Privacy Policy

1. Introduction

This Privacy Policy describes how Igor Apelski – iasoftware (Polish Tax ID / NIP: 5242985396), based at Marcina Kasprzaka 31/119, 01-234 Warsaw, Poland ("Witnessy", "we", "us" or the "Provider"), the creator and publisher of the Witnessy mobile application (the "App"), handles information in connection with your use of the App.

Privacy contact: support@witnessy.com.

The App is distributed through Google Play. This Policy concerns the App itself and the informational website witnessy.com. It does not concern Google Play, your device's operating system, or third-party products or services, which are subject to their own terms and privacy policies.

2. Scope

This Policy applies to your use of the "Witnessy" mobile App available on Google Play and to the informational website witnessy.com. Using the App means you acknowledge this Policy. If you do not agree, you should stop using the App and uninstall it.

3. Privacy at a glance

The rest of this Policy explains each of these points in detail, describes the few situations in which the App connects to the internet, and sets out your rights under applicable data-protection law.

4. What we do not collect

To state the App's approach to privacy unambiguously, here is what Witnessy does not do:

• we do not require, create or maintain a user account, profile or login;
• we do not ask for your name, email address, phone number, contacts or address book, and the App does not transmit them to us;
• we do not upload, stream, archive or replicate your recordings and transcriptions to any server operated by us or for us;
• we do not use advertising networks and do not display ads in the App;
• we do not embed any analytics, telemetry, crash-reporting, attribution or device-fingerprinting tools in the App;
• we do not use cookies or similar identifiers, neither within the App nor on the witnessy.com website;
• we do not access your location, camera, photos or media library, calendar, SMS messages or call log;
• we do not sell, rent or share your personal data and do not process it for cross-context behavioural advertising.

5. Data stored on your device

Witnessy is an audio recorder that operates in a continuous "loop" mode. To perform its function, it creates and stores the following items solely on your device. Unless you deliberately export a file (see Section 6), none of them leaves your phone.

5.1. On-device transcription

Transcription and word search within recordings take place on your device using the open-source Vosk speech-recognition engine and the language model you select. This entire process runs locally. Your audio recordings are not sent to us or to any third party for transcription. Words with low confidence may be shown in the transcription as "…".

5.2. App lock

If you enable the app lock, unlocking is handled by your device's security mechanism (fingerprint, face, or screen PIN/pattern/password) through the standard Android biometric prompt. The App never sees, receives or stores your biometric data or PIN, that verification is performed by the Android operating system. The App only stores whether the lock is on or off.

6. When data leaves your device

The App connects to the internet only in the limited situations described below. In none of them does the App send us your recordings or transcriptions.

a. Downloading speech-recognition models

When you choose to download a language model for transcription or word search, the App downloads it over the internet from the official Vosk model repository operated by Alpha Cephei (alphacephei.com). As with any network connection, the server operator may process technical connection data such as your IP address, the file being downloaded and the approximate region, under its own terms. This request contains no information about your recordings or about how you use the App.

b. Subscriptions and payments

Witnessy Premium is sold and billed through Google Play. When you purchase a subscription, your purchase and payment are handled by Google under Google's terms and privacy policy, we never receive your card details or payment data. The App checks subscription status directly with Google Play on your device; the resulting entitlement information stays on the device. We do not run a server to receive it.

c. Recordings you export

You can export a saved recording to a folder of your choosing (for example, in device storage, on an SD card, or in a folder synced to a cloud drive). When you do, the App decrypts that single file and saves it to the chosen location as an audio file. Once exported, the file is outside the App's protection and remains under your control and your responsibility, including with respect to any cloud service or recipient you give it to.

d. Opening links

The App contains links (for example, to this Policy, the Terms, and to subscription management in Google Play). Opening a link takes you to your browser or to Google Play, each of which is subject to its own terms.

e. Support correspondence

If you contact us (for example, by email), we will receive what you include in it, your email address and the content of your message, together with any diagnostic details if you attach them. We use this information solely to respond to and handle your request.

