Privacy Policy

01

Scope and operator

This policy explains how GAO JIAN, an independent developer and the operator of Sonixy (“Sonixy,” “we,” “us”), handles personal data when you use the Sonixy website, macOS application, account, and connected cloud services. It does not replace the privacy terms of third-party services listed below.

02

Data we process

Account and authentication

We process your email address, chosen authentication method, Google or Apple provider subject where applicable, account timestamps, and any optional name, locale, or time-zone data you provide. Sonixy account entry is limited to Google, Apple, or an email verification code; password authentication is not offered as a product entry point. The macOS app stores its active token in your device Keychain. The website uses a separate opaque, secure HTTP-only session cookie. Web and macOS sessions are independent.

Audio and speech transcription

When you start a voice session, microphone audio is streamed from the app directly to Soniox using a short-lived, single-use credential, and Soniox returns live transcription tokens. When an ordinary dictation or translation ends normally, including with a transcription or processing failure, the app also creates an M4A recording. If history saving is enabled, it uploads that recording through authenticated Sonixy services to protected R2-backed file storage for playback and user-requested retry. Ask Anything audio is not added to history.

Text, writing instructions, translation, and Ask Anything

Direct delivers the Soniox transcript without sending it to ChatGPT. For normal dictation using Correction, Natural, Deep, or Custom, the app sends final text, the selected writing style, and any bounded custom instruction through the authenticated Sonixy backend to OpenAI for one corresponding operation. Translation uses Soniox one-way to produce source and translated text, and the translated text is not sent to ChatGPT. Ask Anything may send your spoken instruction and only the text you explicitly selected. Audio, the identity of the target app, full documents, screenshots, and implicit clipboard contents are not sent to OpenAI.

Operational and usage metadata

Separate from cloud history, we keep limited operational records needed to authenticate, protect, meter, and operate the service: a pseudonymous user relation, request ID, operation, status and HTTP status, latency, validated provider request ID, character and token counts, quota results, plan or entitlement status, and timestamps. These operational records do not contain your email, verification code, token, provider keys, audio, request text, selection, custom instruction, or model response.

Cloud history, recordings, devices, and preferences

Normal dictation and translation history is scoped to your account and current service environment in PocketBase. A record may include source and final text, result status, source app, processing configuration, timestamps, and its protected audio. Device attribution uses a random installation identifier kept in Keychain for that account and environment, together with a user-facing device name and app and operating-system versions; it does not use a hardware serial number or advertising ID. Ask Anything questions, selections, results, and audio remain in memory for the active result and are not added to history. Writing preferences and custom style instructions remain on your device. Legacy local history created before cloud sync is not automatically uploaded, reassigned, or deleted.

Personal vocabulary

Personal terms you actively save are stored in Sonixy PocketBase for the current service environment and sync across devices signed in to the same account. At the start of normal dictation, translation dictation, or Ask Anything, the current terms are sent to Soniox as speech-recognition context. A user-requested asynchronous retry uses the vocabulary current when that retry runs. Context helps recognition but does not guarantee an exact replacement. The complete vocabulary is not used as an OpenAI prompt or long-term memory, and diagnostics do not record term text. When you explicitly start an import, the Mac app can read a UTF-8 CSV or TXT file locally, or—with macOS permission—read only formatted contact names, nicknames, and phonetic names to build a one-time preview in memory. It does not read other contact fields or continuously sync Contacts. The original file, its path and other columns, full contact records, and unselected or invalid suggestions are not uploaded, added to diagnostics, or retained in your account cache. Only terms you select and confirm are sent to PocketBase for the current service environment. CSV and TXT exports are written only to the local file you choose and do not use the network. This website does not display, edit, import, or export the vocabulary and does not call its API.

User feedback

When a signed-in user actively submits feedback in the Mac app, Sonixy collects the description, the authenticated PocketBase account ID and current account email, and only the screenshots or files the user explicitly selects. Sonixy does not automatically attach recordings, transcripts, history, diagnostic logs, device information, accessibility selections, or API keys. File format, count, and size restrictions reduce risk but are not a malware scan or a guarantee of safety; do not submit sensitive information that is unnecessary for support.

Feedback is used only to receive feedback, reproduce and investigate issues, improve the product, and provide necessary support or security responses. Feedback attachments are not sent to Soniox or OpenAI and are not used for advertising profiles. Records are stored in Sonixy PocketBase and attachments use protected file storage. Ordinary users cannot read the shared feedback collection or another user’s feedback; authorized operators access it only as needed to process feedback.

Website visits and communications

This website does not use analytics, advertising, tracking pixels, or marketing cookies. When authentication succeeds, it sets the strictly necessary __Host-sonixy_sessioncookie; the backend stores only a hash of that opaque token. Signed-in headers display a generated initial rather than loading a remote profile image. Cloudflare may process routine network information such as IP address, request URL, browser or user-agent details, timestamps, and security signals to deliver and protect the site. If you email us, we process your address, message, and related correspondence to answer your request.

