Privacy Policy

This Privacy Policy describes how FastProducts LLC (the "Company," "we," "us," or "our") collects, uses, discloses, and otherwise processes information in connection with the WhisperJot desktop applications for macOS, Windows, and Linux (the "Software"), the website at https://whisperjot.com (the "Website"), and related services, downloads, accounts, updates, cleanup reports, and communications (collectively, the "Service"). WhisperJot is a product of FastProducts LLC.

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

Privacy at a Glance

WhisperJot is designed as a local-first dictation product:

• Your microphone audio is captured and transcribed on your device by speech models downloaded to your machine. We do not receive your live dictation audio or transcripts unless you intentionally submit them to us or select the optional Jot Cloud engine.
• Optional cloud transcription (Jot Cloud). If you select the Jot Cloud engine, dictation audio and minimal request metadata are sent to our servers and relayed to a speech-to-text subprocessor for transient processing. We do not store your audio on our servers. Local engines remain the default.
• Optional transcript sync (WhisperJot Cloud). If you turn on sync, your transcripts — text, titles, and timestamps, never audio — are stored on our servers so you can browse and search them on the Website and across devices. Off by default; delete server copies anytime.
• The Software may store local history, transcripts, vocabulary, replacement rules, settings, temporary crash-recovery audio, and retained recording audio on your device, depending on your settings. You control and secure this local data.
• Optional cleanup reports are sent only when you choose to report a specific result. Reports include the text shown to you for that report, not audio.
• Optional LLM cleanup is intended for local runtimes by default, but the endpoint can be configured. If you point the Software at a remote or non-loopback LLM endpoint, text and context sent to that endpoint may leave your device.
• The Software does not send product analytics, behavioral telemetry, or crash reports by default. An optional, off-by-default usage-statistics setting (Section 1) shares anonymous feature-usage events — never audio, transcripts, or content — only if you turn it on.
• The Website, account system, downloads, update checks, remote configuration checks, cleanup rule-pack checks, email features, the in-browser demo, and cleanup-report endpoint may create ordinary server logs and involve third-party service providers.

How the two transcription modes differ:

The rest of this Privacy Policy explains what we collect, why we use it, and the choices you have.

1. Information We Collect

a. Information you provide directly

• Account information. If you create an account or sign in, our identity provider, Clerk, processes your email address, authentication credentials, sign-in events, and authentication cookies on our behalf. We may store your email address, account identifier, Clerk user ID, email-verification status, terms-acceptance status, marketing preference, account status, and related administrative fields.
• Communications and support. If you contact us, reply to emails, submit feedback, or request support, we receive your email address and the contents of your message.
• Opt-in cleanup reports. If you choose to report a cleanup result, we receive the raw transcription text, cleaned transcription text, any expected output or note you add, platform, app version, cleanup rule-pack version, timestamp, and ordinary request metadata. The report endpoint limits report size and rate. Cleanup reports are never sent automatically by the Software.
• Diagnostics you choose to share. The Software can export diagnostics to a file you choose. The export is designed to omit transcripts, vocabulary, replacement rules, and history content, but if you send a diagnostics file to us, we receive whatever it contains.
• Performance metrics you opt in to share. The Software includes an optional, off-by-default setting to send performance measurements to us: transcription and model-loading timings, the engine and speech-model identifiers in use, the speech runtime variant that loaded, and a coarse hardware profile (CPU core count, memory size, instruction-set support, operating system version, and app version). These reports never include audio, transcripts, vocabulary, replacement rules, history content, or your account identity. They are grouped by a random identifier generated on your device when you opt in; turning the setting off deletes that identifier, and reports are not linked to your account or IP address on our servers. We use these metrics solely to understand and improve the Software's performance.
• Usage statistics you opt in to share. The Software includes an optional, off-by-default setting to share anonymous usage statistics through our analytics provider, PostHog: which features are used (for example, that a dictation or meeting transcription completed, or that a settings category was changed), the engine and speech-model identifiers in use, coarse measurements such as durations and counts, and app version and operating system version. These events never include audio, transcripts, vocabulary, replacement rules, clipboard contents, typed text, or your account identity. They are keyed by a random identifier generated on your device when you opt in; turning the setting off deletes that identifier and stops all sending. We use these statistics solely to understand which features are used and to improve the Software.
• Email and marketing preferences. If email features are enabled, we may process registration, welcome, getting-started, unsubscribe, bounce, and segment information through our email provider. We send marketing email only if you opt in (for example, at sign-up), and you can withdraw that consent at any time using the unsubscribe link in any marketing email.
• Billing information. If you start a paid plan, Stripe processes payment details and billing events on our behalf. We may store Stripe customer and subscription identifiers, plan identifiers, account status, renewal timing, and related billing metadata.
• Other voluntary information. We collect any other information you choose to provide to us.

