Superwhisper

Privacy Policy

Last Updated: Oct 8th, 2026

Introduction

This Privacy Policy explains how SuperUltra, Inc. ("we", "us", or "our") collects, uses, and protects your information when you use our voice-to-text applications and website ("Superwhisper"). By using Superwhisper, you agree to the terms of this Privacy Policy. We are committed to protecting your privacy and fulfilling our obligations under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy regulations.

Scope of this Privacy Policy

This Privacy Policy applies to the Superwhisper apps for macOS, iOS, Windows, Android, and Linux, and to superwhisper.com. It does not cover third-party applications, websites, or services that may be linked to, integrated with, or accessed through Superwhisper, including AI providers you connect with your own API key. We encourage you to review their privacy policies.

Local and Cloud Processing

Superwhisper can run speech and language models entirely on your device. When you use a local model, your audio and transcripts never leave your device.

When you choose a cloud model, your audio, transcript, and any prompt or context needed for the request are sent for processing:

• Superwhisper cloud models run on our servers. Audio and transcripts are processed in memory and are not stored after the request completes.
• Third-party models offered through Superwhisper (for example OpenAI, Anthropic, Google, Groq, xAI, Deepgram, and ElevenLabs) receive your request through our API or directly from the app using a temporary key. These providers process it under their own terms.
• Your own API keys: if you connect a provider with your own key, the app sends requests directly to that provider. We do not see that content.

Information We Collect

• Account and purchase information: your email address, license key, and purchase records. Payments are handled by Stripe, Apple, Google Play, or Setapp; we do not receive your full card details. If you sign in with Google or your organization's single sign-on, we receive your name and email from that provider.
• Organization accounts: member names, emails, roles, and directory data provided by your organization (for example via SCIM). For organization admins we keep aggregate usage statistics, such as the number and length of recordings, the models used, and the names of the apps you dictated into. These statistics never include audio or transcript content.
• Service usage data: when the app calls our API we record request metadata: a random device identifier, your license key or device identifier for daily active use, platform, app version, OS version, country (derived by Cloudflare), user agent, endpoint, model, status, latency, and word counts. We use this to run the service, enforce free-tier limits, prevent abuse, and bill organizations. It does not include audio or transcript content.
• Product events: the apps tell us when a paywall or upgrade screen is shown (and which one) and when onboarding is finished. These events do not include content, names, or emails.
• Purchase history: Stripe, Apple, and Google tell us about purchases, renewals, cancellations, failed payments, and refunds. We link these to your license key, along with the plan and price.
• How you found us: on superwhisper.com we read UTM parameters, the website that referred you, and which in-app screen sent you to checkout. These are kept in your browser tab's session storage, added to download links, and saved with your Stripe customer record at checkout.
• Downloads: when you download the app we create a random download token and keep a hashed (one-way, salted) version of your IP address for up to 30 days. We use it to link a download to the first app launch. We do not store raw IP addresses for this.
• Optional survey: after a download or checkout you can answer "How did you hear about us?" with one tap. It is optional.
• Diagnostics: crash and error reports, sent to our error-monitoring provider (Sentry). These include device and app details, an app installation or device identifier, and technical details about the error. On macOS, error reporting is off unless you turn it on. On Windows and Linux you can turn it off in settings. Server logs record technical details about requests, such as timings and errors.
• Problem reports: if you choose to send us a report about a recording, we receive that recording's audio, transcript, AI output and prompt, your message, and your license key. We only use these to investigate the problem you reported.
• Content you choose to share: if you create a share link for a meeting summary, we store the summary so the link works.
• Emails: if you subscribe to updates, we store your email address and whether you opened or clicked our emails. Every marketing email includes an unsubscribe link.

Data Processing Guarantees

We want to be transparent about how we handle your data. Here are our specific guarantees:

• No Training Usage: Your data is not used for training AI models or any other machine learning purposes.
• No Content Retention: Audio and transcripts processed by Superwhisper cloud models are not stored on our servers after the request completes. The only exceptions are problem reports you choose to send and meeting summaries you choose to share.
• Limited Identification: Calls to our API require authentication and are linked to your license key or device identifier for access control, usage limits, billing, and security. They are never linked to the content of your recordings.

