Privacy Policy

Last updated 28 October 2026

Who is responsible

The data controller is Mykhailo Korotych, of Myronenko 43, Poltava, 36010, Ukraine. Contact: support@sayful.app.

What is stored locally on your computer

• Keyboard-layout correction. It is rule-based and runs on your computer, with no account needed; the text you type never leaves your computer. Only the daily count of corrections may be sent (see “Feature counts” below).
• The typing trainer, your notes, boards, pages and their attachments, your history and your settings. Boards, pages and attachments are stored encrypted, with the key in the macOS Keychain. A board you share is also kept on our servers, as described below.
• Your Sayful Cloud session tokens are saved in the macOS Keychain and sent to our backend only to authenticate requests. The encryption key for local dictation history also lives in the Keychain and is not synchronized.
• On Windows, your notes, boards, pages and attachments, dictation history, settings, Sayful Cloud session tokens and a copy of your Google profile picture are stored encrypted with Windows Data Protection (DPAPI) under your Windows account. A board you share, with its pages and attachments, is also kept on our servers, as described below; nothing else stored here is synchronized. Small interface preferences, such as the tab you last opened, are kept unencrypted; so are crash reports and the diagnostic log below, which hold none of your content.
• Crash reports. If Sayful crashes, it keeps a short report on your computer: the app and system versions, where in Sayful's code it failed and the sequence of calls that led there. It never contains what you typed, dictated, selected or copied, or anything shown on your screen, and it is not a memory dump. Only the newest few are kept. A report leaves your computer only if you attach it to feedback; with usage events switched on, the app also counts that a crash happened, without the report.
• A diagnostic log of operational messages, counts and timings (for example how long a dictation took). On Windows it holds none of your content; on macOS it can also include local file paths, filenames derived from note titles, and error details. It stays on your computer unless you send it to us: feedback includes the recent log while “Include system info and logs” is checked, which it is by default.

What we process when you use a cloud feature

By default, dictation, text correction, translation, read-aloud and screen text recognition use Sayful Cloud. The app sends the exact text, recorded audio clip or selected screen region required for that action to our servers, which forward it to a third-party AI provider and return the result. It does not send your wider screen, unrelated clipboard contents or files.

In Notes, the board assistant and the AI actions on a page work the same way, and only when you ask. A request to the board assistant sends what you typed or said together with the titles, fields, dates and the start of the text of cards on your boards; an AI action on a page sends that page's text. Images and files themselves are not sent — only their names where they appear in the page's text.

Sayful Cloud processes that content in memory and does not write it to our database or application logs. The AI provider also processes the content under its own terms and configured retention controls.

AI provider credentials are configured as secrets on our backend. They are not included in or sent to the app. Provider and model routing is also controlled by the backend.

What we do store

• Account: your Google account id, email address, email domain and profile picture URL.
• Recap emails: your choice of recap emails and your computer's time zone (such as Europe/Kyiv), so a recap arrives at 9:00 your time. We record when each recap was sent.
• Usage counts: how many words each request cost, the feature it came from (dictation, chat, the Notes assistant, read-aloud, screen text), and for Notes requests how much board or page text was sent, and which AI model handled it. No content.
• Feature counts: while you are signed in, how many times a day each feature ran on your Mac — automatic layout correction, the double-tap flip, the Shift fix, translation and screen text — linked to your account, so we can see which features people use. Only the numbers, never text. Turn them off with “Send feature counts” in Settings → General. Team members on a company domain who turn off team sharing send none. The Windows app sends these counts only for team members on a company domain, and only while team sharing is on.
• Subscription: your plan, its status, the renewal date and the payment-provider identifiers needed to keep access in sync. We never see or store your card details.
• Referrals: your referral code and, if you invite someone or were invited, the link between the two accounts and whether the reward was granted.
• Your invite link: the page a link you share opens shows your first name from your Google profile, so your friend knows who it is from. Nothing else about you is shown.
• Device key: a salted SHA-256 hash of your computer's hardware UUID, sent by the app with its requests to our servers. It is a one-way hash, not the hardware identifier itself, and we never receive or store the UUID. We use it only to apply two rules: the free week of Pro is given once per computer, and a referral counts only when the friend dictates on their own computer. It is stored with your account and deleted with it.
• Profile picture: your Google profile picture URL, and a custom picture if you upload one. A custom picture is kept in a publicly readable storage bucket so that it can be shown in team rankings, and you can remove it in the app.
• Feedback you send us: your message and anything you choose to attach.
• Notes boards you share: only if you share a board. We keep its content — title, columns, cards, pages and their text, fields, views, and the pictures and files on its cards and pages — so the people you invite can open and edit it, together with who is on it, the email addresses of pending invitations, who changed it last and when. It is encrypted at rest by our database provider but not end to end, so our servers can read it. People on a shared board see each other's names, profile pictures and email addresses, and, while they have the board open, who else is there, which card they are looking at and which paragraph they are writing in; every member keeps a copy on their own computer. While someone types in a card or page that others have open, its text is sent to them as it changes, before it is saved. That live view passes through Supabase's Realtime service on a private channel only the board's members can join. Boards you don't share never leave your computer.

