THOHT - Privacy Policy

Effective Date: July 20, 2026
Last Updated: July 20, 2026

Overview

THOHT is a dictation app for macOS, iPhone, and iPad that converts speech to text, developed by THOHT Limited, a company registered in England and Wales.

In short: THOHT has no user accounts, advertising, or cross-app tracking. On supported Macs, transcription can run entirely on your device. Dictation on iPhone and iPad uses cloud processing and sends recorded audio to the processors identified below only after you explicitly allow cloud processing. Optional, privacy-focused usage analytics are disabled until you turn them on.

1. Who We Are

Data Controller: THOHT Limited
Registered in: England and Wales
Email: info@thoht.app
Website: https://www.thoht.app

THOHT Limited is the data controller responsible for your personal data processed through the THOHT app. As a small organisation, we are not required to appoint a Data Protection Officer. For any data protection enquiries, please contact us at info@thoht.app.

2. Data We Collect

2.1 Audio Data

How it works: THOHT records audio from your microphone only when you initiate a recording session using a hotkey, button, or the THOHT keyboard and stops when you end or cancel the session. On iOS, the container app may keep an audio session active in the background so that keyboard-initiated dictation can work, but it does not capture or submit speech until you start a recording.

• On-device transcription on supported Macs: Audio can be processed entirely on your Mac. In this mode, no audio is sent for cloud transcription.
• Cloud transcription: Dictation on iPhone and iPad is cloud-based. Cloud transcription is also available on Mac. Your recorded audio, selected language, and vocabulary terms you added are sent over HTTPS through THOHT's proxy, hosted by Vercel, Inc., to Groq, LLC for speech-to-text transcription. THOHT's proxy does not store the request content.

Local audio retention: You control whether completed recordings are retained on your device and for how long. Available periods differ by platform. Retained files stay on your device and are not uploaded again except when you explicitly retry the related cloud transcription request.

2.2 Transcribed Text and User Content

When you use AI polish, translation, or a custom prompt, the following data is sent over HTTPS through THOHT's proxy, hosted by Vercel, Inc., to Anthropic, PBC for text processing:

• Your transcribed text
• Your custom prompt text (if using custom prompts)
• Your selected target language (if using translation)
• Your personal context/profile (if you have optionally provided one)
• The source app identifier, when available (for context)

This data is sent solely to perform the feature you requested and is not stored by THOHT's proxy.

2.3 Optional Usage Analytics

Usage analytics are off by default. If you turn on Share usage analytics in Settings, THOHT sends a random identifier generated for this app installation, app version, operating-system version, device type, feature-use events, bucketed recording-duration and transcript-length values, and performance or diagnostic event categories to TelemetryDeck GmbH.

Analytics never include audio, transcribed text, prompts, personal context, keyboard input, names, email addresses, advertising identifiers, or precise timestamps. You can turn analytics off at any time; THOHT then disables the analytics transport, removes the local analytics identifier, and purges its local analytics cache.

2.4 Diagnostic Data (User-Initiated Only)

Feedback and diagnostic report content is collected only when you explicitly choose to submit it:

• Bug reports: You may optionally submit a bug report from the app settings. This includes your written description and app, operating-system, device, build, and subscription information. Recent app logs are included only if you turn on that attachment.
• API error reports: When an API error occurs, you may choose to report it. This includes the error type, HTTP status code, app version, macOS version, and timestamp.

Reports are delivered to the THOHT team via Resend. Audio, transcribed text, and keyboard input are not attached. The text you type into the feedback form may itself contain information that identifies you, so include only what you want to share.

2.5 Purchase Data

In-app purchases are handled entirely by Apple's StoreKit framework. THOHT receives Apple-signed subscription and app-transaction records to unlock Pro features and sends those signed records to its proxy for entitlement verification. THOHT does not receive your credit card number or billing address; Apple manages payment processing.

2.6 iCloud Sync (Optional)

If you have iCloud enabled on your device, THOHT may sync the following data via Apple's iCloud Key-Value Store:

• Your custom prompts
• Your user profile/personal context
• App settings
• Vocabulary words and replacements

This sync is managed by Apple's iCloud infrastructure and is subject to Apple's privacy policy. You can disable iCloud sync in your macOS System Settings.