Please do not submit sensitive personal information, confidential third-party information, protected health information, financial account numbers, government identifiers, passwords, secrets, or other regulated content to us unless we specifically request it in writing.

b. Information collected automatically

• Server logs. When you visit the Website or when the Software contacts our servers, our servers may record standard log data such as IP address, browser or client type, operating system, requested URL, referrer, timestamps, response status, request ID, and security or debugging metadata.
• Service interactions. We may process requests for downloads, signed cleanup rule packs, update feeds, remote configuration flags, health checks, robots/sitemap files, account pages, email webhooks, and cleanup reports.
• Email delivery and engagement events. When we send you email, our email provider reports delivery and engagement events — such as sent, delivered, delayed, opened, clicked, bounced, or marked as spam — which we store to operate email features, honor unsubscribes, and monitor deliverability.
• Cookies and similar technologies. See Section 3.
• Rate-limit and abuse-prevention data. We may process IP addresses, request counts, timestamps, and related metadata to detect and limit abuse.

The Software does not automatically send us dictated audio, transcript history, vocabulary, replacement rules, clipboard contents, selected text, application names, usage analytics, device identifiers, or crash reports. The exceptions are the optional Jot Cloud engine (while you have explicitly selected it, dictation audio and related request data are sent to our servers as described in Section 5), optional transcript sync (while you have explicitly enabled it, transcript text and related metadata — never audio — are stored on our servers as described in Section 6), and the optional performance-metrics and usage-statistics settings (while you have explicitly enabled them, anonymous measurements and feature-usage events — never content — are sent as described in Section 1).

c. Local data processed by the Software

Depending on platform and settings, the Software may process or store locally:

• microphone audio during an active dictation session;
• temporary crash-recovery audio until a session completes or is recovered;
• retained recording audio for re-transcription when enabled;
• raw and cleaned transcripts in local history when history is enabled;
• vocabulary terms, replacement rules, cleanup profiles, selected settings, hotkeys, audio device preferences, launch-at-login preferences, account email/user ID, and authentication confirmation timestamps;
• local refresh tokens or session credentials stored through platform protections such as Keychain or DPAPI where implemented;
• selected text and recent clipboard text for optional LLM cleanup context; and
• diagnostics exports saved to a location you choose.

This local data is not held by us unless you choose to send it to us. Local data is subject to your operating system, account, file-system permissions, disk encryption, backups, malware protections, and anyone with access to your device.

d. Information from third parties

• Sign-in providers. If you sign in using a third-party provider, such as Google through Clerk, we may receive basic profile information such as your email address, subject to that provider's settings and policies.
• Service providers. We may receive operational information from service providers such as Clerk, Stripe, Resend, hosting providers, database providers, and security or infrastructure providers.
• Model and download providers. Third-party model, repository, CDN, or release-hosting providers may independently process your IP address and request metadata when your device downloads models, releases, or related files. The downloaded speech models themselves run locally on your device: using a local engine never transmits your audio or transcripts to the model's publisher or anyone else.

