Privacy Policy

1. Privacy at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Data Controller

Silvio Lindstedt und Maik Gräfendorf, GbR
Pappelweg 27
39576 Stendal
Email: silvio-lindstedt@outlook.com

3. Hosting

This website is hosted on GitHub Pages, a service provided by GitHub Inc. (88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA), a subsidiary of Microsoft Corporation.

When you visit this website, GitHub automatically collects the following data:

• IP address
• Browser type and version
• Referrer URL
• Time of access

This is technically necessary for operating the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). GitHub processes this data in accordance with the GitHub Privacy Statement. Data transfers to the USA are safeguarded by Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR.

4. Cookiefree Web Analytics (Matomo)

This website uses the cookiefree web analytics software Matomo (endpoint: matomo.silvio-und-maik.de) to produce aggregated, anonymous usage statistics. No cookies are set and no information is stored on or read from your device; because tracking is cookieless and IP-anonymised, § 25 TDDDG requires neither consent nor a cookie banner. Recorded are, among others, the anonymised IP address, browser and device type, screen resolution, language, region of origin, the referrer and the subpages visited, plus anonymous technical performance metrics (Core Web Vitals: loading time, layout stability, response time). There is no profiling, no cross-device tracking and no sharing with third parties; the data cannot be linked to individuals. No external fonts or CDN services are loaded; all other resources are served locally from GitHub Pages. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in needs-driven improvement). You may object to this processing at any time (Art. 21 GDPR). Tick the opt-out option in the field below.

The only local storage mechanism is localStorage, which stores your language and theme preference on your device only. This data is never sent to any server.

5. External Links

This website contains links to external services:

• GitHub — Source code repository and releases
• GitHub Sponsors / Ko-fi — Voluntary support options

When clicking these links, the respective privacy policies of the third-party providers apply. WhisPaste has no influence on data processing by these services.

6. Core Principle

WhisPaste is designed with privacy first. Your audio and transcribed text never leave your device unless you explicitly choose a cloud transcription service. The app does collect anonymous, aggregated usage statistics and optional crash reports to guide development; these are cookieless, carry no account or device identifier, never contain your audio, text, or history, and can be switched off at any time (see section 15).

7. Audio Recording & Transcription

WhisPaste records audio from your microphone when you activate recording (via hotkey or button). The recorded audio is processed in one of two ways, depending on your settings:

• Local / Offline transcription: Audio is processed entirely on your device using a local AI model: Whisper (via whisper.cpp) or Parakeet (via sherpa-onnx), depending on your settings. No audio data leaves your computer.
• Cloud transcription (OpenAI or Deepgram): Audio is sent to the servers of whichever provider you choose. This requires you to provide your own API key for that provider. The audio is transmitted directly from your device to the provider; WhisPaste does not route, store, or process it on any intermediary server of ours.

When using a cloud provider, that provider's data processing terms apply: OpenAI Privacy Policy or Deepgram Privacy Policy.

8. Transcription History

Transcribed text is stored locally on your device in an SQLite database (%APPDATA%\WhisPaste\ on Windows, ~/Library/Application Support/WhisPaste on macOS, ~/.config/whispaste on Linux). This data never leaves your device. You can view, search, export, and delete your transcription history at any time through the application.

9. API Key Storage

API keys for cloud providers (OpenAI, Deepgram) are not stored in plain text in a configuration file. They are kept in your operating system's secure credential store: Windows Credential Manager, the macOS Keychain, or libsecret on Linux. A key is transmitted only directly to that provider's API endpoint when you perform a transcription request. WhisPaste does not send your API key to any other service or server.

10. Configuration & Local Storage

All other application settings (language, hotkey, theme, model preferences, etc.) are stored locally in the same application folder as your transcription history (see section 8). No configuration data is transmitted to external servers.

11. AI Model Downloads

For local/offline transcription, WhisPaste downloads AI models from Hugging Face: both the Whisper and the Parakeet models come from separate repositories there. During a model download, a standard HTTPS request is made to Hugging Face's servers. No personal data or identifiers are sent; only the model file URL is requested. Downloaded models are stored locally on your device.

12. Auto-Update

The update mechanism depends on how you installed WhisPaste:

• Installed via the Microsoft Store, Mac App Store, or a package manager (Homebrew Cask, Scoop, Snap, Flatpak): that store or package manager handles update checks; the app itself performs no separate check.
• Installed via the Windows or macOS installer, or the portable build: the app checks for a new version through signed appcast feeds fetched from GitHub.
• On Linux (AppImage/.deb): the check queries the GitHub Releases API directly.

These requests contain no personal data; they simply fetch the latest release version information. No user identifiers, device information, or usage data are transmitted.

13. Third-Party Data Sharing

WhisPaste does not share your content with third parties. Audio is sent to a cloud provider only when you explicitly choose one (OpenAI or Deepgram), directly from your device under that provider's terms. Anonymous usage statistics go to a Matomo server operated by us (not a third party). Optional crash reports are processed by Sentry as a data processor. Both can be switched off (see section 15).

14. Network Connections

WhisPaste only makes network connections for the following purposes:

• OpenAI / Deepgram API — when cloud transcription is enabled (user-initiated)
• Hugging Face — when downloading offline AI models (user-initiated)
• GitHub — for automatic update checks (Releases API or appcast)
• Matomo — anonymous, opt-out usage statistics (see section 15)
• Sentry — optional crash reports (opt-out)
• Supabase — only when you submit the optional feedback form (see section 16)

All network connections use HTTPS encryption. Aside from the update check and the anonymous telemetry described in section 15, no background network activity occurs.

15. Anonymous Usage Statistics & Crash Reports

To guide development, WhisPaste collects anonymous, aggregated usage statistics by default via a Matomo server, plus optional crash reports (Sentry). Both are cookieless and carry no account, user, or device identifier. For Matomo, the IP address is fully anonymised server-side, and an active operating-system Do-Not-Track setting is honoured.

Never transmitted: your audio, transcribed text, history, snippets, tags, notes, API keys, concrete hotkeys, file paths, cursor position, or the target application. Only aggregated event counters and categories are collected (app version, platform, selected provider, install channel, language). Legal basis: Art. 6(1)(f) GDPR (legitimate interest). You can switch off each stream independently at any time under Settings → Privacy.

16. Feedback Form

WhisPaste includes an optional, voluntary feedback form in the app. Submitting it sends your rating, feedback text, chosen category, app version, a hashed, non-identifying device identifier, and the app's UI language to a Supabase database that we operate. Only if you choose to fill them in, a contact email address and a preferred contact language are also sent, so we can reply to your feedback. Legal basis: Art. 6(1)(a) GDPR (consent, given by actively submitting the form). None of this data is transmitted unless you submit the form.

17. Children's Privacy

WhisPaste does not knowingly collect data from children. Since the application does not collect any personal data or require account creation, there are no age-related data concerns.

18. Changes to This Policy

This privacy policy may be updated to reflect changes in the application. Significant changes will be noted in the application's release notes on GitHub.

19. Contact

For privacy-related questions or concerns, please refer to the Legal Notice (Impressum) page for contact information.

20. Your Rights

You have the right at any time to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

Since this website does not collect any personal data beyond the technically required server logs by GitHub, there is no data held by WhisPaste itself to delete, unless you have submitted the feedback form (see section 16). For requests regarding GitHub server logs, please contact GitHub Support.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

21. SSL/TLS Encryption

This website uses SSL/TLS encryption (HTTPS) for security reasons. An encrypted connection is indicated by the address bar changing from "http://" to "https://".