3. Data We Do Not Require or Use

THOHT does not require an account. You may voluntarily place personal information in a custom prompt, personal context, transcription, or feedback message; that content is handled as described above. THOHT does not otherwise collect or use:

• Location data (precise or coarse)
• Contacts or address book data
• Browsing or search history
• Health or fitness data
• Financial or credit information
• Advertising identifiers such as IDFA
• Hardware identifiers or your Apple ID
• Advertising data
• Audio, transcripts, prompts, or keyboard input for analytics

4. Lawful Basis for Processing

Under the UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

Audio processed locally on your device is not transmitted to us or any third party, and therefore does not constitute data processing by THOHT Limited under UK GDPR.

5. Third-Party Services

THOHT uses the following processors to provide the app. Cloud content is sent only after you allow cloud processing and actively request the relevant feature:

5.1 Anthropic, PBC

• Purpose: AI provider for text reformatting, translation, and custom prompt processing.
• Data sent: Transcribed text, selected instruction or target language, custom prompt, optional personal context, and source app identifier when available.
• Privacy: Under Anthropic's Commercial API Terms, commercial customer content is not used for model training by default. Anthropic's commercial terms and policies govern its limited retention and trust-and-safety processing.
• Policy: https://www.anthropic.com/legal/privacy

5.2 Groq, LLC

• Purpose: Cloud-based speech-to-text transcription (when cloud transcription is enabled).
• Data sent: Audio recording, selected language, and vocabulary terms you added.
• Policy: https://groq.com/privacy-policy

5.3 Vercel, Inc.

• Purpose: Hosting THOHT's secure proxy, which routes cloud-processing requests and verifies entitlements.
• Data processed: Cloud request content in transit, Apple-signed entitlement records, request metadata, and operational security information. THOHT's application code does not store or log audio, transcripts, prompts, or personal context on the proxy.
• Policy: https://vercel.com/legal/privacy-notice

5.4 Upstash, Inc.

• Purpose: Rate limiting and usage-quota enforcement for THOHT's proxy.
• Data processed: Hashed entitlement or app-transaction identifiers, request counters, and bucketed character or audio-duration usage. Upstash does not receive your audio, transcript, prompts, or personal context from THOHT.
• Policy: https://upstash.com/trust/privacy.pdf

5.5 TelemetryDeck GmbH

• Purpose: Optional, privacy-focused app-usage analytics, disabled by default.
• Data sent: A random per-installation analytics identifier, app and device metadata, feature-use events, and bucketed measurements. Never audio, transcripts, prompts, personal context, or keyboard input.
• Policy: https://telemetrydeck.com/privacy/

5.6 Resend

• Purpose: Email delivery for user-initiated bug and error reports.
• Data sent: Your feedback text, app and device information, and recent app logs only when you choose to attach them.
• Policy: https://resend.com/legal/privacy-policy

5.7 Apple (StoreKit & iCloud)

• Purpose: In-app purchase management and optional data sync.
• Data sent: Subscription transactions (managed by Apple). Optional sync of prompts, personal context, settings, and vocabulary via iCloud.
• Policy: https://www.apple.com/legal/privacy

THOHT requires each third-party processor, through its applicable commercial terms and data-protection commitments, to provide the same or equal protection for personal data as described in this policy and required by applicable law. We do not sell your data or disclose it to parties beyond those listed above except where required by law.

6. How We Use Your Data

Data is used only for app functionality, security and quota enforcement, support you request, and optional analytics you enable:

We do not use any data for:

• Advertising or marketing
• Advertising or behavioural profiling
• Tracking across apps or websites
• Training THOHT or third-party AI models on your content
• Sale to third parties or data brokers

7. Automated Decision-Making

THOHT uses AI models to process your text (reformatting, translation, custom prompts). This processing is performed by third-party AI services (see Section 5) at your explicit request. These AI features are tools that assist you — they do not make decisions that produce legal or similarly significant effects on you. You always have the opportunity to review, edit, or discard AI-processed output before use.