2. How We Use Information

We may use information to:

• provide, operate, maintain, secure, and troubleshoot the Service;
• authenticate users, manage accounts, gate downloads, and enforce account or license status;
• provide downloads, update feeds, cleanup rule packs, support, and administrative communications;
• send welcome, getting-started, transactional, product-update, or marketing emails where permitted;
• process unsubscribe, bounce, suppression, and email-delivery events;
• receive and review opt-in cleanup reports, diagnostics, support messages, and feedback;
• improve cleanup rules, test cases, product quality, documentation, security, and reliability;
• detect, investigate, prevent, and respond to fraud, abuse, scraping, excessive requests, security incidents, unauthorized access, or violations of our Terms;
• comply with legal obligations, preserve rights, and enforce agreements;
• analyze aggregated or de-identified information; and
• carry out any other purpose disclosed at collection or with your consent.

3. Cookies and Similar Technologies

The Website uses limited cookies and similar technologies, including:

• session, security, and CSRF cookies set by our web framework;
• authentication cookies set by Clerk when you sign in or out;
• cookies or local storage required by third-party account components embedded on our pages; and
• with your consent only, analytics cookies and local storage set by Google Analytics and PostHog, and the Meta Pixel's advertising-measurement cookies _fbp and _fbc (see below).

With your consent, the Website uses Google Analytics and PostHog to understand how visitors find and use the site (pages viewed, referring sources, and campaign parameters such as UTM tags), to replay consented browsing sessions on our own site (with typed input masked), and to diagnose website errors. Analytics cookies are set only after you choose "Accept" on the cookie banner; if you decline, no analytics scripts load. You can change or withdraw your choice at any time via the "Cookie preferences" link in the site footer, which re-opens the banner. If you are signed in when you accept, website analytics may be associated with your account identifier so we can understand product usage across visits. If you sign up, we may also record the campaign parameters (UTM tags), referring page, and landing page from your first visit alongside your account, to understand which channels our customers come from. For accounts that accepted analytics cookies, we also record account lifecycle events (such as subscription changes and first use of cloud features) on our servers and send them to the same analytics provider; declining or withdrawing consent stops this.

Advertising measurement (Meta Pixel and Conversions API). With your consent via the same cookie banner, the Website loads the Meta Pixel and sets the _fbp (browser) and _fbc (ad-click) cookies so that Meta Platforms, Inc. can measure whether its ads led to a page view, sign-up, checkout, installer download, download-link request, or purchase on our site. For the same purpose, and only for consenting visitors, our servers may send Meta a matching sign-up, checkout, download, or purchase event containing a hashed (SHA-256) version of your email address and account identifier, the _fbp/_fbc values, your IP address and browser user agent, and the plan, order amount, currency, and order identifier — never audio, transcripts, or other content. When you are signed in, the pixel in your browser is also initialized with the same hashed (SHA-256) email address and your account identifier (“advanced matching”) so that Meta can match these events more reliably; your plain-text email address is never sent to the pixel. If you sign up while consent is granted, we store those _fbp/_fbc values, IP address, and user agent with your account so that a later purchase can be attributed to the click. Declining or withdrawing consent stops the pixel, deletes its cookies, and stops server-side events for your account. Meta processes this information under its own terms; you can also manage ad preferences in your Meta account settings.

Apart from the consent-gated Meta Pixel described above, we do not use advertising cookies or cross-site behavioral advertising cookies on the Website. The Software itself does not set browser cookies. You can configure your browser to refuse cookies, but account, download, and security features may not function properly.

4. Third-Party Services

We use service providers and third-party components to operate the Service, including:

• Clerk for identity, authentication, account UI, verification, session handling, and related account emails;
• Stripe for checkout, subscription and one-time purchase billing, promotional codes, customer portal sessions, payment processing, invoices, taxes, and billing webhooks, if configured;
• Resend for transactional and marketing email delivery, contact management, segments, unsubscribe handling, and delivery/engagement events such as opens, clicks, bounces, and spam complaints, if configured;
• Google for Google sign-in if you choose it, Google Fonts on the Website, and — only with your consent via the cookie banner — Google Analytics for Website usage statistics;
• PostHog, Inc. for — only with your consent via the cookie banner — Website analytics, session replay, and error diagnostics, and — only if you enable the opt-in usage-statistics setting in the Software — anonymous product-usage events (processed in the United States);
• Meta Platforms, Inc. for — only with your consent via the cookie banner — advertising measurement through the Meta Pixel and Conversions API (hashed sign-up, checkout, download, and purchase conversion events and advanced matching, as described in Section 3; processed in the United States);
• Groq, Inc., Deep Infra, Inc., or OpenAI, L.L.C. — the speech-to-text processing subprocessor for the optional Jot Cloud engine and the optional meeting agents feature (whichever we have configured at the time, including as an automatic backup during outages), used only if you select that engine or send a meeting agent (audio processed transiently in the United States);
• Deepgram, Inc. — the speaker-identification subprocessor for the optional, per-recording “Identify Speakers” feature, used only when you explicitly request speaker labels for a recording (audio processed transiently in the United States and never stored on our servers);
• Hugging Face, GitHub, model publishers, repository providers, and release/CDN providers for model, dependency, release, or asset downloads;
• DigitalOcean for website hosting, managed databases, and object storage/CDN used to serve release downloads, update feeds, and remote configuration flags;
• Other hosting, database, infrastructure, logging, and security providers as needed to run and protect the Website and related endpoints;
• Local or user-configured LLM runtimes such as MLX-LM, Ollama, LM Studio, llama.cpp-compatible servers, or OpenAI-compatible endpoints, if you configure and use them.

Third-party services process information under their own terms and privacy policies. We are not responsible for third-party services, models, endpoints, applications, operating systems, or providers that you choose, configure, or interact with through the Service.

5. Optional Cloud Transcription (Jot Cloud)

The Software includes an optional cloud transcription engine called "Jot Cloud." Local engines remain the default: they run entirely on your device using downloaded models, and while a local engine is selected, your dictation audio is never processed by us or by any third party (transcript text leaves your device only if you submit an opt-in cleanup report or configure a non-local LLM endpoint — see Sections 1 and 7). Cloud transcription is used only while you have explicitly selected the Jot Cloud engine, and it works differently — audio is processed by our servers and a speech-to-text subprocessor as described below.

• What is sent. If you select the Jot Cloud engine, the Software sends the dictation session's audio, engine and language parameters, app version and platform, the account token authorizing the request, and ordinary request metadata such as IP address and timestamps.
• When. Cloud transcription occurs only while Jot Cloud is explicitly selected — never by default and never automatically. Re-transcribing saved recordings while Jot Cloud is selected also uses cloud transcription, as disclosed in the in-app consent.
• How and where. Audio is sent over an encrypted connection to our servers in the United States and relayed to a speech-to-text subprocessor in the United States for transcription.
• Retention. We do not store your dictation audio on our servers. Audio is processed in memory, relayed for transcription, and the resulting transcript is returned to your device, where it is handled according to your local history settings. Our server logs record request metadata but never audio or transcript content. The speech-to-text subprocessor processes audio on our behalf solely to return your transcript; any transient retention by the subprocessor (for example, for trust-and-safety or reliability purposes) is governed by that provider's own policies. The providers we may use are named in Section 4.
• Consent and withdrawal. The Software asks for your consent before the first use of Jot Cloud. Switching back to a local engine stops all cloud transcription immediately.
• Subscription and fair use. Using Jot Cloud in the Software requires an active subscription, and cloud transcription is subject to reasonable fair-use limits to prevent abuse.
• Website demo. The Website offers an in-browser demo that transcribes a short clip you record or upload. Demo clips are relayed for transcription in the same way as Jot Cloud requests — processed in memory and not stored on our servers — and are subject to short clip-length, size, and rate limits. The demo does not require an account, and our logs record only ordinary request metadata, never audio or transcript content.

