Privacy Policy

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website or use the Saytrue app. Personal data is any data that can be used to identify you personally.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section "Controller" of this privacy policy.

How do we collect your data?

Some of your data is collected when you provide it to us. This may be, for example, data you send us by email.

Other data is collected automatically or after your consent by our IT systems when you visit the website. This is mainly technical data (e.g. browser, operating system or time of the page request). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors. Other data could be used to analyse your user behaviour (currently not implemented).

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data.

Legal Bases and Responsibility

• Local processing (transcription, on iPhone and Android with the operating system's speech recognition, analyses with Ollama or Apple Intelligence, storage): it takes place only on your device, we receive no data. If you use the app exclusively for private purposes, the GDPR does not apply to it (Art. 2(2)(c) GDPR).
• Cloud LLMs and cloud transcription (OpenAI, Anthropic, Mistral AI): your explicit consent in the app's privacy dialog (Art. 6(1)(a) and Art. 9(2)(a) GDPR), for cloud LLMs separately per purpose (analyses, chat and coaching; Bible impulse and prayer; on the computer, text from the Services menu and keyboard shortcut). Both dialogs name us as the provider of the app and our role. The app sends the content with your own API key directly to the provider; we do not receive it, do not store it and have no contract with the providers about your data. Processing by the provider is governed by its terms, which you accepted with your account there.
• Crash reports: no processing takes place at present, see Section 4.
• Update check: in the Linux direct distribution the app asks GitHub for a new version at most once a day (can be switched off in the settings), in the Microsoft Store build only when you choose "Check for Updates..." in the menu. No device identifier is transmitted; GitHub or Microsoft sees your IP address. The legal basis is our legitimate interest in informing you about bug fixes and security updates (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG).
• Download of the speech recognition models: if you download a model from saytrue.de during setup or in the settings, our hosting provider ALL-INKL.COM processes your IP address during the download; no access logs are generated for this website (Section 2). The legal basis is the provision of the requested download (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG). On iPhone and Android, at your request, the operating system downloads the language model for a language from Apple's or Google's servers; your recordings are not transferred. Which data the operating system transmits in the process is determined by Apple or Google, and their privacy policies apply. Here too, the legal basis is the provision of the requested function (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG).
• Setup helper: The macOS DMG, the Windows installer and the Linux packages .deb and .rpm come with a setup helper; the Homebrew installation, the AppImage and the store versions do not. If you start it, it installs Ollama at your request (via Homebrew, the installation script from ollama.com or, on Windows, via winget) and downloads language models from Ollama's model library. On macOS it opens a Terminal window for this; on first launch, macOS asks whether it may control Terminal. In the process, the installation programs connect to their providers' servers (for example Homebrew and GitHub, ollama.com, and on Windows Microsoft), and Ollama connects to its model library. These providers see your IP address; by default, Homebrew additionally sends anonymous usage data to its operators. The helper does not transfer any content from the app. The privacy policy of the respective provider applies. The legal basis is the provision of the requested function (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG).
• Stores and purchase of Saytrue Pro: You buy Saytrue Pro in the Mac App Store or in the Microsoft Store. The store handles purchase and payment as an independent controller; the privacy policies of Apple or Microsoft apply. For the purchase, we receive from the stores only aggregated sales statistics, no names, email addresses or payment data. Depending on the diagnostics settings of your operating system, Apple or Microsoft also provide us with crash reports and aggregated usage statistics, without your name; this applies to every version from the stores, including Saytrue Free. We see store reviews with the name you give there. The app contains no in-app purchases, does not verify the purchase and sends nothing for this purpose; a link in the app only opens the store page.
• Reporting AI responses (iPhone and Android): If you tap “Report” on an AI response, the app opens a prepared email to us in your email app. It contains the reason you selected, your comment if you write one, the app's version and edition (Free or Pro) and the operating system. It only contains the text of the AI response if “Include the response text” is ticked. In doing so, the app leaves out fields in which it carries your own text as a quotation; the AI response may nevertheless reproduce sentences from your text, for example in a rephrasing. You see the email before sending it and can change it. We only receive it once you send it, together with your email address and the name your email app sends along. We use the report only to review offensive, harmful or incorrect responses and to improve the app. The legal basis for the reason, comment and app details is our legitimate interest in doing so (Art. 6(1)(f) GDPR). The response text may contain special categories of personal data, such as information about your health or your faith, for example in a prayer. The legal basis for it is your explicit consent given with the tick (Art. 6(1)(a) and Art. 9(2)(a) GDPR); you can withdraw it at any time by emailing us. Please do not write such information in the comment; if we receive it nevertheless, we do not use it and delete it as soon as we notice it. The email is kept in our mailbox at ALL-INKL.COM (Section 2). We delete it as soon as the report has been dealt with, at the latest after six months.

