Privacy Policy

Capturia has no accounts, no sign-up, and no user database. In the desktop app, your voice is transcribed on your Mac and your call audio never leaves it. The app sends one anonymous, four-field usage ping that you can switch off. The product is open source under MIT, so every claim on this page is verifiable in the source.

In the desktop app, speech recognition runs on your Mac: Apple’s speech engine on macOS 26, a local Whisper model on earlier versions. No bot joins your meeting, nothing is recorded, and no call audio or video is sent to Capturia. Only the transcribed command, and any deck you choose to load, go to the AI provider that powers your setup (your own provider on the free tier, Capturia’s hosted proxy on Pro, below).

The browser demo is the exception: dictation there is handled by your browser’s built-in speech service, not on your machine. In Chrome that service sends your microphone audio to Google for recognition, governed by Google’s privacy policy; Capturia receives only the resulting transcript.

When telemetry is on, the desktop app sends exactly four fields: a random install id (a UUID connected to nothing, no account, no email, no hardware id), the event name (such as “launch”), the app version, and the macOS version. Never sent, by construction: audio, transcripts, prompts, overlay or deck content, API keys, file names, or any free-form text. The server rejects payloads with extra fields, and it stores aggregate counts only: individual install ids are not recoverable from storage, and raw IP addresses are never stored. Those aggregate counts are publicly visible at /metrics, so you can see everything the beacon adds up to, exactly as we do.

Nothing is sent before you have seen the first-run disclosure and its toggle. You can turn the beacon off there, in Settings under Privacy, or by hand in the app’s settings file. docs/telemetry.md shows the exact bytes on the wire and the exact server-side keys.

On the free tier you supply your own AI key. It is encrypted on your Mac with a key held in the macOS Keychain, travels only to your model provider, and is never sent to or stored on a Capturia server. What that provider does with your requests is governed by its own terms and privacy policy.

Pro replaces your own key with hosted AI: the app sends your transcribed commands, and the content of any deck you load, through Capturia’s proxy to Google Gemini (optionally via Cloudflare AI Gateway). That content transits the proxy and streams back to you; the proxy does not store or log prompts, transcripts, deck content, or model responses.

What the hosted service does keep, in runtime state: your subscription’s entitlement status keyed to its Stripe customer id, monthly token usage totals (counts, not content), short-lived rate-limit counters, hashed device credentials for the devices you activate, and one-time activation codes. There are no user accounts and no user database; Stripe is the customer record. Content forwarded to Google is processed under Google’s terms.

Pro subscriptions are processed by Stripe. Checkout happens on Stripe’s pages, and Capturia never sees your card number. Capturia receives from Stripe the identifiers and subscription status needed to switch Pro on and off for your purchase, nothing more. The payment details you enter at checkout are governed by Stripe’s privacy policy.

The hosted pages (the landing, the browser demo, the audience vote pages) use Vercel Web Analytics: cookieless page views plus a single custom event when a download button is clicked. No cookies, no cross-site tracking, no advertising identifiers. Audience voting asks your viewers for nothing but an anonymous tap: no sign-in, no name, no phone number.

If a data flow changes, this page and its date change with it. Questions, or anything this page leaves unclear: capturia@andresio.com.