8. Data Linked to Your Identity

THOHT has no user-account system and does not receive your Apple ID, advertising identifier, or payment details. Cloud quota records use a one-way hash of an Apple-signed entitlement identifier. Optional analytics use a random identifier created for the app installation. These identifiers are not combined with your cloud content. Content you voluntarily enter may identify you by what you write, so avoid adding identifying information you do not want processed.

9. Tracking

THOHT does not track you. We do not:

• Use advertising identifiers (IDFA)
• Share data with data brokers
• Link your data with third-party data for advertising purposes
• Use analytics for advertising, cross-app tracking, or profiling

THOHT includes the TelemetryDeck SDK solely for optional first-party product analytics. It remains disabled until you turn analytics on and never receives your audio, text, prompts, personal context, or keyboard input.

10. International Data Transfers

THOHT Limited is based in the United Kingdom. Depending on the feature you use and the processor's infrastructure, data may be processed in the United Kingdom, European Economic Area, United States, or other locations used by the processors and subprocessors identified in Section 5. In particular:

• Anthropic, Groq, Vercel, Upstash, and Resend may process data in the United States.
• TelemetryDeck is based in Germany and operates its analytics infrastructure in the European Union.

THOHT uses the processors' applicable data-protection agreements and transfer safeguards. All app-to-cloud data is transmitted over encrypted HTTPS connections.

11. Data Retention

THOHT's proxy does not persist audio, transcripts, prompts, personal context, or source app identifiers. Limited operational records such as hashed entitlement identifiers and quota counters are retained by the processors described above for the periods stated.

12. Your Rights

Under the UK GDPR, you have the following rights:

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may request correction of inaccurate personal data.
• Right to erasure — You may request deletion of your personal data.
• Right to restrict processing — You may request that we limit how we use your data.
• Right to data portability — You may request your data in a portable format.
• Right to object — You may object to processing of your personal data.
• Right to withdraw consent — Where we rely on consent (including cloud processing and optional analytics), you may withdraw consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.

THOHT has no user accounts. You can directly delete locally stored transcriptions, recordings, custom prompts, vocabulary, and personal context within the app. For data processed by a service provider, contact us and we will respond to applicable requests and coordinate with the processor where necessary.

For any data protection requests, contact us at info@thoht.app. We will respond within one month.

Right to Complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been infringed:

Information Commissioner's Office
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

13. Your Controls

You have full control over your data within the app:

• Delete transcription history from within the app
• Delete custom prompts from within the app
• Clear your personal context/profile from within the app
• Configure local audio retention using the options available on your platform
• Withdraw cloud-processing consent in Settings → Data & Privacy. New audio and text will no longer be sent for cloud processing, and cloud-dependent features will remain unavailable until you allow processing again.
• Turn usage analytics off in Settings at any time
• Control iCloud access in your device's system settings
• Choose not to submit bug or error reports (submission is always optional)
• Use on-device transcription on supported Macs to avoid sending audio for cloud transcription. Dictation on iPhone and iPad requires cloud processing.
• Uninstall the app to remove all locally stored data

14. Children's Privacy

THOHT is not directed at children under the age of 13 (or 16 in the UK). We do not knowingly collect data from children. If you believe a child has provided data through the app, please contact us at info@thoht.app and we will take steps to delete such data.

15. Security

We take appropriate technical measures to protect your data:

• All data transmitted to third-party services is sent over encrypted HTTPS connections
• Our proxy server does not store or log user content
• Locally retained audio and transcription history are protected by platform security
• Entitlement identifiers used for quotas are one-way hashed before storage
• We minimize request data to what is needed for the feature you invoke
• API authentication credentials are stored securely and never exposed to end users

16. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last Updated" date at the top of this document. For significant changes, we will endeavour to notify users through the app. When a change materially affects what cloud data is shared or who receives it, THOHT will require a new cloud-processing decision before sending additional content.

17. Contact Us

If you have questions or concerns about this Privacy Policy or how your data is handled:

THOHT Limited
Email: info@thoht.app
Website: https://www.thoht.app

This privacy policy aligns with the data disclosures made in the Apple App Store privacy nutrition labels for THOHT.