Privacy Policy

1. Introduction

Wispr Flow, Inc. ("the Company," "we," "us," or "our") operates an AI voice dictation application for macOS and Windows. It captures microphone audio, converts it into clean, formatted text, and delivers it to the active application. This Policy describes data collected through the application and wisprfiow.com, together the "Service," how we process it, and your choices. It addresses US privacy standards and California requirements under the California Consumer Privacy Act and California Privacy Rights Act.

Our address is 1045 Bryant Street, Suite 200, San Francisco, CA 94103. Privacy questions may be sent to [email protected].

2. Information We Collect

2.1 Voice Recordings and Transcription Data

Speech captured during dictation is central to the Service:

• Voice recordings: microphone audio captured during dictation. By default, on-device processing handles audio locally, and it is never transmitted to or stored on servers. With cloud-assisted transcription, audio travels over TLS-encrypted connections, becomes text, and is deleted within 24 hours. Raw audio is not retained beyond that period.
• Transcription output: text generated from speech, which may be stored server-side for dictation history and custom vocabulary.
• Custom vocabulary: user-defined words, names, acronyms, and technical terms added to improve recognition.

We do not train AI models on your voice recordings or transcript content without your explicit written consent.

2.2 Account and Subscription Data

Creating a Hub account or subscribing to Flow involves collecting:

• Full name, email address, and password, stored as a salted hash rather than plaintext;
• Plan selection, Starter (free) or Flow (paid), and billing-cycle preference;
• Payment processor metadata, including transaction identifiers; we do not directly store full payment-card numbers or banking credentials.

2.3 Usage and Session Metadata

The application gathers operational metadata for quality and performance troubleshooting:

• Dictation start time, duration, word count, and trigger method, keyboard shortcut or button click;
• Application context, including the app name and, on macOS, its bundle identifier, receiving dictated text;
• Device details, including operating system, hardware class, CPU architecture, microphone type, and application version.

2.4 Website Analytics

Visits to wisprfiow.com generate limited technical information automatically:

• IP address and approximate city/region location;
• Browser, operating system, and device class;
• Visited pages, referring URLs, and time on page;
• Cookie and similar identifiers, as described in Section 5.

2.5 Contact and Support Submissions

Information sent through contact, support, or early-access feedback channels, including your name, email address, and message content.

2.6 We Do Not Knowingly Collect Children's Data

The Service is not intended for children under 13, and we do not knowingly collect their personal information. If a child provides information, contact [email protected] for prompt deletion.

3. How We Use Information

We use collected data to:

• Turn spoken audio into clean, formatted text and deliver it to your active application;
• Operate your Hub account, authenticate access, and administer your subscription;
• Improve transcription and filler-word removal using anonymized aggregate analysis, not retained audio content;
• Create and improve your custom vocabulary library;
• Answer support requests and operate wisprfiow.com contact features;
• Send service notices and, where legally required, consent-based marketing;
• Identify, investigate, and prevent fraud or unauthorized Service access;
• Meet legal obligations.

We do not train AI models on voice recordings or transcription output without explicit written consent. We do not sell personal information. State advertising rules may classify some arrangements as a "sale" or "share"; see the applicable state section.

4. Sharing of Information

We share personal information only with:

• Contracted service providers, including cloud infrastructure for cloud-mode audio processing, payment processors, and website analytics providers;
• Authorities when legally required or necessary to protect rights, safety, or property;
• A successor following a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties or share voice recordings or transcript content with third parties for marketing or advertising.

5. Cookies and Tracking

Cookies and similar technologies operate the site, maintain sign-in sessions, remember preferences, and measure wisprfiow.com usage. The desktop application does not set browser cookies. See our Cookie Policy for details and choices.

6. Data Retention

We retain personal information as needed for stated purposes and legal or accounting duties:

• Cloud voice recordings: deleted within 24 hours of transcription;
• Transcript data and custom vocabulary: account life plus 30 days after deletion;
• Hub account and credentials: account life plus 30 days after deletion request;
• Billing records: retained for 7 years;
• Contact and support messages: retained 24 months from last contact;
• Analytics logs: identifiable for 90 days, then aggregated.

7. Security

We use administrative, technical, and physical safeguards, including TLS encryption for cloud-mode audio, salted password hashing, encrypted production databases, least-privilege access controls, and regular security reviews. On-device mode avoids server retention of audio. No system is perfectly secure, and absolute security cannot be guaranteed.

8. Your General Rights

Rights may include access, correction, deletion, and limits on certain processing, depending on jurisdiction. Email requests to [email protected]. We respond within applicable legal deadlines.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), California residents have rights concerning collected personal information. This section supplements this Policy.

9.1 Categories We Collect

In the past 12 months, we collected categories identified under Cal. Civ. Code §1798.140: identifiers, including name, email, IP address, device identifiers, and Hub account ID; audio data, including dictation recordings processed on-device by default and deleted within 24 hours when cloud-processed; transcription text; commercial information, including plan and billing records; internet activity, including wisprfiow.com browsing and in-app metadata; and usage-based inferences for transcription improvement.

9.2 Sources, Purposes, Disclosure

We obtain information directly from you, through dictation in the Wispr Flow application, and through automatic instrumentation on wisprfiow.com. We use it to provide dictation, manage accounts and subscriptions, improve accuracy, and meet legal duties. We disclose it only to contracted service providers and legally required authorities.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may revise this Policy. Material changes will show a revised "Last updated" date and, where appropriate, notice.

11. Contact

Questions, requests, or complaints can be sent to: