Vaiti Privacy Policy

In short

• The microphone records only after you tap the Vaiti button, and stops when you tap again.
• Your recording is sent directly from your phone to Groq with your own Groq API key to be turned into text. It does not pass through any server of mine: I never receive your audio, text or key (the only exception is a problem report where you tick “Include the recording” yourself, section 4).
• Your API key, settings, notes and recordings are stored only on your phone. Recordings are kept there, compressed, so you can listen again or hear a note again in another language; delete any or all of them in the app (Settings → Notes), or switch “Keep audio” off to have them deleted after transcription. To delete everything, uninstall the app (section 8).
• The Accessibility service is used only to show the button, detect an active text field, insert your text and (optionally) use the volume-down button as a command key. It does not read or collect your screen content.
• If something goes wrong, the app can send a short problem report to me, but only when you tap “Send report”; its text or recording only if you tick them (section 4).
• No advertising, no tracking, no sale of data. The app has no analytics at all; the website counts its visits anonymously, without cookies (section 5).

1. Who is responsible

Vaiti is developed by Vitaly Stockman, an individual developer based in Porvoo, Finland, trading as SviFi, the developer name shown on Google Play (“I”, “the developer”). Contact: privacy@vaiti.app.

Because the app has no backend, I do not collect or store personal data from the app. Where data leaves your phone, it goes to the services described in section 4, under your own accounts with them. The only personal data I hold is what you give me yourself: your email address if you sign up for updates on this website (section 5), and any message you send me.

2. What the app handles and where it stays

App data is excluded from Android cloud backup and device-to-device transfer. Uninstalling the app deletes all of it. If you use Export, the app writes your notes (their text, titles, lists, done and archive marks and reminders, but no audio), statistics and settings to a file in the place you choose, for example your phone’s storage or a cloud drive; that copy is then under your control and is not sent to the developer. Your API key is never included in an export.

3. Accessibility service

Vaiti uses the Android Accessibility API because a dictation button that works in every app is not possible otherwise. It uses it only to:

• draw the floating microphone button over other apps;
• detect when a text field is focused or the keyboard is open, so the button appears only while you type (never over a password field);
• insert your dictated text at the cursor of that field (or paste it);
• optionally, while you are recording, treat the volume-down or headset button as the “command” key.

The app does not read, store or transmit the content of your screen or of other apps, does not record keystrokes, and does not perform actions on your behalf. Information about the focused field (whether it is editable, its current text and cursor position) is used only in memory, at the moment of inserting your text, and is never stored or sent anywhere. You are shown this explanation and asked for consent in the app before the service is turned on.

The Accessibility service is optional. Without it, you can dictate in Vaiti’s own panel (from the app, its Quick Settings tile or its launcher shortcut); the finished text is placed on your phone’s clipboard for you to paste. When you add your Groq key, the app also looks at the clipboard for a copied key (beginning “gsk_”) so you don’t have to paste it; nothing else from the clipboard is used.

4. Services the app connects to

Groq (speech recognition and AI cleanup)

When you finish a dictation, the app sends the audio to Groq, Inc. (api.groq.com) for transcription. If AI cleanup or auto-translate is on, the transcript, together with your selected languages, the translation language if you chose one, vocabulary and custom instructions, is sent to Groq for editing or translation. While “Live preview” is on, short overlapping snippets of the most recent audio are also sent during recording. Requests use your API key, so they are made under your Groq account and Groq’s terms and privacy policy apply: groq.com/privacy-policy. Groq may process data in the United States. To make your notes findable, the app also sends each note's text to Groq once, to get a short title and a few search terms back. When you ask your notes a question, the question and the text of the notes that best match it (at most twelve) are sent to Groq to write the answer. When you open the app, it may also ask Groq for the list of available models and read the usage-limit information Groq returns. If you choose Hear again in… on a note, its kept recording is sent to Groq again, to be transcribed in the language you picked.

Your watch (Wear OS, if you use it)

On a Wear OS watch, what you record or ask goes from the watch to your phone over Google's Wearable Data Layer (Bluetooth or Wi-Fi, between your own two devices). The phone handles it exactly as a dictation made on the phone, as described above, and sends the text back to the watch. The notes you read on the watch are sent from your phone in the same way. Nothing is stored on the watch, and your API key never leaves your phone.

Your calendar (only if you turn it on)

If you turn on Also put reminders in a calendar, the app writes each reminder (the note's title, its text and the time) as an event into the calendar you choose on your phone. That calendar belongs to an account on your phone (for example Google, Samsung or Outlook) and is synced by that account like your other events, under that account's terms. The app reads only the list of your calendars, so you can choose one; it does not read your events.