Meeting agents (optional, invite-only pilot)

The Service includes an optional meeting-agent feature, currently in an invite-only pilot: at your request, a notetaking agent joins a meeting you specify (for example a Google Meet, Microsoft Teams, or Zoom meeting) and produces a transcript for you. Meeting agents never join a meeting automatically — one runs only when you explicitly send it, and only after you have given consent in your account.

• What is processed. While an agent is in a meeting, the meeting's audio is processed transiently on our servers and relayed to a speech-to-text subprocessor named in Section 4 to produce your transcript. We do not store meeting audio — recording is disabled at the platform level, and our logs record request metadata, never audio or transcript content.
• What is stored. The transcript (including speaker labels), the meeting link you submitted, title, timing, and status are stored with your account until you delete the meeting; deleting a meeting deletes its transcript immediately.
• Other participants. The agent joins under a visible participant name so people in the meeting can see it. You are responsible for obtaining any consent from other participants that applicable law or the meeting's rules require before sending an agent.
• Consent, withdrawal, and fair use. The feature asks for your consent before first use, and you can revoke it at any time from your account. Meeting agents are subject to duration, concurrency, and monthly fair-use limits.

6. Optional Transcript Sync (WhisperJot Cloud)

The Software includes an optional transcript sync feature ("WhisperJot Cloud") that stores your dictation and meeting transcripts on our servers so you can browse, search, and manage them at whisperjot.com/account/ and keep them in sync across your devices. Sync is off by default and runs only after you explicitly enable it on a device.

• What is stored. If you enable transcript sync on a device, the Software uploads transcript text (including raw pre-cleanup text), titles, timestamps, durations, the name of the application you dictated into, engine names, and device names. If you separately enable settings sync, custom vocabulary, text replacement rules, and a limited allowlisted subset of app settings are stored as well. We never store your dictation audio — sync has no ability to upload audio or audio files.
• How it is stored. Synced transcripts are stored encrypted at rest on our servers in the United States. They are not end-to-end encrypted: our systems can read them in order to provide the service (for example, to run full-text search), and they are shown to you on the Website when you are signed in.
• Consent and withdrawal. Each device asks for your consent before its first sync. Turning sync off stops future uploads; content synced earlier remains stored until you delete it.
• Deletion. You can delete individual conversations or all synced content at any time from your account pages ("Turn off sync and delete server copies") or via the app. Deletion removes transcript content from our systems immediately; a content-free deletion marker is retained briefly (up to 30 days) so your other devices learn about the deletion, then removed. Deleting your account removes all synced content.
• Fair use. Sync is subject to reasonable storage and rate limits to prevent abuse.

7. Local LLM, Context, and Third-Party Applications

If LLM cleanup is enabled, the Software may send raw transcript text, cleanup prompts, selected text, and, if enabled, recent clipboard text to the configured LLM endpoint. Defaults are intended for loopback/local endpoints, but the Software may allow custom endpoints. If you configure an endpoint that is remote, shared, proxied, logged, or operated by someone else, the information sent to it may leave your device and be processed by that endpoint's operator.

The Software may type, paste, replace, or submit text into third-party applications. We do not control those applications or what they do with inserted text. Your use of those applications is governed by their terms and privacy policies.

8. Data Sharing and Disclosure

We do not sell personal information. Except for the consent-gated Meta advertising measurement described in Section 3 — which may be considered "sharing" for cross-context behavioral advertising under some state laws, and which you can opt out of by declining or withdrawing cookie consent — we do not share personal information for cross-context behavioral advertising. We may disclose information:

• To service providers that process information on our behalf to operate, secure, and support the Service;
• To third parties you choose when you use sign-in providers, model providers, local or remote LLM endpoints, email links, support channels, or applications that receive dictated text;
• For legal compliance when required by law, subpoena, court order, legal process, or governmental request;
• To protect rights and safety of the Company, users, third parties, the public, accounts, infrastructure, and the Service;
• In business transfers involving a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets;
• With consent or at your direction; and
• As aggregated or de-identified information that cannot reasonably identify you.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain accounts, comply with law, resolve disputes, enforce agreements, prevent abuse, and protect our rights.

