Privacy policy

Who we are

Koltype is operated by an Israeli sole proprietorship, trading as Koltype ("Koltype", "we", "us"). Contact: support@koltype.com. This policy explains what we collect when you use the Koltype app and koltype.com, why, who receives it and your rights.

Your voice and your text

When you use Koltype Cloud, the app cuts your recording into phrases on your computer and sends each phrase over an encrypted connection to our server. Our server passes it to our speech-recognition provider, receives the text and returns it to your computer. To improve accuracy the app may also send the words in your personal dictionary and a short piece of text you said earlier in the same dictation.

Audio is never stored on our servers. The text of your dictations is stored only if you turn on cloud backup. Otherwise both are processed in memory and discarded when the request ends.

We use a US-based speech-recognition provider bound by a data processing agreement. It may keep the audio and text of a request for up to 30 days to detect abuse, then deletes them. It uses the data for nothing else.

When Koltype transcribes on your computer, your audio never leaves your PC.

Cloud backup of your text (optional, Pro)

On Pro, also during a trial, you can back up your dictation history, so a second computer or a new installation gets it back. The backup is off until you turn it on in the app (Settings, Data and privacy) or on your account page.

• What is stored: the text of each dictation, when it was made, the name of the app you dictated into, its language and its word count. Never audio.
• How: encrypted at rest with a key for your account alone. It is used only to restore your history to your computers. Our logs never contain the text.
• Deleting: dictations you delete in the app are removed from the backup too. Turning the backup off, or choosing Delete the backup on your account page, deletes all of it at once.
• When Pro ends: the backup is kept for 30 days, so it is still there if you come back, and then deleted. A trial that ends without payment (cancelled, or its first charge failed) deletes it at once, and so does deleting your account.

Data on your computer

Your history (transcripts and the recordings behind them), personal dictionary, snippets, notes and settings are stored on your computer, in your Windows user folder. We cannot see them, unless you turn on the cloud backup of your text described above. Recordings are never backed up. You can turn history off, choose how long recordings are kept, export them or delete them in the app. Your sign-in is stored encrypted with Windows data protection, so only your Windows account can read it.

Data we keep about your account

• Account: your email address, your name and the account identifier from that sign-in provider if you sign in with an external sign-in provider, and when you signed up.
• Plan and billing: your plan, subscription status, renewal dates, the customer and subscription identifiers Paddle gives us, your extra-minutes setting and cap, and a record of each extra-minutes charge (minutes, amount, status). We never receive or store card numbers.
• Trial: when you started a Koltype Cloud trial, how many trial minutes you used, how it ended, and the language and time zone of the app, so the reminder emails reach you in your language at the right time.
• Usage counts: for each Koltype Cloud request, the time, its length in seconds, which allowance it used and whether it worked; and the number of minutes the app transcribed on your computer each month. Never what was said.
• Computers: the name of each computer you sign in on (for example "LAPTOP-123"), when it signed in and was last used, and the IP address it last connected from, so you can see and end sign-ins.
• Website sign-ins: when you signed in on koltype.com and the IP address used.
• Free plan and trial limits: a hashed identifier of each computer you sign in on (we cannot turn it back into the original) and your email address in a normalized form. They limit how often the same person or computer can start a Koltype Cloud trial, and make sure the free monthly minutes on your computer are counted per computer and per mailbox, so a new account does not reset them.
• Cloud backup: only if you turn it on, as described above.
• Security log: a record of account events such as sign-ins, plan changes, trials, changes to billing settings and extra-minutes charges.

The website uses one sign-in cookie, a cookie that remembers the language you chose (English or Hebrew), and stores your light or dark theme choice in your browser. Visitors from Israel see the Hebrew pages unless they choose English; we use the country Cloudflare reports for the connection, and we do not store it. There are no advertising or analytics cookies. We count visits with Cloudflare Web Analytics, which sets no cookies, does not follow you across sites and gives us only totals such as page views, countries and referring sites. When you download the app from a link of one of our ads, we count that download for the ad's campaign; the count holds nothing about you.

Why we use it (legal bases)

• To provide the service you asked for: transcription, your plan and trial (including the reminder emails before a trial ends), billing, your account and, if you turn it on, the backup of your text (performance of a contract).
• To keep accounts secure and prevent abuse, for example the hashed computer identifier and the normalized email that limit trials and keep the free monthly minutes from being reset, rate limits, and the security log (legitimate interests). You can object to this processing by writing to us.
• To meet legal duties such as tax and accounting (legal obligation).

We do not sell your data, show ads, or use your voice or text to train any model.

Who receives data

We share data only with these categories of recipients, and only what each needs:

• Paddle.com, our merchant of record: sells the subscription to you for us, runs checkout, collects tax, issues invoices and handles refunds. Paddle receives the payment details you give it directly and acts as an independent controller for them.
• A hosting and security provider: runs our website, server and database, and checks sign-ins for automated abuse.
• A US-based speech-recognition provider: turns Koltype Cloud audio into text, bound by a data processing agreement. It may keep the audio and text of a request for up to 30 days to detect abuse, then deletes them.
• An email delivery provider: sends sign-in codes, and the reminders before a trial ends, to your email address.
• An external sign-in provider: only if you choose to sign in with it.
• Authorities: only when the law requires it.

Some recipients process data outside your country, including in the United States. Where data leaves the EEA, the UK or Israel we rely on standard contractual clauses or equivalent safeguards.

How long we keep it

• Account, plan, usage and computer data, and records of past sign-ins (also ones that were signed out): while your account exists.
• The cloud backup of your text: until you delete it or turn it off; 30 days after Pro ends; at once when a trial ends without payment; at once when you delete your account.
• When you delete your account, we delete your account, usage counts, sign-ins and extra-minutes records at once.
• We keep the free plan and trial markers (the normalized email, the hashed computer identifier, and the monthly minute counts and trial records linked to them) after deletion, only to stop a trial or the free minutes being claimed again too soon, and security log entries, which no longer contain your email, as long as needed for security and accounting.
• Rate-limit counters, which can include an IP address or an email address, are deleted after 2 days.
• Sign-in codes expire after 10 minutes. Paddle keeps billing records as the law requires.

Your rights

You can access, export, correct or delete your data, and object to processing based on legitimate interests. Your account page lets you download a copy of your account data (email, plan, usage counts, signed-in computers and, if you use cloud backup, your backed-up texts) and delete your account. For a copy of anything else we keep, such as sign-in IP addresses or the security log, or for any other request, write to support@koltype.com and we will answer within 30 days. If you are in the EEA or UK you may also complain to your local data protection authority; in Israel, to the Privacy Protection Authority.

Security

Connections are encrypted. Sign-in codes and session tokens are stored only as one-way hashes, and the app's access tokens expire after 10 minutes. The cloud backup is encrypted with a separate key for each account. The app never holds the keys to our speech-recognition provider. Access to production data is limited to what is needed to run the service.

Children

Koltype is not intended for children under 16 and we do not knowingly collect their data.

Changes

If we change this policy in a meaningful way we will tell you by email or in the app before it takes effect. The policy is also available in Hebrew.