Recap emails

If you have a personal Sayful account, we email you a short monthly recap of how you used Sayful: words dictated, the time that saved, and the features you used. It is built from the usage counts above and never contains your text or audio. A weekly recap is available if you turn it on. Company accounts get no recaps. To stop them, use the “Unsubscribe” link in any recap or choose Off under “Email recaps” in the app’s Account window.

Why we may process it

To provide the app you asked for and to bill you (performance of a contract); to enforce usage allowances, prevent abuse, understand aggregate use of the website and send you the recap emails, which you can stop at any time (legitimate interest); to meet tax and accounting obligations (legal obligation); to see where new users get stuck setting the app up, through the anonymous setup counter below (legitimate interest; it carries no identifier and you can switch it off); and, for the optional in-app analytics below, only if you switch them on (your consent, which you can withdraw by switching them off).

Who else is involved and where they process data

These providers process personal data for us or, in Creem's case, for themselves as the merchant of record.

• Supabase — authentication, database and serverless functions. Data is hosted in the EU (Frankfurt, Germany).
• Railway — runs the nightly backup of our database on servers in the EU (the Netherlands) and stores the backups in Amsterdam. Each backup is encrypted, with a key Railway does not hold, before it is stored. Railway also stores, in Amsterdam, the pictures and files of Notes boards you share, encrypted at rest.
• OpenRouter and Groq — AI providers that process your request content in order to answer it (speech-to-text, text correction, translation, read-aloud, screen text and the Notes assistant). They operate mainly in the United States. OpenRouter forwards a request to the model provider behind the model we select, which then processes it too.
• Creem — merchant of record for purchases completed through Creem Checkout. Creem receives your billing details directly and handles payment, invoicing, sales tax and refunds for those transactions, under its own privacy notice.
• Other checkout providers — if another authorised merchant of record is offered, we identify it before purchase. Sayful never receives or stores your card details.
• Google — sign-in. You authenticate with your Google account, and Google's own privacy policy applies to that step. To show your profile picture, the app also downloads it from Google's image host, which receives your IP address for that request.
• Resend — sends transactional email such as feedback notifications, and the recap emails (United States).
• GitHub — hosts the Sayful downloads and update files, and the keyboard word lists the app fetches. When you download Sayful, or the app checks for or installs an update or a word list, GitHub receives your IP address (United States). The Windows app checks GitHub for updates when it starts, then once a day while it runs, and when you choose Check for Updates.
• Vercel — hosts this website and its small server functions, and provides privacy-preserving, aggregate Web Analytics for the public landing page and the Thanks page. This lets us understand page views, referral and campaign sources, broad country and device/browser information, and which Download button was clicked. We do not send names, email addresses, account or payment data, dictated text, or other user content to website analytics. Analytics does not use tracking cookies, and we do not use advertising networks. Vercel operates a global network with servers mainly in the United States. The Mac app also checks sayful.app for updates, so Vercel sees the IP address of that request.
• PostHog — the anonymous setup counter and optional in-app analytics, described below (United States).

International transfers

We are based in Ukraine, our database is in the EU, and several providers above process data in the United States. Where personal data is transferred to a provider outside your country, the EEA or the UK, we rely on standard contractual clauses or equivalent safeguards with that provider.

What this website loads

This website loads its own pages, styles, scripts, images, videos and fonts from sayful.app. The fonts (Geist, Newsreader, IBM Plex Mono) are self-hosted; no font, script or tracker is loaded from Google or another third party. Beyond the Vercel Web Analytics script on the landing and Thanks pages, the website sets no analytics cookies. It stores one small thing in your browser, only if you arrive through an invitation link: the referral code, until you sign in. The /api/locale endpoint reads the country that Vercel derives from your IP address, uses it on the spot to choose the demo language and to tell visitors from regions where we cannot take payments, and does not store it. The Download buttons send you to GitHub for the file. Links to other sites, such as Creem's checkout, are governed by those sites.

