LEGAL

Privacy Policy

Effective date: June 8, 2026

SafeDictate is built on a single architectural principle: your audio never leaves your device. This policy explains what data we collect (very little), what we do with it, and what we don't do.

1. What SafeDictate Does

SafeDictate is a Chrome Extension that captures microphone input and transcribes it using the Whisper AI model running entirely inside your browser via WebAssembly/ONNX Runtime. No audio, no audio fragments, and no transcription text are ever transmitted to any external server.

The one network activity required for transcription is a one-time download of the Whisper model file (≈39–140 MB depending on the model you choose) from the public Hugging Face CDN (huggingface.co) the first time you use the extension. The model is then cached in your browser and all subsequent transcription runs fully offline. This download transfers only the model weights to your device — no audio, text, or personal data is sent.

2. Data We Collect

2.1 Settings and Preferences

Your settings (selected language, model size, UI preferences) are stored exclusively in chrome.storage.local on your device. They are never synced to our servers. Chrome may optionally sync this data across your own devices if you have Chrome Sync enabled — that is between you and Google, not us.

2.2 Email Address (Pro subscription only)

If you purchase a Pro subscription, we process the email address you used at checkout in order to verify your subscription status. When the extension checks your license, it sends only this email address over HTTPS to our licensing endpoint (a Cloudflare Worker operated by SoftLab), which forwards it to Paddle — our payment processor and Merchant of Record — to look up your active subscription. No other personal data accompanies this request.

Where it is stored: your email, subscription plan, and renewal date are cached in chrome.storage.local on your device so the extension can recognize your Pro status offline. Our Cloudflare Worker is a stateless proxy and does not store your email; the email and your billing details are held by Paddle as part of your purchase. See Paddle's privacy policy.

How to delete it: the cached email is removed when you log out in the extension or uninstall it. To delete your billing data held by Paddle, contact us at the address below. If you use the free tier, we never receive or process your email.

2.3 Microphone Audio

Audio is captured from your microphone only while you have dictation actively enabled. It is processed entirely in-browser using a local ML model — we never receive, store, or process your audio. The transcribed text is inserted directly into the focused input field on your page.

3. Data We Do Not Collect

  • We do not collect usage analytics or telemetry.
  • We do not collect crash reports or error logs.
  • We do not track what websites you visit or which fields you dictate into.
  • We do not store or transmit your audio or transcriptions.
  • We do not build behavioral profiles, and we never sell your data.

4. Third-Party Services

The extension makes exactly two kinds of external request, neither of which transmits your audio or transcriptions:

  • Hugging Face CDN (huggingface.co) — a one-time download of the Whisper model file, described in section 1. No personal data is sent with this request.
  • Paddle, via our Cloudflare Worker — the Pro subscription check described in section 2.2, which sends only your email (paddle.com/legal/privacy). Free-tier users never trigger this request.

The landing page (safedictate.softlab.cc) is static and does not use analytics, tracking pixels, or cookies.

5. Permissions

SafeDictate requests the following Chrome permissions:

  • microphone — required to capture audio for transcription.
  • storage — required to save your settings and (for Pro) your cached subscription email locally.
  • activeTab and host access — required to inject transcribed text into the focused input field on the tab you are dictating into.
  • clipboardWrite / clipboardRead — required for the copy-paste fallback when a page does not allow direct text injection.
  • contextMenus — required to provide right-click menu actions.
  • offscreen — required to run the Whisper AI model in a background context without blocking the browser UI.

No permission is used for any purpose beyond what is described here.

6. Data Retention

We operate no database and retain no data on our own servers. Your settings and your cached subscription email remain on your device until you uninstall the extension or manually clear the data; uninstalling removes all locally stored data automatically. Billing records associated with your email are retained by Paddle for as long as required by their policy and applicable law.

7. Children's Privacy

SafeDictate is not directed at children under 13. We do not knowingly collect any information from children.

8. Changes to This Policy

If we make material changes, we will update the effective date at the top of this page. Continued use of the extension after changes constitutes acceptance of the updated policy.

9. Contact

Questions? Email us at support@softlab.cc.