Search by meaning (only if you download it)

If you turn on Search by meaning on this phone, the app downloads Google’s EmbeddingGemma model once from GitHub (github.com/SviFi/vaiti-models and GitHub’s file servers), which, like any download, reveals your IP address to GitHub. From then on your notes and searches are turned into vectors on the phone itself and stored beside each note; nothing about them is sent anywhere for this. Only the short request for a note’s title still goes to Groq, as described above.

vaiti.app (model recommendations and version check)

When you open the app (at most about once a day, or when you tap “Check”), it downloads a small public file listing the recommended models from this website (vaiti.app/recommended.json) and reads Groq’s public model documentation. These requests contain no personal data from the app, but, like any web request, reveal your IP address to the website’s hosting provider (see section 5) and to Groq.

Google Play

The app is distributed through Google Play, which downloads, installs and updates it under Google's own terms and privacy policy. If you allowed your phone to share usage and diagnostics with app developers, Google may show me anonymous, aggregated statistics about crashes and app performance on different devices (Android vitals). They contain no recordings, notes or anything you dictated, and nothing that identifies you.

All connections use HTTPS. No other services are contacted; the app contains no advertising, analytics or crash-reporting SDKs.

Problem reports and feedback (only when you send them)

When something goes wrong, the app explains it and offers Send report; you can also write feedback. Nothing is sent unless you tap the button. A report contains: what kind of problem it was and a short technical description of it (for example “no connection while recognising speech”), the app version, the Android version, the phone model, where the app was installed from (Google Play or by hand) and whether the phone is one of Google’s test phones, the app’s language, and the comment you wrote, if any. It never contains your API key. It contains your text only if you choose so: the report screen has a box Include the text and the result (unticked, except when you report a problem with one particular note), which shows that text before sending; you can edit it and remove anything private, or leave the box unticked. That text is stored with the report so I can find the problem; it is not put into the notification email. In the same way, a report about a note whose recording is still on your phone offers Include the recording (always unticked): only if you tick it is that note’s recording (compressed audio, at most about 20 minutes) sent with the report, so I can hear what went wrong. Only I listen to it; it is stored apart from the report, never put into the email, and deleted automatically 30 days after it arrived (sooner if you ask, or when the report is deleted). Screenshots you add to a report or to feedback (up to three; sent as they are up to 4K, larger ones made smaller; a photo that records where it was taken is saved again without that) are kept the same way: only I see them, deleted after 30 days. If you want an answer, you can add your email address; otherwise the report carries nothing that identifies you.

Reports are sent to vaiti.app, stored in the website’s database (Lovable Cloud / Supabase, in the EU, Ireland) and forwarded to my email, so I can fix problems. They are kept for at most 24 months and then deleted; ask at any time and I will delete yours sooner. The legal basis is your consent (Art. 6(1)(a) GDPR), given by tapping Send.

5. This website

vaiti.app sets no cookies for its visitors, uses no tracking or analytics scripts from anyone else, and loads nothing from third parties. (The developer's own private admin pages use a sign-in cookie, set only after the developer's key is entered; no visitor ever receives it.) Two choices are remembered in your own browser and sent nowhere: light or dark theme, and whether you closed the suggestion to read the site in another language. Like any website, its hosting provider receives technical data such as your IP address when you open a page, to deliver it and keep it secure; the developer does not use this to identify you.

Counting visits

To know how the site is used, it counts its own visits, anonymously. When a page is shown, and when one of its main buttons or links is tapped (for example “Get it on Google Play”, the language menu or the arrows of the ideas), it stores one line with: what happened (a page shown or a button tapped, and which one), the address of the page, its language, the name of the site you came from if you followed a link (only the site’s name, such as google.com, not the address of the page), the kind of screen (phone, tablet or computer, from the width of the window), your country as a two-letter code when the hosting provider supplies it, and the time.

It does not store your IP address, browser details or any identifier, uses no cookies and stores nothing in your browser for this, so the lines cannot be linked to you or to each other: pages and buttons are counted, people are not. The counts are kept in the website’s database (see below) for 13 months and are seen only by the developer.

• Legal basis: the developer’s legitimate interest in knowing, in general, how the website is used, so it can be improved (Art. 6(1)(f) GDPR). As nothing identifies you, this has no effect on you; you can still object by writing to privacy@vaiti.app.

Updates list

If you sign up for updates, I store the email address you enter, your name if you give one, what you ticked as interesting to you if anything (the iPhone app, Windows or Mac, Vaiti for a team), the time you signed up and the wording of the notice shown under the form, in the language of the page you used. Your IP address and browser details are not stored with it. I use this only to email you about Vaiti: when it arrives on new devices, such as iPhone and computers, and about major new versions; what you ticked tells me which of those to write to you about. I do not use it for other marketing, and I do not share or sell it. People who joined the earlier waiting list for the test agreed to hear about the test invitation and the launch; they receive only that, unless they sign up again.

