Privacy policy

Who is responsible

The controller is KERNEXIT S.R.L., IDNO 1026023040248, MD-2008, mun. Chișinău, str. Ștefan Neaga 20, of. 4, Republica Moldova. Contact for any privacy question: hello@spunly.app.

The Spunly app

Speech recognition runs entirely on your Mac. Your audio is processed locally by the speech model and is not sent to us or to anyone else.

Transcripts, the history of your last transcripts, your corrections dictionary, settings and usage statistics are stored only on your Mac. We have no copy and no way to access them.

The app has no account, no analytics and no telemetry. We don’t collect device identifiers, crash reports or usage events.

On first launch the app downloads the speech model (about 630 MB) from Hugging Face, where the model is published (the download source may change before launch; this page will say so). As with any download, Hugging Face receives your IP address and standard request data; their own privacy policy applies to that.

The version downloaded from this website checks for updates once a day by requesting a small file from spunly.app. The request carries nothing about you or your dictation, only what any web request carries: the IP address and the app version.

If you buy Spunly Pro in the Mac App Store, Apple handles the payment and does not share your payment details with us.

Buying on spunly.app

Orders on this website are processed by our online reseller Paddle.com, the Merchant of Record for all our website orders. Paddle handles payment, VAT and sales tax, invoices and refunds. Its privacy notice covers what you enter at checkout.

From Paddle we receive your email address, country and order ID. We use them only to issue your license key, email it to you, send it again if you lose it, and keep accounting records. The legal grounds are the performance of our contract with you and our legal obligation to keep accounting records. We store your email and the order ID together with the key, while the license can be used and for as long as accounting law requires.

The license key does not contain your email, only a short one-way hash of it. The app checks the key offline and never contacts us to do so. The keys are stored in a Cloudflare database and emailed through Cloudflare Email Service; Cloudflare acts as our processor. Paddle and Cloudflare may process data outside Moldova, under safeguards such as the EU standard contractual clauses.

Optional AI cleanup

AI cleanup is off by default. If you turn it on and add your own API key, Spunly sends the recognised text (never audio) to the OpenAI-compatible provider you configured, to fix punctuation and grammar. That transfer goes directly from your Mac to that provider; it does not pass through us. The provider’s terms and privacy policy apply, and you choose whether to use it.

This website

The site has no advertising pixels and no third-party fonts or embeds. Without your consent it loads no analytics and sets no cookies of its own; it only remembers your cookie choice in your browser. With your consent it uses PostHog web analytics, described in the next section.

The one exception is checkout: Paddle’s payment script loads only after you press Buy on the Pricing page. Paddle may then set cookies strictly needed to complete the payment and prevent fraud.

The site is served by Cloudflare. Like any web host, Cloudflare processes technical request data (IP address, browser, time of request) to deliver pages and protect against attacks. We don’t use this data to identify visitors.

If you write to us by email, we use your address and message only to reply, and to send the one launch message you asked for. We keep that correspondence no longer than needed for this purpose and delete it on request.

Website analytics

If you press Accept in the cookie banner, this website uses PostHog web analytics, so we can see which pages people read and which buttons they press, and make the site better. This concerns the website only: the Spunly app has no analytics.

The legal basis is your consent. Until you choose, the analytics code is not even downloaded, and after Reject it never is. If your browser sends Do Not Track or Global Privacy Control, analytics stays off even after Accept.

What is collected: the pages you view and the page you came from, clicks on links and buttons (including Download and Buy), device type, operating system, browser and screen size, language, and an approximate location (country, region, city) derived from your IP address. IP anonymisation is on in our PostHog project, so your IP address itself is not stored. PostHog gives your browser a random identifier; we don’t link it to your name, email or purchase, create no user profiles and record no sessions.

PostHog Inc. processes this data on our behalf as our processor, in its EU data region (PostHog Cloud EU). PostHog is a US company; any access from outside the EU is covered by its data processing agreement with the EU standard contractual clauses. The data is kept for up to 1 year and then deleted; you can ask us to delete it earlier.

Stored in your browser: spunly-consent in localStorage, your cookie choice and the policy version it applies to (necessary, kept until you change it or clear site data). Only after you accept analytics: the ph_phc_rDPmRPQANpU8vKPSTeUVz3Z3DNquqLGeXZQToEwvPqCJ_posthog cookie and the localStorage entry with the same name, PostHog’s random identifier (up to 1 year), plus the current visit’s session in sessionStorage. If you later withdraw consent, __ph_opt_in_out_phc_rDPmRPQANpU8vKPSTeUVz3Z3DNquqLGeXZQToEwvPqCJ in localStorage records the refusal.

You can withdraw consent at any time, as easily as you gave it: Cookie settings (also at the bottom of every page). Analytics stops at once and PostHog’s identifier is removed from your browser. Withdrawal doesn’t affect processing that happened before it.

Your rights

You have the right to access, correct and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. Write to hello@spunly.app. You may also complain to the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md) or to the supervisory authority in your EU country.

Changes

If this policy changes, we will update this page and the date at the top.