Account records may be retained while your account is active and for a reasonable period after deletion where required or permitted by law. Cleanup reports, support messages, and diagnostics you submit may be retained for product improvement, security, support, legal, and recordkeeping purposes. Server logs are retained for a limited period appropriate for security, debugging, operations, and compliance. Cloud-transcription usage records — request metadata such as timestamps, durations, sizes, status, and a hashed network identifier, never audio or transcript content — are retained for approximately 90 days. Email delivery and engagement event records are retained for approximately 12 months. Aggregated or de-identified information may be retained indefinitely.

Local data stored by the Software on your device, including history and retained audio, is controlled by your settings and device. We cannot delete local data we do not possess. You can use in-app settings, account settings, operating system tools, or uninstall/delete flows to manage local data, subject to platform behavior.

10. Data Security

We use commercially reasonable technical and organizational measures designed to protect information we process, including transport encryption for connections to our servers and platform-protected storage for certain local authentication tokens where implemented. However, no system, device, network, software, storage method, or transmission is completely secure.

We cannot guarantee absolute security. We are not responsible for unauthorized access, disclosure, corruption, or loss that occurs despite reasonable measures, or for risks created by your device, operating system, backups, malware, local files, third-party applications, configured LLM endpoints, shared computers, weak credentials, or account compromise.

You are responsible for securing your account credentials, devices, operating system accounts, local files, backups, and any local or remote endpoints you configure.

11. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13, we will take appropriate steps to delete it. If you believe a child provided us personal information, contact us at info@fastproducts.io.

12. International Data Transfers

We are based in the United States. Information may be processed in the United States and other countries where we or our service providers operate. These countries may have privacy laws that differ from those in your jurisdiction. Where required, we take steps designed to provide appropriate safeguards for international transfers.

13. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to certain processing of your personal information, and to withdraw consent where processing is based on consent.

To exercise rights, contact us at info@fastproducts.io. We respond to verified requests within the time required by applicable law. We may need to verify your identity and may decline or limit requests where permitted by law, including where a request is fraudulent, excessive, infeasible, affects others' rights, concerns information we do not control, or conflicts with legal obligations or legitimate business needs. We may charge a reasonable fee for manifestly unfounded or excessive requests where permitted.

If you have an account, you can also delete it from your account page on the Website. Account deletion removes your account with our identity provider, cancels any active subscription, removes you from our email lists, and deletes or de-identifies the account records we hold, except where retention is required or permitted by law (for example, records our payment processor keeps for tax and accounting purposes, and limited abuse-prevention metadata).

Because much of WhisperJot's data is stored locally on your device and not held by us, some privacy requests must be completed by you through the Software, your account settings, your operating system, or deletion of local files.

14. California Privacy Rights

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended, including the right to know, access, correct, delete, and obtain a copy of certain personal information; the right to opt out of sale or sharing; the right to limit use and disclosure of sensitive personal information where applicable; and the right not to be discriminated against for exercising your rights.

We do not sell personal information. The consent-gated Meta advertising measurement described in Section 3 may be considered "sharing" under the CCPA; you can opt out at any time by declining the cookie banner or using the "Cookie preferences" link in the site footer. To exercise California privacy rights, contact us at info@fastproducts.io.

15. European and UK Privacy Rights

If you are in the European Economic Area, Switzerland, or the United Kingdom, we process personal information on legal bases that may include performance of a contract, legitimate interests, consent, and compliance with legal obligations.

You may have rights described in Section 13, as well as the right to lodge a complaint with your local supervisory authority. Where we rely on consent, you may withdraw it at any time, but withdrawal does not affect processing that occurred before withdrawal.

16. Do Not Track

Some browsers transmit "Do Not Track" or similar signals. Because there is no uniform industry standard for these signals, the Website does not currently respond to them.

17. Changes to This Privacy Policy

We may update this Privacy Policy at any time. Changes are effective when posted on this page, with the "Last Updated" date revised. Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

18. Contact

If you have questions about this Privacy Policy, contact us at info@fastproducts.io.