• Legal basis: your consent, given by submitting the form (Art. 6(1)(a) GDPR).
• Where it is kept: in the website’s database, run for me by the hosting provider Lovable in the EU (Ireland). I also receive a notification email with the same details when you join, sent through Lovable’s email service.
• How long: until you ask to be removed, and in any case deleted when Vaiti no longer sends these updates. Entries from the earlier waiting list for the test are deleted no later than 31 October 2027, 12 months after Vaiti became publicly available.
• Leaving the list: write to privacy@vaiti.app at any time and I will delete your entry.

6. Permissions

• Microphone: recording your dictation, only after you tap the button.
• Internet: the connections in section 4.
• Notifications (optional): your reminders, and a notice if Android switches the accessibility service off.
• Alarms & reminders (optional): reminders come exactly on time; without it Android may bring them a few minutes late.
• Calendar (optional): only if you turn on putting reminders in a calendar (section 4).
• Save Groq’s allowance (a setting, not a permission): with it on, the app sends fewer requests to Groq (no live text, no titles for new notes, no planning step for questions to your notes).
• Display over other apps (optional): shows the floating button over other apps when the accessibility service is off; you grant it in Android's settings and can take it back there at any time. It lets the button be seen and notice whether the keyboard is open (so the button can appear only while you type), nothing more: it does not read the screen or the text in other apps.
• Network state: whether the phone is online, so that a dictation made without a connection is kept for later at once.
• Run at startup: re-scheduling that setup check and your reminders after a reboot.
• Accessibility service: see section 3.

7. Legal basis (GDPR)

Processing on your phone happens at your request, to provide the app you chose to use (Art. 6(1)(b) GDPR), and the accessibility use is based on your consent given in the app (Art. 6(1)(a)), which you can withdraw at any time by turning the service off in Android settings. Sending your recordings to Groq happens on your instruction, under your own agreement with Groq. The website’s updates list is based on your consent (section 5).

8. Your rights

Under the GDPR you have the right to access, correct, delete and port your personal data, to restrict or object to processing, and to withdraw consent. As your data stays on your phone, you can exercise most of these directly: view, copy or delete notes in Notes, clear the app’s data, or uninstall it. For data held by Groq, use your Groq account or contact Groq. For the updates list, or any other question, write to privacy@vaiti.app.

Deleting your data

• Everything the app keeps (notes, recordings, settings, statistics and your API key) is on your phone only. Delete single notes in Notes, or delete it all at once by uninstalling Vaiti or, in Android's settings, Apps → Vaiti → Storage → Clear storage. Nothing stays with the developer, because none of it was ever sent to me.
• Problem reports you sent are kept for at most 24 months; a recording or screenshots you included, 30 days. To have yours deleted sooner, write to privacy@vaiti.app from the address you gave in the report, or describe the report (date and what it was about); I delete it within 30 days and confirm.
• Data held by Groq (under your own Groq account): delete it through your Groq account or by contacting Groq.
• The updates list: write to privacy@vaiti.app and your entry is deleted.

You may also lodge a complaint with a supervisory authority, in Finland the Data Protection Ombudsman (tietosuoja.fi), or the authority in your country.

9. Users in Japan (APPI)

For users in Japan, Vaiti also follows Japan’s Act on the Protection of Personal Information (APPI). In its terms:

• Purposes of use: as described in sections 2 to 5; personal information is not used for any other purpose without your consent, and is not provided to third parties except as described here or as required by law.
• Transfers abroad: your recordings go from your phone directly to Groq, Inc. (United States) under your own Groq account; the developer does not receive them. Updates-list entries, visit counts and problem reports you send are stored in the EU (Ireland), a jurisdiction recognised by Japan’s Personal Information Protection Commission as having an equivalent level of protection. The United States has no such recognition; Groq’s own privacy policy describes its safeguards.
• Security measures: data is sent only over encrypted connections, access to the website’s database is limited to the developer, and the app keeps your data on your phone.
• Your requests: you may ask for disclosure, correction, addition, deletion, suspension of use or of provision to third parties of personal information about you, and for records of provision to third parties. Write to privacy@vaiti.app; requests are answered without charge.
• Handler: Vitaly Stockman, SviFi, Kurbölentie 114, 06200 Porvoo, Finland (the business representative).

10. Recording other people

Vaiti is meant for dictating your own speech. If other people can be heard, make sure you have their consent where the law requires it.

11. Children

Vaiti is not directed at children under 16 and is not designed to be used by them.

12. Changes

If this policy changes, the new version will be published at this address with a new effective date. Significant changes will also be mentioned in the app’s release notes.

13. Contact

Vitaly Stockman · Porvoo, Finland · privacy@vaiti.app