Privacy policy

Who we are

Koltype is operated by [Legal name], [business form and registration number], [postal address], Israel ("Koltype", "we", "us"). Contact: support@koltype.com. This policy explains what we collect when you use the Koltype app and koltype.com, why, who receives it and your rights.

Your voice and your text

When you use Koltype Cloud, the app cuts your recording into phrases on your computer and sends each phrase over an encrypted connection to our server. Our server passes it to a speech-recognition processor, receives the text and returns it to your computer. To improve accuracy the app may also send the words in your personal dictionary and a short piece of text you said earlier in the same dictation.

Audio and transcripts are never stored on our servers. They are processed in memory and discarded when the request ends. The speech-recognition processor is bound by a data processing agreement and uses the data only to return the text, with zero data retention where offered. Where zero retention is not offered, it may keep request data for a limited time (up to 30 days) to detect abuse, and then deletes it.

When Koltype transcribes on your computer, your audio never leaves your PC.

Data on your computer

Your history (transcripts and the recordings behind them), personal dictionary, snippets, notes and settings are stored only on your computer, in your Windows user folder. We cannot see them. You can turn history off, choose how long recordings are kept, export them or delete them in the app. Your sign-in is stored encrypted with Windows data protection, so only your Windows account can read it.

Data we keep about your account

• Account: your email address, your name and the account identifier from that sign-in provider if you sign in with an external sign-in provider, and when you signed up.
• Plan and billing: your plan, subscription status, renewal dates, the customer and subscription identifiers Paddle gives us, your extra-minutes setting and cap, and a record of each extra-minutes charge (minutes, amount, status). We never receive or store card numbers.
• Usage counts: for each Koltype Cloud request, the time, its length in seconds, which allowance it used and whether it worked; and the number of minutes the app transcribed on your computer each month. Never what was said.
• Computers: the name of each computer you sign in on (for example "LAPTOP-123"), when it signed in and was last used, and the IP address it last connected from, so you can see and end sign-ins.
• Website sign-ins: when you signed in on koltype.com and the IP address used.
• Free plan limits: a hashed identifier of each computer you sign in on (we cannot turn it back into the original) and your email address in a normalized form. They make sure each person and each computer gets one free cloud trial, and that the free monthly minutes on your computer are counted per computer and per mailbox, so a new account does not reset them.
• Security log: a record of account events such as sign-ins, plan changes, changes to billing settings and extra-minutes charges.

The website uses one sign-in cookie and stores your light or dark theme choice in your browser. There are no advertising or analytics cookies. We count visits with Cloudflare Web Analytics, which sets no cookies, does not follow you across sites and gives us only totals such as page views, countries and referring sites. When you download the app from a link of one of our ads, we count that download for the ad's campaign; the count holds nothing about you.

Why we use it (legal bases)

• To provide the service you asked for: transcription, your plan, billing and your account (performance of a contract).
• To keep accounts secure and prevent abuse, for example the hashed computer identifier and the normalized email that limit free trials to one per person and computer and keep the free monthly minutes from being reset, rate limits, and the security log (legitimate interests). You can object to this processing by writing to us.
• To meet legal duties such as tax and accounting (legal obligation).

We do not sell your data, show ads, or use your voice or text to train any model.

Who receives data

We share data only with these categories of recipients, and only what each needs:

• Paddle.com, our merchant of record: sells the subscription to you, runs checkout, collects tax, issues invoices and handles refunds. Paddle receives the payment details you give it directly and acts as an independent controller for them.
• A hosting and security provider: runs our website, server and database, and checks sign-ins for automated abuse.
• A speech-recognition processor: turns Koltype Cloud audio into text, bound by a data processing agreement, with zero data retention where offered.
• An email delivery provider: sends sign-in codes to your email address.
• An external sign-in provider: only if you choose to sign in with it.
• Authorities: only when the law requires it.

Some recipients process data outside your country, including in the United States. Where data leaves the EEA, the UK or Israel we rely on standard contractual clauses or equivalent safeguards.

How long we keep it

• Account, plan, usage and computer data, and records of past sign-ins (also ones that were signed out): while your account exists.
• When you delete your account, we delete your account, usage counts, sign-ins and extra-minutes records at once.
• We keep the free plan markers (the normalized email, the hashed computer identifier and the monthly minute counts linked to them) after deletion, only to stop the free trial or the free minutes being claimed again, and security log entries, which no longer contain your email, as long as needed for security and accounting.
• Rate-limit counters, which can include an IP address or an email address, are deleted after 2 days.
• Sign-in codes expire after 10 minutes. Paddle keeps billing records as the law requires.

Your rights

You can access, export, correct or delete your data, and object to processing based on legitimate interests. Your account page lets you download a copy of your account data (email, plan, usage counts and signed-in computers) and delete your account. For a copy of anything else we keep, such as sign-in IP addresses or the security log, or for any other request, write to support@koltype.com and we will answer within 30 days. If you are in the EEA or UK you may also complain to your local data protection authority; in Israel, to the Privacy Protection Authority.

Security

Connections are encrypted. Sign-in codes and session tokens are stored only as one-way hashes, and the app's access tokens expire after 10 minutes. The app never holds the keys to our speech-recognition processor. Access to production data is limited to what is needed to run the service.

Children

Koltype is not intended for children under 16 and we do not knowingly collect their data.

Changes

If we change this policy in a meaningful way we will tell you by email or in the app before it takes effect.