Content of other people: if you pass messages or recordings of other people to a cloud provider, you decide on this yourself. For purely private use, the GDPR does not apply to it. If you use Saytrue professionally, for example for content of customers, clients or employees, you are the controller for it and need your own legal basis as well as a data processing agreement with the cloud provider. Shorten or anonymise such content before the transfer.

Data Categories

Audio recordings, transcriptions, imported texts, chat histories, AI analysis results, configuration settings (e.g. chosen LLM provider) including the time and version of consents given or withdrawn. When you report AI responses, also the information in your email to us (see “Reporting AI responses”).

Note on Art. 9 GDPR: Saytrue is not a medical device and does not create diagnoses. The psychologically informed analyses (emotion recognition according to Plutchik, NVC according to Rosenberg, cognitive distortions according to Beck) serve exclusively for self-reflection. Recordings, texts and analyses may nevertheless reveal information about health or religious beliefs (special categories under Art. 9 GDPR). Processing takes place locally on your device; when using the cloud, based on your explicit consent (Art. 9(2)(a) GDPR).

Storage Location

Locally on your device: macOS (App Store) in the folder you choose at first launch (suggestion ~/Documents/Saytrue/), macOS (direct distribution) ~/Library/Application Support/Saytrue/recordings/, Windows %LOCALAPPDATA%\Saytrue\recordings\, Linux ~/.local/share/saytrue/recordings/ (as Snap $SNAP_USER_COMMON/recordings/). In the App Store build the folder can be changed in the settings. On iPhone and Android, the recordings are stored in the app's protected storage area, which other apps cannot access. If your device backs up apps to iCloud or to your Google account, the recordings are included in that backup; you control this in the operating system settings.

Storage Duration and Automatic Cleanup

Default: the oldest recording is deleted as soon as more than 100 recordings are stored (selectable: 25, 50, 100, 200 or 500). You can delete manually at any time ("Delete all"). We do not store recordings, texts or analyses on our servers; for reports by email, see “Reporting AI responses”.

App Permissions

• Microphone: required for audio recordings
• File system: for local storage, for files you open for import and for exports to the location you choose in the save dialog
• Notifications: for Quick Record notices, for example that the result is on the clipboard; the notifications do not contain the text
• Clipboard: The app reads it only when you act: when you press the keyboard shortcut for Rephrasing Alternatives or for pasting from the clipboard, or choose "Paste from clipboard" in text input. It places text there when you copy something, select a rephrasing alternative or finish a Quick Record
• Keyboard shortcuts: On the computer, the app registers its keyboard shortcuts with the system so that they also work when another program is in the foreground. It does not read any other keyboard input
• Autostart: not in the versions from the Mac App Store and the Microsoft Store; otherwise only if you switch on the option "Launch at system startup" under "Advanced" in the settings

Audio recordings and transcripts are stored locally without encryption. API keys are stored encrypted in the operating system's credential store. The user is responsible for device security (disk encryption such as FileVault or BitLocker recommended).

Important Note

Saytrue is a self-reflection tool, not a medical product. The AI analyses serve self-awareness, not diagnosis or treatment.

Minimum Age

Saytrue is intended for adults (18+). The psychologically informed analysis features are not designed for minors. Users under 16 need the consent of a parent or guardian.

External Hosting

This website and the speech recognition models for the app are stored on the web space of an external hosting provider. When a page is requested or a model is downloaded, the hosting provider processes technically necessary access data (IP address, time, requested file, status code, amount of data transferred, referrer and browser identifier). This processing is unavoidable for delivery.

The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in a secure, fast and efficient provision of our online offering by a professional provider; where contracts with customers are prepared or performed, Art. 6(1)(b) GDPR.

Hosting provider: ALL-INKL.COM

ALL-INKL.COM - Neue Medien Münnich
Hauptstraße 68
02742 Friedersdorf
Germany

More information: ALL-INKL.COM privacy information

A data processing agreement pursuant to Art. 28 GDPR is in place with ALL-INKL.COM. Processing takes place exclusively on servers in Germany.

Our email mailbox is also hosted at ALL-INKL.COM.

