GitHub Sponsors / Ko-fi — Voluntary support options

When clicking these links, the respective privacy policies of the third-party providers apply. WhisPaste has no influence on data processing by these services.

6. Core Principle

WhisPaste is designed with privacy first. Your audio and transcribed text never leave your device unless you explicitly choose a cloud service for transcription or for Smart Mode. By default (opt-out) the app sends anonymous, aggregated usage statistics and crash reports to guide development; both are cookieless, carry no account identifier, never contain your audio, text, or history, and can each be switched off at any time (details in section 15).

7. Audio Recording & Transcription

WhisPaste records audio from your microphone when you activate recording (via hotkey or button). The recorded audio is processed in one of two ways, depending on your settings:

• Local / Offline transcription: Audio is processed entirely on your device using a local AI model: Whisper (via whisper.cpp) or Parakeet (via sherpa-onnx or whisper.cpp backends), depending on your settings. No audio data leaves your computer.
• Cloud transcription (OpenAI or Deepgram): Audio is sent to the servers of whichever provider you choose. This requires you to provide your own API key for that provider. The audio is transmitted directly from your device to the provider; WhisPaste does not route, store, or process it on any intermediary server of ours.

Smart Mode (optional text cleanup): Off by default. When it runs locally, the transcribed text is processed on your device with a downloaded language model. If you choose OpenAI as the Smart Mode service, the transcribed text and the selected preset's instructions are sent directly to OpenAI using your own OpenAI API key.

When using a cloud provider, that provider's data processing terms apply: OpenAI Privacy Policy or Deepgram Privacy Policy.

8. Transcription History

Transcribed text is stored locally on your device in an SQLite database (%APPDATA%\WhisPaste\ on Windows, ~/Library/Application Support/WhisPaste on macOS, ~/.config/whispaste on Linux). This data never leaves your device. You can view, search, export, and delete your transcription history at any time through the application.

9. API Key Storage

API keys for cloud providers (OpenAI, Deepgram) are not stored in plain text in a configuration file. They are kept in your operating system's secure credential store: Windows Credential Manager, the macOS Keychain, or libsecret on Linux. A key is transmitted only directly to that provider's API endpoint when you perform a transcription or Smart Mode request. WhisPaste does not send your API key to any other service or server.

10. Configuration & Local Storage

All other application settings (language, hotkey, theme, model preferences, etc.) are stored locally in the same application folder as your transcription history (see section 8). No configuration data is transmitted to external servers.

11. AI Model Downloads

For local/offline transcription, WhisPaste downloads AI models from Hugging Face: the Whisper and Parakeet models as well as the optional Smart Mode language model come from separate repositories there. A corrupted Whisper model is re-downloaded automatically. During a model download, a standard HTTPS request is made to Hugging Face's servers. No personal data or identifiers are sent; only the model file URL is requested. Downloaded models are stored locally on your device.

12. Auto-Update

The update mechanism depends on how you installed WhisPaste:

• Installed via the Microsoft Store, the Mac App Store, Homebrew, or Scoop: the respective store or package manager handles update checks; the app itself performs no separate check. (Snap and Flatpak are planned but not yet available.)
• Installed via the Windows installer (incl. portable build) or the macOS DMG downloaded directly from GitHub (outside the Mac App Store): the app checks for a new version at startup and every 24 hours afterwards through signed appcast feeds fetched from GitHub.
• On Linux (AppImage/.deb): the check queries the GitHub Releases API directly.

These requests contain no personal data; they simply fetch the latest release version information. No user identifiers, device information, or usage data are transmitted. Automatic checks can be switched off under Settings → Updates.

13. Third-Party Data Sharing

WhisPaste does not share your content with third parties. Audio or text is sent to a cloud provider only when you explicitly choose one (OpenAI or Deepgram for transcription, OpenAI for Smart Mode), directly from your device under that provider's terms. Anonymous usage statistics go to a Matomo server operated by us (not a third party). Crash reports and performance data are processed by Sentry (EU data region) as a data processor. Both can be switched off (see section 15).

14. Network Connections

WhisPaste only makes network connections for the following purposes:

• OpenAI / Deepgram API — when cloud transcription is enabled (user-initiated)
• OpenAI API — only if you choose OpenAI as the Smart Mode service (user-initiated)
• Hugging Face — when downloading offline AI models (user-initiated)
• GitHub — for automatic update checks (Releases API or appcast; on by default, can be switched off)
• Matomo — anonymous usage statistics (on by default, can be switched off, see section 15)
• Sentry — crash reports and sampled performance data (on by default, can be switched off, see section 15)
• Supabase — only when you submit the optional feedback form (see section 16)

All network connections use HTTPS encryption. Aside from the update check and the usage statistics and crash reports described in section 15, no background network activity occurs. A complete technical list of every connection is in NETWORK.md.