03

How data is used and who processes it

We use the data above only to provide requested features, maintain accounts and sessions, secure the service, enforce quotas, provide account history and recording playback, perform retries you request, process user feedback, diagnose failures, answer requests, and comply with law.

04

Why we process personal data

Depending on where you live, processing may be necessary to provide the service you request or perform our agreement with you; based on your permission or consent for microphone, accessibility, and optional content access; necessary for our legitimate interests in security, reliability, fraud prevention, support, and service operation; or required to meet legal obligations. You can decline optional permissions, but the related feature may not work.

05

Retention and deletion

• You can set cloud-history retention to Don’t Save, 7 days, 30 days (the default), 60 days, or 90 days. The authenticated history API returns only records within the setting active for your account.
• Don’t Save prevents new history records and recordings from being uploaded and returns an empty history list. It does not immediately erase older cloud records. Shortening retention hides older records; lengthening it may reveal records that still exist within the service’s hard-deletion window.
• Cloud history records and their protected recordings are automatically and permanently deleted after approximately 100 days, regardless of the visible retention setting. You may delete an individual record or all cloud history earlier.
• Personal vocabulary is independent of the cloud-history retention setting. Terms remain until you delete them individually, clear the vocabulary, or permanently delete the account.
• Each user-feedback record and all its protected attachments are automatically deleted no later than 365 days after submission. Permanently deleting the account earlier also deletes its feedback and attachments. Feedback content, attachments, and feedback IDs are not added to the separate account-deletion audit.
• Account data is kept while the account is active and as reasonably needed to provide the service, resolve disputes, secure the system, or satisfy legal obligations.
• After an authenticated account-deletion request is confirmed with a code sent to the account email, Sonixy permanently deletes the active account, provider links, website sessions, entitlements, usage records, request ledgers, cloud-history records and recordings, device records, retry attempts, and cloud personal-vocabulary terms.
• For security investigations, abuse prevention, and deletion dispute audits, a separate access-restricted audit record retains the original email address, name, and Google or Apple provider subject, together with minimal deletion metadata. Identity fields are authenticated-encrypted and are not used to sign in, market to you, profile you, or restore the deleted account.
• A deletion audit becomes eligible for manual removal 180 days after account deletion. Removal is not automatic: an authorized operator must explicitly purge eligible records that are not subject to a necessary legal, security, or dispute hold. After that manual purge, restricted rolling backups may retain the encrypted record for up to 7 additional days.
• A website session expires no later than 20 days after it is created. Email verification codes expire after 10 minutes; short-lived login transaction and exchange credentials expire after about 60 seconds and are invalidated after use.
• Request, usage, entitlement, billing-related, and security metadata is kept only as reasonably necessary for quota enforcement, operations, security, accounting, dispute resolution, and law. We do not claim a fixed period that has not yet been established.
• Third-party providers retain data under their policies, applicable service configuration, and our agreements with them. Disabling storage in an API request does not itself guarantee zero provider retention.

06

Your choices and requests

• Revoke microphone or accessibility permission in macOS System Settings. This prevents features that require the revoked permission.
• Choose your cloud-history retention period, play a saved recording, retry an eligible failed transcription, delete one record, or clear all cloud history from Sonixy.
• In the Sonixy app, add, edit, delete, or clear personal vocabulary. The website itself has no vocabulary controls.
• Website sign-out revokes only that browser session, and macOS sign-out revokes only that app session. The revoke-all control invalidates both website and app sessions for the account.
• Email us to request access to, correction of, or deletion of account-related personal data, or to object to or restrict processing where applicable.
• If an Apple sign-in credential cannot be revoked during local deletion, Sonixy still deletes the local account and may ask you to stop using Sign in with Apple for Sonixy in your Apple account settings.

Signed-in Mac users can permanently delete their account in Sonixy Settings → Account Settings. Sonixy sends a verification code to the account email before final confirmation. The website itself does not provide an account-deletion control. If you cannot use the Mac app, contact contact@sonixy.app. We may need to verify your identity and may retain data that law requires or permits us to keep. We will not discriminate against you for exercising applicable privacy rights.

07

Security and international processing

We use measures designed to reduce risk, including TLS for production traffic, device Keychain storage for the session token and random installation identifier, short-lived speech credentials, content-free operational logging, strict request validation, authenticated access controls around cloud history, and short-lived file-access tokens for protected recordings. No transmission or storage method is completely secure.

Sonixy and its providers may process data in countries other than yours. Privacy protections and lawful transfer mechanisms may differ by location. Provider regional processing options may apply only when configured for the relevant service and do not necessarily cover system or account metadata.

08

Children and policy changes

Sonixy is not directed to children who cannot lawfully consent to the processing described here. If you believe a child provided personal data without required authorization, contact us so we can assess and delete it where required.

We may update this policy when the product, providers, or law changes. We will publish the revised date here and provide additional notice when a change materially affects your rights or how we use personal data.

09

Contact

Operator: GAO JIAN (independent developer)
Privacy and legal requests: contact@sonixy.app