7. App permissions

The App requests only the permissions necessary for it to work:

The App does not request access to your location, contacts, camera, photos/media, calendar, SMS messages or phone. You can review and change permissions at any time in your device settings; disabling the microphone permission will prevent recording.

8. Third-party services

A small number of third parties are involved in the situations described above. How they handle any data is subject to their own policies:

• Google Play / Google. Distribution of the App, updates and subscription billing. See policies.google.com/privacy.
• Alpha Cephei (Vosk models). Hosting of the offline speech-recognition models you can download. See alphacephei.com.
• Your device's operating system (Android). Provides the microphone, encrypted keystore and biometric / screen-lock verification.

We do not integrate any advertising, analytics or data-broker services.

9. The witnessy.com website

The witnessy.com website is a static informational site. It requires no account, contains no data-collection forms, and uses no cookies, analytics or advertising tools.

Server logs. The site is hosted on servers located in the European Union by a hosting provider acting as a processor on the Provider's behalf. Like any web server, the server records technical connection data in its logs: IP address, the date and time of the request, the requested URL, the browser identifier (user-agent) and the referring page. This data is processed solely to deliver the site, ensure its security (including abuse analysis) and diagnose errors, on the basis of the Provider's legitimate interest (Art. 6(1)(f) GDPR), and is kept for a limited period necessary for those purposes, after which it is automatically deleted or overwritten. From the logs, the hosting provider also generates automatic, aggregate visit statistics that may contain the IP addresses of some visitors. We do not combine the logs or statistics with any other data and do not use them to identify visitors.

10. Roles and legal bases

Because the App stores your content locally and we have no access to it, our role as data controller is very limited. You decide whether, when and whom you record. Where the GDPR applies, it is you, not the Provider, who determines the purposes and means of recording and bears responsibility for the recordings you make. If a recording is a purely personal or household activity, the household exemption may apply; if you record identifiable people for other purposes, or publish or share recordings, you may become a controller with your own obligations (see the Terms).

In the few situations where the Provider processes limited data, the legal bases are set out in the table below:

11. Your rights

Depending on where you live, you may have rights to access, rectify, erase, port, restrict or object to the processing of your personal data, as well as to withdraw consent and lodge a complaint with a supervisory authority.

Because your recordings, transcriptions and related data are on your device rather than in our systems, you can exercise the most important of these rights directly and immediately:

• Access and portability: Your recordings are on your device; you can play them and export saved recordings to a location of your choosing.
• Erasure: delete individual recordings, transcriptions or the search history in the App, or uninstall the App to remove all its data from the device.
• Rectification: edit the titles and notes you add to recordings.
• Withdrawal of consent: stop using the App and/or uninstall it; disable the microphone permission in your device settings.

For any data we may hold about you (e.g. support correspondence), or to ask questions about this Policy, write to support@witnessy.com. We will respond within the time required by law. For payment data, also contact Google. In practice, because most data is processed locally and the Provider has no access to it, you can carry out many requests yourself in the App.

12. Regional information

European Economic Area and the United Kingdom (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, you have the rights listed in Section 11, including the right to lodge a complaint with the competent supervisory authority (in Poland, the President of the Personal Data Protection Office; in the UK, the Information Commissioner's Office). We do not make solely automated decisions producing legal or similarly significant effects.

California (CCPA/CPRA)

In the preceding 12 months, the Provider has not collected consumers' personal data in its systems through the App, has not sold or shared personal data, and has not used it for cross-context behavioural advertising. California residents have rights to know, delete, correct and to non-discrimination; you can exercise them as described in Section 11. The recording of conversations is governed by separate California law (see the Terms).

Other U.S. states

If you live in a U.S. state with a consumer privacy law (for example, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others), the same position applies: we do not collect, sell, share or use your personal data for targeted advertising through the App. You can exercise your rights via the contact indicated in Section 19.

Brazil (LGPD)

To the extent the LGPD applies, our role is limited as described in Section 10. Data subjects have rights to confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and withdrawal of consent. You can contact us (Section 19) and also approach the Brazilian data protection authority (ANPD).

