What we hold

The short version

Klepsy.ai needs your email address to sign you in, and it stores the tasks and times you record so they reach your other Macs. That is the whole of what it needs.

Everything beyond that is off until you switch it on. On a new install the Mac app sends no usage data and no crash reports, and it never sends the words you speak. Onboarding asks once. Skipping that screen leaves everything off, because silence is not agreement.

Your audio is never stored by us, whatever you choose.

What the Mac app stores about your work

Task titles, start and stop times, the switches between tasks, your projects and your dictionary terms. This is the product; without it there is nothing to sync or report on. It is kept until you delete your account.

Your account row holds your email address, and the name, role, use case and referral source you gave during onboarding. The last three are optional and exist only to shape the product.

What happens when you speak

While you hold the hotkey, Apple's on-device speech recognition shows a live preview on your Mac. Nothing has left the machine yet.

When you let go, and only while you are signed in, the recording is uploaded to our backend and passed to Groq for transcription. It is held in memory for that request and never written to disk or kept afterwards. Signed out, no audio leaves your Mac at all.

The resulting text is used to work out what you asked for. Whether a copy of it is kept is the switch called "Share what you say to improve recognition", which is off unless you turn it on. With it on, the words and the task they matched are stored for 90 days and then deleted. With it off, we keep only how well recognition performed: which matching method won, its confidence, how long it took. Those numbers describe the parser, not you.

Usage and crash reports

Off unless you turn them on. When on, the app records that it launched, which screens you opened, that it checked for an update, and a diagnostic if it crashed, along with a random identifier for the install and the app version. There is no name, email or task text in any of it. These are deleted after 180 days.

If an earlier version of Klepsy.ai left anything queued on your Mac from before these switches existed, it is deleted the first time the new version starts, rather than held in case you later agree.

This website

The site counts page views and clicks on the download link, on our own backend. There are no third-party scripts, no cookies, and nothing at all is stored in your browser: no identifier is written to your device, which is why this site has no consent banner to show you.

What is recorded is the page, the country your request arrived from, and a salted code derived from your address that is regenerated every day, so automated floods can be told apart from real readers without following anyone from one day to the next. Nothing is sent if your browser asks not to be tracked. These counts are deleted after 90 days.

Who else handles it

• Groq transcribes your audio and generates the daily summary, the report narrative and answers in Ask. It receives the audio, the resulting text and the task titles relevant to the question.
• Railway runs the backend and the database, so it holds everything described above.
• Resend sends your sign-in code, and so handles your email address.
• Vercel serves this website.

We do not sell anything to anyone, and there is no advertising network involved at any point.

How long things are kept

• Your tasks and times: until you delete your account.
• Shared voice transcripts: 90 days.
• Usage and crash reports: 180 days.
• Website counts: 90 days.
• Sign-in sessions: 30 days, then you sign in again.
• Sign-in codes: 10 minutes.
• Your audio: not kept at all.

Deleting your account

Settings, then your account, then delete. It removes the account row, and every task, time entry, switch, project, dictionary term, transcript and usage event attached to it, in the same operation. There is no waiting period and nothing is retained afterwards.

You can take your data with you first: the Reports page exports any range as CSV, JSON or PDF, generated on your Mac.

Security, stated plainly

Your session token and your sign-in code are stored only as hashes, so the database never holds either in a usable form. Traffic runs over HTTPS. Your session token lives in the macOS Keychain.

Your task titles and any shared transcripts are stored as ordinary text in the database, protected by the hosting provider's own encryption of its disks rather than by encryption we apply on top. We would rather say that than imply more.

Who is responsible for this

Klepsy.ai is run by one person, Umar Mehmood Qureshi, not a company. There is no support department to be passed around: the person who wrote the code is the person who answers.

He is the data controller for everything described on this page and the way to reach him is hello@klepsy.ai. If you need a postal address, for a formal data request or for any other reason, ask at that address and you will be given one.

Why we are allowed to hold it

• Your account and your tracked time: we need them to give you the product you asked for. In GDPR terms, performance of a contract.
• Sign-in emails: the same, since there is no way to sign you in without sending one.
• Shared transcripts, usage and crash reports: your consent, given by turning the switch on, and withdrawable by turning it off. Nothing is collected before you do.
• Website counts and rate limiting: our legitimate interest in knowing whether the site works and in keeping the service up, using data that identifies nobody.

Where it goes

Our backend, database, email delivery and AI processing run on infrastructure operated from the United States by the companies named above. If you are in the United Kingdom or the European Economic Area, your data is transferred there under the standard contractual clauses those providers offer, which is the mechanism UK and EU law provides for transfers of this kind.

Your rights

If you are in the UK or the EEA, the law gives you the following, and we extend them to everyone regardless of where you are:

• Access: a copy of what we hold. The Reports page exports it directly, or write to us.
• Rectification: correction of anything wrong.
• Erasure: deletion of all of it, which Settings does immediately.
• Portability: your data in a machine-readable form. The JSON export is exactly that.
• Restriction and objection: to ask us to stop a particular use.
• Withdrawing consent: the two switches, at any time, with no effect on what was lawfully collected while they were on.

No decision affecting you is made automatically, and there is no profiling.

If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to a data protection authority: in the UK the Information Commissioner's Office, and in the EEA the supervisory authority of the country you live in.

Children

Klepsy.ai is not aimed at children and we do not knowingly hold data about anyone under 16.

Changes

If what we collect changes, this page changes with it and the date at the top moves. A change that widens what is collected will be off until you agree to it, the same as the switches described above.

Asking us anything

Write to hello@klepsy.ai for a copy of your data, a correction, a deletion, or to ask what any of this means in practice.