Privacy Policy
Last updated: 2026-04-21
This is the privacy policy for Abalone Flow (the Mac app) and abalone.ai. It's written in plain English because we'd rather you read it than skim it.
Who we are
Abalone is a solo-founder project by Vincent Wei. Contact: vincent@vincentwei.co. For GDPR purposes, Abalone is the data controller for data collected through Abalone Flow and abalone.ai.
What we collect, and why
| Data | Why we have it | Lawful basis (GDPR) |
|---|---|---|
| Email, name, avatar (from Google or Apple OAuth) | Account identity, so your dictation history syncs across devices | Contract (you asked us to store it) |
| Dictation text | Your searchable history across the devices you sign into | Contract |
| Audio recordings | Lets you retry transcription with a different model later | Contract |
| Device metadata: Mac model, chip, OS version, app version, locale, timezone, hardware identifier (IOPlatformUUID), serial number | Debugging crash reports and compatibility issues; product decisions (e.g. when we can drop macOS 13 support) | Legitimate interest |
| IP address and country (derived from IP by our edge provider) | Security monitoring, growth analytics (“where are our users?”) | Legitimate interest |
We do not collect precise location (GPS), contact lists, browsing history, or anything from other apps. The app's voice-to-text model runs locally on your Mac — the raw audio does not leave your device for transcription. It's only uploaded to cloud storage if you're signed in, so you can retry transcription later from another device.
What we do not do
- No advertising. No ad networks.
- No selling, sharing, or licensing data to third parties.
- No behavioral tracking, no fingerprinting beyond the hardware identifier above, no cookies beyond what's required to sign you in.
- No AI training on your data.
How long we keep it
We keep your data for as long as your account exists.
When you delete your account (or email us at the address above asking us to), we delete everything within 30 days. That includes your dictation text, audio files, device rows, and profile.
Who we share with
We don't share your data for marketing. We use a small number of subprocessors to run the service:
- Supabase — database and audio storage hosting
- Google / Apple — OAuth sign-in (only — we don't share anything else with them)
- GitHub — hosts our app update releases (the update check sends your IP to GitHub's CDN, same as any download)
Your rights
If you're in the EU, UK, or California, you have the right to:
- Access — ask us for a copy of your data
- Deletion — ask us to delete it
- Portability — ask for it in a machine-readable format
- Objection — ask us to stop processing it
Email vincent@vincentwei.co. We'll respond within 30 days.
Children
Abalone Flow isn't designed for children under 13, and we don't knowingly collect data from them.
Changes to this policy
If we materially change what we collect or how we use it, we'll update the “Last updated” date at the top and notify signed-in users in-app. Small clarifications won't trigger a notice.