Your voice stays yours.

• While you hold the hotkey, your microphone is on.
• When you release the hotkey, your audio is sent to a transcription service, returned as text, and immediately discarded. Audio is never stored on the server.
• On-device mode (Settings → Transcription → On your Mac) skips the server entirely. Your audio is transcribed locally on Apple Silicon. Nothing leaves the device. The audit log inside Halopen still records the dictation locally so you can recover the text, but the endpoint shows "(local)" — confirming no network call happened.
• Halopen does not record continuously. It does not transcribe in the background. It does not capture your screen.
• Halopen stores a small amount of operational metadata on the server — your account, your subscription state, and per-device data so your /account/ page can show you which Macs you’ve signed into. No transcripts, no audio.
• Your dictation text lives in the local audit log on this Mac, controlled by you. Each dictation’s transcript (and, if Polish or Editorial cleanup ran, the cleaned text) is kept in ~/Library/Application Support/Halopen/audit-log.json with owner-only file permissions, so you can copy any past dictation back if it went somewhere unexpected. Halopen never uploads this file. You control retention from Settings → Privacy (default: Keep everything; you can pick 7 / 30 / 90 days, or Off to clear everything and stop recording).
• Halopen does not sell or share your data. There is nothing to sell — none of it is kept.

Halopen now ships two transcription pipelines, and the privacy posture is different in each. Pick the one that fits the moment.

• Cloud (default) — audio is uploaded to our transcription endpoint while you hold the hotkey, transcribed via OpenAI’s gpt-4o-transcribe, returned as text, and discarded. Highest accuracy. Audit log records each call, including the resulting transcript text (locally, on your Mac).
• On your Mac (optional, opt-in) — audio is transcribed on Apple Silicon via WhisperKit. The model file (~600 MB) lives at ~/Library/Application Support/Halopen/Models/. Nothing about the audio leaves the device. Audit log records the dictation with “(local)” as the endpoint so you can confirm at a glance that no network call happened, and so you can copy the transcript again later if you need to. Requires an M-series Mac.

You can switch between the two at any time from Settings → Transcription. The choice is local to your Mac; it doesn’t affect billing.

To dictate text, Halopen needs to hear what you say while you hold the hotkey and to know that you held the hotkey. Specifically, when the hotkey is held:

• Microphone audio — captured by the operating system and held in memory in a temporary buffer.
• Hotkey state — when you start and stop holding the key.

When the hotkey is released, the buffered audio is compressed and uploaded to our transcription service (Cloud mode) or transcribed entirely on your Mac (on-device mode), and the resulting text is placed at your cursor in the active app.

When the hotkey is not held, the microphone is not active. Halopen does not stream audio continuously. There is no “always-on” mode.

Halopen can pre-feed context to the transcription engine so proper nouns, brand names, and technical terms land on the first pass. Two sources, with different privacy properties:

• Personal dictionary — words you've added yourself in Settings → Vocabulary. Default ON. When biasing is enabled, your dictionary entries are sent to the transcription engine alongside the audio in Cloud mode; in on-device mode they stay on your Mac. This is content you explicitly authored, so we surface it by default.
• Clipboard contents and currently-selected text — up to 200 characters of the macOS clipboard and 300 characters of the focused app's selected text. Default OFF. When this toggle is on, in Cloud mode Halopen sends those snippets to the transcription service alongside the audio as a spelling hint. We default it off because clipboard contents can contain passwords, API keys, or other material a user copied for a different purpose and would not want sent to a transcription service. A heuristic filter rejects content that looks like a credential (long high-entropy strings, common credential prefixes, password-like words), but the filter is defense in depth — the primary safeguard is leaving the toggle off until you decide otherwise.

The biasing toggles are in Settings → Transcription. Switch the transcription mode to On your Mac if you want the clipboard / selection bias without any network exposure.

Audio leaves your Mac in only one circumstance: a hotkey-bounded clip is sent to our hosted transcription endpoint. The endpoint forwards the clip to a third-party automated speech recognition service, returns the text to your Mac, and discards the audio. Halopen does not retain the audio on the server, and our transcription provider has contractually committed not to train on or retain the audio either.

The local recording, the network upload, and the returned text are all ephemeral. None of them are written to disk on the server. Logs are limited to operational metadata (timestamps, anonymous request IDs, response times) used for monitoring uptime, with no transcript content recorded.

Halopen stores a small amount of state in the standard macOS user defaults database for your account:

• Your chosen hotkey, recording-pill preference, and sound-cue preference.
• A monthly transcription-minutes counter so the menu can show you usage.
• The license token associated with your subscription, after you sign in.

That is the entire footprint. There is no transcript history, no “recent dictations” window, no folder of saved audio. If you want to delete this data, deleting Halopen and removing its preferences via ~/Library/Preferences/com.halopen.Halopen.plist wipes it.

• Your screen. Halopen does not capture, share, or analyze your display.
• Your typing. Halopen does not log keystrokes apart from detecting whether the hotkey is currently held.
• Other applications. Halopen reads the bundle identifier of the foreground app to send your typed text there. It does not read other applications’ content.
• Your clipboard. Halopen briefly snapshots and restores your clipboard around an injection so it isn’t clobbered. The snapshot is discarded immediately.

Halopen relies on the following hosted services to function. None receive identifying information beyond the minimum required for operation.

• Supabase — hosts our transcription endpoint, account database, and edge functions. Stores account email, subscription state, and per-device records so /account/ can list signed-in Macs.
• OpenAI — performs the speech-to-text transcription. OpenAI may briefly retain audio for abuse monitoring per their standard API policy (up to 30 days, then deleted). OpenAI does not train on API data sent through this endpoint. We have not negotiated a Zero Data Retention agreement; if that ever changes, this line gets updated.
• Cloudflare — serves halopen.com and the download. Sees IP addresses (anonymized in our analytics).
• Stripe — processes payments and manages subscriptions. Stripe sees the billing details you provide at checkout (name, billing address, card last-4); Halopen receives only the subscription-state events back via webhook.
• Resend — sends transactional email (sign-in confirmations, comp-grant notifications, refund receipts). Sees the recipient email address and the transactional content of each message.

Halopen is not directed at children under 13 and we do not knowingly collect personal information from them. The product is offered to general audiences.

If we change this policy in a way that materially expands what we collect or retain, we will email subscribers and post the change at the top of this page before it takes effect. The previous version remains available on request.

Questions, deletion requests, or anything else: email [email protected]. We answer in person, usually within a day.