15. Anonymous Usage Statistics & Crash Reports

To guide development, WhisPaste collects anonymous, aggregated usage statistics via a self-hosted Matomo server, plus crash reports via Sentry (EU data region). Both are on by default (opt-out) — the Privacy step of the onboarding says so as well. Both are cookieless and carry no account identifier. For Matomo, the IP address is fully anonymised server-side; if the DNT=1 environment variable is set, the app sends no usage statistics. For week-level analysis (e.g. returning usage within the same week), a purely locally generated pseudonymous marker is also sent: a hash of a random, never-transmitted device value and the current calendar week. This value automatically changes every week and cannot be linked across weeks — it is therefore not a persistent device identifier. In addition, every app start gets a random visitor ID that is never stored and only links events from the same run.

Crash reports (Sentry) contain technical error data: the error message and stack trace, app version, operating system and CPU architecture, install channel and the most recent app log lines (these never contain transcribed text; the user name in local file paths is replaced with a placeholder before sending). To tell whether an error keeps recurring on the same device, a truncated hash of the device name is included. Events containing secrets such as API keys are dropped; screenshots and on-screen content are never sent. In addition, a small share of app operations (0.5 %) is sent as performance measurements: timings only, database query templates without values, and the addresses of model and update downloads. Switching error reporting off stops Sentry immediately, including native crash and app-hang reports, and later launches do not start it at all.

Never transmitted (in either stream): your audio, transcribed text, history, snippets, tags, notes, or API keys. Usage statistics additionally never include concrete hotkeys, file paths, cursor position, or the target application; they only collect aggregated event counters and categories (app version, platform, selected provider, install channel, language, the weekly-rotating cohort marker described above). Legal basis: Art. 6(1)(f) GDPR (legitimate interest). You can switch off each stream independently at any time under Settings → Privacy ("Error Reporting" and "Share anonymous usage statistics"); when usage statistics are off, no cohort marker is generated or sent either.

16. Feedback Form

WhisPaste includes an optional, voluntary feedback form in the app. Submitting it sends your rating, feedback text, chosen category, app version, a hashed, non-identifying device identifier, and the app's UI language to a Supabase database that we operate. Only if you choose to fill them in, a contact email address and a preferred contact language are also sent, so we can reply to your feedback. Legal basis: Art. 6(1)(a) GDPR (consent, given by actively submitting the form). None of this data is transmitted unless you submit the form.

17. Website Contact Form

Using the contact button in the bottom right corner (“Write to us”) you can voluntarily send us a message. We then process the type of request you chose, your message, your email address for the reply, and the language and path of the page you write from. No name or account is needed. The sole purpose is to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns your use of WhisPaste, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests).

The data is sent TLS-encrypted to our interface api.whispaste.de. It runs on servers of netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany), which acts as our processor under Art. 28 GDPR; processing takes place in Germany. The interface forwards your message as an email to our mailbox and does not store its content itself. We delete the email once your request is resolved, at the latest after 12 months, unless statutory retention obligations apply.

Abuse protection: To keep the form from being used for spam, we limit the number of messages per sender. For this we never store your IP address or email address in plain text, only as a hash keyed with a secret, and only until the respective time window has passed (at most 24 hours, after which the entry is deleted automatically). A hidden check field and the time taken to fill in the form help detect automated submissions; no further data is collected for this. The interface's technical log contains no IP address, email address or message text, only the type and outcome of the request, and is deleted after 14 days. The legal basis is Art. 6(1)(f) GDPR (protection against abuse).

No form data is transmitted unless you submit it. You can object to this processing at any time (Art. 21 GDPR) and ask us to delete your message; write to the address given in the imprint. The “Open the idea board” button leads to our idea board on VotePit (app.votepit.com), a separately operated service with its own privacy policy; no data flows there unless you open the link.

18. Children's Privacy

WhisPaste does not knowingly collect data from children. Since the application does not collect any personal data or require account creation, there are no age-related data concerns.

19. Changes to This Policy

This privacy policy may be updated to reflect changes in the application. Significant changes will be noted in the application's release notes on GitHub.

20. Contact

For privacy-related questions or concerns, please refer to the Legal Notice (Impressum) page for contact information.

21. Your Rights

You have the right at any time to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

Since this website does not collect any personal data beyond the technically required server logs by GitHub, there is no data held by WhisPaste itself to delete, unless you have submitted the feedback form (see section 16). For requests regarding GitHub server logs, please contact GitHub Support.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

22. SSL/TLS Encryption

This website uses SSL/TLS encryption (HTTPS) for security reasons. An encrypted connection is indicated by the address bar changing from "http://" to "https://".