Privacy Policy

Last updated: April 1, 2026

Introduction

We want to be transparent about the data we collect and how we use it. This Privacy Policy explains how Sally ("Sally", "we", "us", or "our") collects, uses, shares, and protects personal data when you use our app and related services.

By using Sally, you acknowledge that your information will be handled as described in this Privacy Policy.

Data We Collect and How We Use It

Account Information

To use Sally, you must create an account. We collect your email address, first name, and last name.

This information is provided either:

• directly when you sign up with an email and password, or
• automatically when you authenticate through a third-party provider such as Google or Apple.

If you sign up with Google, we may also collect your profile picture to display it in your account.

We use this information to:

• create and manage your account,
• identify you,
• provide the service to you, and
• contact you about your account or the service.

Technical and Monitoring Data

We use Sentry for crash reporting and error monitoring, and PostHog for product analytics.

These tools may collect technical information such as:

• IP address,
• device type,
• operating system and version,
• app version,
• crash and diagnostic data,
• and related technical event data.

We use this data to:

• detect and fix bugs,
• monitor app stability,
• analyze performance,
• improve the service,
• and help secure the app against misuse or technical issues.

Usage and Analytics Data

The primary usage metric we associate with your account is the number of words you have dictated for trial monitoring and usage analytics.

We also collect information about how Sally is configured and used, such as:

• keyboard shortcuts,
• languages used,
• and similar product usage settings.

This information is collected in a manner not linked to your account and not used to directly identify you. We use it to understand usage patterns and guide product improvements.

Recording Data

Voice and Transcription Data

When you record speech using Sally, your audio is sent to our cloud transcription and AI processing services for processing. This is the best way for us to provide accurate, low latency transcription.

We do not store your audio recordings or transcription content on our servers. Once transcription and processing are complete, neither the audio nor the transcription content is retained by us.

Your voice data and transcription content are never used to train AI models.

You may notice you can view your dictation history, including the original transcription, the formatted result, and audio playback, in the app. This is only stored locally on your device for you to view. It is not synced to our servers, and we do not have access to it.

Contextual Data

When you record speech, Sally captures information about the application in which recording is taking place, such as the app name.

We use this information in real time to tailor the output to the context, for example by applying a more formal tone in email contexts or a more casual tone in messaging contexts.

The app name may also be stored in a manner not linked to your account and not used to directly identify you, in order to help us understand which apps Sally is used with and to improve context-aware formatting over time.

Processing Metadata

We collect processing metadata such as:

• recording duration,
• processing time,
• and similar service-performance metrics.

We do not collect the underlying audio or transcription content for this purpose. This metadata is used for performance monitoring, analytics, and service improvement, and is not linked to your account.

Payment Information

We use Polar to handle payments and subscription billing.

We do not store your payment card details. Polar may collect billing and payment information, such as your name, billing address, and payment method details, in accordance with Polar's privacy policy.

We may receive limited subscription-related information, such as your plan, subscription status, and renewal status, in order to manage your access to paid features.

System Permissions

Sally requires the following macOS system permissions to function:

• Microphone access: Required to record your voice for transcription. We access the microphone only when you actively trigger a recording, such as by using your configured keyboard shortcut. Sally does not passively monitor your microphone.
• Accessibility access: Required to type dictated text into other applications on your behalf. This permission is used only to provide the requested functionality and is not used to passively monitor your activity.

Legal Bases for Processing

If you are located in the European Economic Area, United Kingdom, or another jurisdiction that requires a legal basis for processing, we rely on the following legal bases where applicable:

• Performance of a contract: to provide Sally, create and manage your account, process dictation, and provide paid features.
• Legitimate interests: to improve the service, monitor usage, maintain security, detect bugs, and ensure stability and performance.
• Consent: where required by law, for example for certain analytics-related processing or where a specific permission-based choice is required.
• Legal obligation: where processing is necessary to comply with applicable law.

International Data Transfers

Some of our service providers may be located outside of the European Economic Area or your country of residence.

Where personal data is transferred internationally, we take steps to ensure that appropriate safeguards are in place where required by applicable law, such as contractual protections or other lawful transfer mechanisms.

Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.

In general:

• Account data is retained while your account is active and for a limited period afterward where necessary for legal, security, or operational reasons.
• Subscription and billing-related data is retained as required for billing, accounting, tax, and legal compliance purposes.
• Technical, monitoring, and usage data is retained for a limited period as necessary for analytics, troubleshooting, security, and service improvement.
• Audio recordings and transcription content are not retained on our servers after processing is complete.
• Local dictation history remains on your device until you delete it or remove the app. The audio files are deleted automatically from your device after a certain period, which is 7 days by default.

Data Security

We use reasonable technical and organizational safeguards to protect your information.

This includes the use of TLS encryption in transit for data transmitted between the app and our services. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

Compliance and Security Program

We are continuing to strengthen our privacy and security program over time.

In particular, we intend to continue improving our controls, documentation, and operational practices in areas such as privacy, security, and compliance. This may include work relating to frameworks such as SOC 2 and data protection requirements such as the GDPR.

Any future audit, certification, or assessment will depend on timing, scope, and business needs. Nothing in this section should be interpreted as a statement that we currently hold a certification unless explicitly stated otherwise.

Third-Party Service Providers

We use third-party providers to operate Sally. These may include the following providers:

We do not sell or rent your personal data. We do not share your personal data with advertising networks for advertising purposes.

We may update the providers we use from time to time as our services evolve.

Your Rights

Depending on your location, you may have rights regarding your personal data, including the right to:

• access your personal data,
• correct inaccurate personal data,
• request deletion of your personal data,
• object to certain processing,
• request restriction of processing,
• request portability of certain data,
• and withdraw consent where processing is based on consent.

You may also have the right to lodge a complaint with your local data protection authority.

To exercise your rights, contact us at support@heysally.ai.

Children's Data

Sally is not intended for children under the age of 13, or the minimum age required by applicable law in your jurisdiction.

We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us at support@heysally.ai so that we can take appropriate action.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this Privacy Policy.

If we make material changes, we may also notify you in the app, by email, or by other appropriate means.

Contact Information

If you have any questions about this Privacy Policy, or if you would like to exercise your rights under applicable data protection laws, you may contact us at support@heysally.ai