Server Logs and Statistics

In the hosting provider's administration interface, the setting "No logs are generated" is selected for this account under "Logs & Statistics". No log file is therefore delivered to our account and no access statistics are generated; we do not receive any access data. We have no access to the logs that ALL-INKL.COM keeps for its own operation; they are not evaluated and not merged with other sources. According to the provider, these log files are deleted after seven days at the latest.

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Controller

The controller responsible for data processing on this website is:

Marc Allgeier
Kugelfangtrift 81
30657 Hannover
Germany
Email:

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses or similar).

Storage Duration

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of the data processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation.

For the website operator based in Lower Saxony, the competent supervisory authority is:

Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen)
Prinzenstraße 5
30159 Hannover
Germany
Email: poststelle@lfd.niedersachsen.de
https://lfd.niedersachsen.de

Data subjects from other EU/EEA member states can also contact the supervisory authority of their country of residence.

UK users may also contact the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format.

Information, Deletion and Correction

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the address line of the browser changing from "http://" to "https://" and by the lock symbol in your browser line.

In the app's settings, the “Advanced” tab contains the “Crash Reports” switch. It is off by default. At present, the app sends no crash reports even when the switch is on, because no service has been set up to receive them. No data is therefore transmitted.

Before we introduce crash reports, we will add the recipient, scope, retention period and legal basis to this privacy policy. Even then, reports will only be sent with your consent.

Applicable Law

This website and app are operated by a sole trader based in Germany. Data processing is based on the GDPR (EU 2016/679) and, for users in the United Kingdom, the UK GDPR.

Competent Supervisory Authorities by Country

Users from different countries can contact the following authorities:

• EU/EEA: The supervisory authority of your country of residence (EDPB member list)
• Germany (controller's authority): LfD Niedersachsen, see Section 3
• United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF: ico.org.uk. Processing of UK users' personal data (emails you send us and, if you opt in, crash reports) is governed by UK GDPR. As this processing is not large-scale and involves no special categories of data, the Art. 27 UK GDPR exemption applies (no UK representative appointed).
• Canada: Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca
• Norway / Iceland / Liechtenstein (EEA, non-EU): These countries apply the GDPR via the EEA Agreement. Norway: Datatilsynet: datatilsynet.no
• Switzerland: Applies the revDSG (similar to GDPR; EU adequacy decision in place). Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch
• France: Commission Nationale de l'Informatique et des Libertés (CNIL): cnil.fr

United States

This website and app are operated by a sole trader based in Germany and do not meet the thresholds of US state privacy laws (CCPA, VCDPA, CPA, CTDPA, etc.), including the USD 25 million annual revenue threshold and the 100,000 consumer threshold. These laws therefore do not legally apply.

That said: we do not sell or share personal information. We ourselves only process emails you send us and, if you opt in, crash reports; our German hosting provider generates no access logs for this website (Section 2). No data broker activity, no targeted advertising, no profiling.

Australia

This operator does not meet the annual turnover threshold (AUD 3 million) of the Australian Privacy Act 1988 and is therefore not legally required to comply with the Australian Privacy Principles (APPs). The data practices described in this policy nonetheless align with the APPs: minimal collection, no onward sharing, and content is transferred only upon your explicit action (optional cloud LLMs and cloud transcription); otherwise the app only makes connections without content (update check, model download and, if you opt in, crash reports, see above).

Do Not Track (DNT)

This website uses no tracking, no analytics and no cookies. Do Not Track signals from your browser are therefore implicitly respected; there is no behavioural tracking that would need to be deactivated.

Cross-Border Data Transfers

When using OpenAI or Anthropic as a cloud LLM, the content listed in the Privacy-First card (transcripts, texts, analysis results as context, chat history) is transferred to the USA, and with cloud transcription via OpenAI also your audio recordings. This applies to users from all countries, including Canada, Australia and the United Kingdom. The transfer takes place exclusively after your explicit consent in the app, which you can withdraw at any time by switching to local processing. On iPhone and Android, you withdraw it in the settings under AI Models (see above). The privacy policies of the respective provider apply. According to their data processing agreements, OpenAI and Anthropic base transfers to the USA on Standard Contractual Clauses; neither is certified under the EU-US Data Privacy Framework (as of 9 October 2026). According to Mistral AI, it stores data in the EU by default; depending on the feature, temporary transfers outside the EU are possible, which Mistral safeguards pursuant to Art. 46 GDPR.