These guarantees will not change in our default product offering without prior notice to our users.

How Long We Keep Data

• Recordings and history on your device: under your control. You can set them to delete automatically after a day, a week, a month, or longer. By default they are kept until you delete them. Organizations can set a retention period for their members.
• Server logs: 30 days.
• Crash and error reports: up to 90 days.
• Service usage data: up to 3 months for request metadata. Usage counts needed for billing and free-tier limits are kept while your account is active.
• Product analytics (events, attribution, purchase lifecycle): about 90 days in Cloudflare Analytics Engine. A daily export is kept in our private Cloudflare R2 storage for as long as needed for product analytics, in aggregate reporting.
• Download tokens and hashed IP addresses: up to 30 days.
• Abuse-prevention records: 30 days.
• Problem reports: 90 days.
• Shared meeting summaries: 30 days.
• Account, license, and purchase records: while your account is active, and afterwards as long as required for tax, accounting, and legal purposes.
• Email subscription data: until you ask us to delete it.

Service Providers

We use the following providers to run Superwhisper. They process data only on our behalf:

• Hosting and infrastructure: Amazon Web Services, Cloudflare, Vercel
• Payments: Stripe, Apple, Google Play, Setapp
• Email: Cloudflare, Amazon SES
• Error monitoring: Sentry
• Website analytics and referrals: PostHog, Vercel Analytics, Google Tag Manager, Dub, Rewardful
• AI model providers (only when you choose their models): OpenAI, Anthropic, Google, Groq, xAI, Deepgram, ElevenLabs
• Business customer management: Twenty, Apollo (for organization and enterprise accounts)

Cookies and Similar Technologies

The Superwhisper apps do not use cookies or advertising trackers.

superwhisper.com uses cookies and similar technologies to keep you signed in to your dashboard, to understand how the site is used (PostHog, Vercel Analytics, Google Tag Manager), to attribute referral and affiliate links (Dub, Rewardful), to prevent spam (Cloudflare Turnstile), and to diagnose errors (Sentry). Error reports from the website can include your IP address and browser details. Pages opened from a shared meeting link do not load analytics. The site also stores UTM parameters, the referring website, and the in-app screen that led to checkout in your browser tab's session storage, which is cleared when you close the tab. You can block cookies in your browser settings; some features, such as signing in, may not work without them.

Data Security

We take the security of your information seriously. Data sent to our servers is encrypted in transit, and access to our systems is restricted to the people who need it. Recordings and transcripts from local models stay on your device, which significantly reduces the risk of unauthorized access. However, no method of transmission or storage can be guaranteed to be completely secure, and files saved to your device are protected by your device's own security.

Your Rights

Under the GDPR, the CCPA, and similar laws, you have the right to be informed about how we use your personal data, to access the data we hold about you, to correct it, to have it deleted, and to restrict or object to certain processing. We do not sell your personal information, and we do not use the analytics described above for ad targeting. We use it to understand how people find, start using, and buy Superwhisper. To exercise any of these rights, email privacy@superwhisper.com. You can delete recordings stored on your device at any time from within the app.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be effective immediately upon posting the revised policy on Superwhisper. Your continued use of Superwhisper after any changes to the Privacy Policy have been posted constitutes your acceptance of the updated policy. If the changes are significant, we may provide a more prominent notice or seek your consent, as required by law.

Important: Any changes to our core data processing guarantees (regarding data training usage, server retention, and user identification) will not occur without prior notice to our users, giving you sufficient time to evaluate the changes and make informed decisions about your continued use of our service.

Contact Information

If you have any questions about this Privacy Policy, or if you want to exercise your rights under the GDPR, CCPA, or other data protection laws, you may contact us at privacy@superwhisper.com.

Regulatory Authority

If you feel that your rights have been violated and we have not adequately addressed your concerns, you can lodge a complaint with a supervisory authority. In the European Union, this would be the data protection authority in the country where you reside.