Japan (APPI)

To the extent Japan's Act on the Protection of Personal Information (APPI) applies, we process personal data solely for the purposes described in this Policy, do not share it with third parties except as described here, and respond to requests for disclosure, correction and cessation of use to the extent required by law.

India (DPDP Act 2023)

To the extent India's Digital Personal Data Protection (DPDP) Act applies, we process personal data solely for the purposes described here and on the bases indicated in Section 10. As a Data Principal, you can access, correct and erase your data, nominate a representative, and raise grievances, and you can approach the Data Protection Board of India.

Other regions

Regardless of where you live, we apply the same data-minimisation principles described in this Policy: your content stays on your device, and we do not operate systems that would collect it. If the laws applicable in your country (e.g. PIPEDA and Law 25 in Canada, the Privacy Act in Australia, PIPA in South Korea, the nFADP in Switzerland) grant you rights regarding personal data, you can exercise them as described in Section 11 or by contacting us (Section 19). We will respond within the time required by the applicable law.

13. Data retention and deletion

You control how long your data is kept:

• The loop keeps only the most recent audio for the retention window you set (up to 24 hours on the free tier, or up to 31 days with Premium) and automatically deletes older audio as it rolls forward.
• Saved recordings and their transcriptions remain until you delete them.
• If Premium expires, audio older than the free 24-hour window is locked and, after a grace period of 3 days, is deleted, so that retention returns to the free-tier limit. Export anything you want to keep before Premium ends.
• Uninstalling the App removes its recordings, transcriptions, database, downloaded models and settings from your device.
• Support correspondence is kept for up to 12 months after the request is closed, for handling any related matters and for establishing and defending claims, after which it is deleted, unless longer retention is required by applicable law.

14. Data security

• Encryption at rest. Finished loop segments, saved recordings in the archive and transcriptions are stored encrypted, using strong, authenticated encryption (AES-256-GCM). Encryption keys are stored in the device's hardware-backed keystore (Android Keystore).
• Private storage. App data is stored in areas of storage that are private to the App and inaccessible to other apps.
• App lock. You can require biometric verification or the device screen lock to open the App.
• No cloud attack surface. Because we store none of your content on servers, there is no cloud copy of your recordings for anyone to breach.

No method of storage or processing is completely secure. The security of your data also depends on keeping your device secure, using a screen lock, keeping the operating system up to date, and controlling who has access to your unlocked device and to exported files.

15. Children

The App is intended for adults and is not directed to children. To use the App, you must be at least 18 years old (or older, if that is the age of majority in your place of residence). By using the App, you confirm that you are 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data (for example, in support correspondence), contact us and we will delete it.

16. Transfers outside the EEA

Because your content stays on your device, cross-border transfers are minimal. The few internet-requiring activities, downloading models from Alpha Cephei and communicating with Google Play, may involve servers located outside the EEA (e.g. in the USA). These third parties are responsible for the transfer mechanisms appropriate to their services (e.g. the EU Standard Contractual Clauses). If you contact us from outside Poland, your correspondence will be handled in Poland, with appropriate safeguards where required by law.

17. Changes to this Policy

We may update this Policy from time to time in connection with changes to the App, the law or technology. When we make a material change, we will update the "Last updated" date above and, in line with the versioned consent in the App, ask you to review the Policy again in the App before continuing to use it. The current version is always available at witnessy.com and in the App.

18. Language versions

We make the Policy available in several language versions. The source version is the Polish version, and in the event of a discrepancy between translations it prevails. This does not, however, limit any mandatory rights available to you under the law applicable to your place of residence, nor your right to rely on the version in the language in which the Policy was presented to you.

19. Contact

• Data controller: Igor Apelski – iasoftware (Polish Tax ID / NIP: 5242985396)
• Email: support@witnessy.com
• Address: Marcina Kasprzaka 31/119, 01-234 Warsaw, Poland
• Website: witnessy.com

See also our Terms of Service.