Anonymous setup counter (PostHog, US Cloud). On a new installation, Sayful counts once each setup milestone it reaches: the first launch and where the app ran from, each onboarding step shown, granted, skipped or finished, the reason a test dictation failed (for example “network” or “quota”), a rough time band for finishing, and the first dictation and first layout fix after setup. Each milestone travels with the app version, the macOS major version and your system language code (for example “uk”), and nothing else: no installation or account identifier, no email, no text, audio or screenshots. Our server gives each milestone a fresh random tag before it reaches PostHog, so milestones cannot be linked to each other or to you, and it does not forward your IP address. The counter does not run on Macs that finished setup before it existed, and the Windows app does not send it. It has its own switch, “Count setup steps anonymously”, on the first onboarding screen and in Settings → General; switching it off, or switching usage events off, stops it.

Optional app analytics (PostHog, US Cloud). Only if you enable “Share usage events” in onboarding or Settings → General, Sayful sends a small set of feature, onboarding and checkout milestones, the app version, and a random installation identifier through our server to PostHog; the setup milestones above then carry that identifier too. We do not send your email, account ID, dictated text, audio, screenshots, document contents, or screen recordings. Our event gateway does not forward your IP address to PostHog. These events do not create an account-linked analytics profile. Turning the setting off stops future sending and removes the analytics identifier on your computer; it does not automatically delete previously received events. Website hosting and network infrastructure may still process connection metadata to serve requests.

We do not sell your data and we do not use your content to train models.

How long we keep it

Account, subscription, referral, device key and usage records (one record per AI request, with its time, feature, size and model, never its content), and daily feature counts, are kept for as long as your account exists; we do not delete usage records on a schedule. A shared board stays on our servers until its owner stops sharing it, deletes it in the app or has the account deleted; a member's access ends when they leave or are removed, and an invitation is deleted once it is accepted, declined or cancelled. A shared board's pictures and files are deleted with it, and otherwise 38 days after no card or page uses them any more. Copies on members' computers are not affected. Nightly encrypted backups of the database are kept for up to a year and used only to restore the service, so something deleted from the database can remain in them until they expire. Short-lived rate-limit counters last minutes. Feedback you send is kept until we delete it. Audio and text sent for AI processing are not stored by us. The in-app “Sign out and clear profile” action removes the saved profile and session from your computer (it does not stop sharing your boards); to permanently delete the Sayful Cloud account and associated records, including boards you share, email us. We may retain records that the law requires for tax or accounting purposes, and providers such as Creem keep their own records under their own policies.

Your rights

Depending on where you live, you can ask us for access to your personal data and a copy of it, ask us to correct or erase it, ask us to restrict how we use it, ask for it in a portable format, object to processing based on our legitimate interest, and withdraw a consent you gave. Email support@sayful.app. You can remove the local account and session from inside Sayful at any time; permanent cloud deletion currently requires a support request.

You also have the right to complain to the data-protection supervisory authority in your country or region if you believe we have handled your data unlawfully. We would appreciate the chance to fix the problem first.

Permissions on macOS and Windows

On macOS, Sayful asks for Input Monitoring, Accessibility, Microphone and Screen Recording. These let it detect your hotkey, insert corrected text, hear dictation and read a screen region you select.

Windows has no separate prompts for keyboard or screen access. There Sayful uses a keyboard hook and Windows UI Automation for the same purposes, and uses the microphone only while you dictate or run a microphone test you start (Windows privacy settings decide whether desktop apps may use it). When you press the screen-text hotkey, it takes a still picture of the screen so you can select a region; only that region is read and sent, and the picture is erased as soon as you finish or cancel.

On both, Sayful observes keyboard events while running so hotkeys and layout correction work, but it does not persist a keystroke log. The screen is captured only after the screen-text hotkey, and only the region you select is sent. Automatic rewriting is suppressed in recognized terminals, password managers and sensitive text fields, and on Windows also in password fields and in windows running as administrator.

Children

Sayful is not intended for anyone under 16, and our Terms require users to be at least 16.

Changes

If this policy changes, the date at the top changes with it, and significant changes are announced in the app or by email.