Privacy Policy
Effective 3 November 2026
This policy explains what personal data TalkOS (the Mac app, the website talkos.app and the service at api.talkos.app) processes, why, and your rights. TalkOS is built so that as little as possible leaves your Mac.
1. Who is responsible
The controller is PCTR INFORMACIJSKE STORITVE d.o.o. (PCTR d.o.o.), Lokev 173, 6219 Lokev, Slovenia. Registration number 9966935000, tax and VAT number SI78302765, registered with the District Court of Koper. Contact for privacy matters: piercallin@gmail.com.
2. What stays on your Mac
- Your voice. Speech is turned into text on your Mac by Apple’s on-device speech recognition. Audio recordings are never sent to us or anyone else.
- Memory, writing examples and settings (your name, sign-off, tone, saved people, promises and notes) are stored on your Mac. Parts of them are included in a request only when they are relevant to the reply being written (see section 3).
- TalkOS reads the text field and the conversation around it only while you hold the key, and you can turn reading the conversation off in Settings. It never sends a message for you.
3. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, name, sign-in codes (expire after 10 minutes), session tokens, device name | Creating your account and signing you in | Contract, Art. 6(1)(b) |
| Request content: the transcript of what you said, the text in the field, the visible conversation around it (if enabled) and relevant preferences or memory | Writing or editing the reply you asked for. We pass it to our AI provider and return the result. We do not store the content of your requests or replies on our servers. | Contract, Art. 6(1)(b) |
| Number of replies per day and month | Applying plan limits and fair use | Contract, Art. 6(1)(b) |
| Subscription status, Stripe customer ID, invoices | Billing, taxes and accounting | Contract and legal obligation, Art. 6(1)(b), (c) |
| Referral codes, gift codes, team membership (team owners see members’ emails) | Referral rewards, gift codes and team plans | Contract, Art. 6(1)(b) |
| Diagnostics reports you choose to send (app version, macOS version, permissions, settings, app identifiers and event counts, your note; never the text you said, wrote or read) | Fixing problems you report | Consent, Art. 6(1)(a) |
| IP address and technical request logs, rate-limit counters | Security, abuse prevention and delivering the website and app updates | Legitimate interests, Art. 6(1)(f) |
We do not sell your data, use it for advertising or use it to train AI models. The website uses no cookies, analytics or trackers.
4. Who we share it with
We use these processors, bound by data processing agreements:
- OpenAI (USA) writes the replies. Under its API terms, request data is not used to train models and is kept for up to 30 days for abuse monitoring, then deleted.
- Cloudflare runs our API and database.
- Stripe processes payments. We never see or store your full card details.
- Resend sends sign-in emails.
- Netlify hosts the website and app updates.
- Apple provides on-device speech recognition and macOS. Apple’s own policies apply to your Mac.
Some of these providers process data outside the EU/EEA, mainly in the USA. Transfers rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. We may also disclose data where the law requires it.
5. How long we keep it
- Account data, usage counts and referrals: while your account exists. They are deleted when you delete your account.
- Sessions: until you sign out or delete your account.
- Diagnostics reports: until the problem is resolved, at most 12 months.
- Billing and invoice records: as long as Slovenian tax and accounting law requires (up to 10 years).
- Request content: not stored by us. OpenAI may keep it for up to 30 days, as described above.
6. Your rights
Under the GDPR you can request access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. You can delete your account in the app (Settings → Account → Delete Account) or by emailing us. We answer requests within one month.
You can also complain to a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
7. Security
Connections are encrypted (HTTPS). Sign-in codes and session tokens are stored only as hashes. Access to production data is limited to the people who run the service.
8. Children
TalkOS is not intended for children under 16, and we do not knowingly collect their data.
9. Changes
We will post changes here and update the effective date. For significant changes, we will tell you in the app or by email.
See also the Terms of Service.