Privacy Policy

01The johTalk app

Your voice and your text. With a local engine (Local Whisper, Nemotron Streaming, Meta Omnilingual ASR and other engines that run on your computer), your audio is turned into text on your computer and neither is sent anywhere. We never receive your audio or your transcripts.

Cloud engines. If you choose a cloud engine (such as OpenAI, ElevenLabs, Google Gemini or a server you configure), johTalk sends your audio directly from your computer to that provider, using your own API key. That provider's privacy policy applies to what it receives. It does not pass through our servers.

API keys. Keys you enter are saved in johTalk's settings file on your computer and are only sent to the provider they belong to. We never receive them.

Licence and updates. To unlock a computer and check your licence from time to time, johTalk contacts our licence service and sends the computer's name, its operating system, the johTalk version and a random installation id. To look for updates it asks johflow.com, which forwards the request to GitHub, where releases are hosted. When you download a local speech model, your computer fetches it from where the model is published (for example GitHub or Hugging Face).

Logs. johTalk keeps a log file on your computer to help with troubleshooting. It stays there unless you choose to send it to us.

02What this website collects, and why

Account. Signing in with Apple or Google gives us your email address and name (and, for Google, your avatar). If you use Apple's Hide My Email, we store the relay address Apple creates for you. We keep these to run your account (legal basis: performance of a contract). When an account is created we also note the email address and the date in a sign-up record. It is not a mailing list.

Purchase. Payments run through Stripe, which processes your payment details. We store a record of your purchase (date, amount, currency, its Stripe references and whether it was refunded) to unlock johTalk, handle refunds and keep the records tax law requires (legal bases: contract and legal obligation). We never see your card number.

Your computers. When you unlock a computer, we store the name, operating system and app version it reports, a random installation id, when it was paired and last checked in, and a salted hash of the IP address that paired it (never the address itself). We use this to enforce the computer limit and let you review and remove computers (legal bases: contract, and our legitimate interest in preventing abuse).

Email. If you write to us, we keep the conversation to answer you and, for refunds, to process them. If you joined our email list in the past, we keep your address and the record of your consent until you unsubscribe; every email has a one-click unsubscribe link.

03Who processes it

These providers process data to provide their services to us. We do not sell data or run ads. Your sign-in state is kept in your browser's local storage. Google Analytics is optional, as described below.

Several of these providers are based outside the European Economic Area, mainly in the United States, and DeepSeek, which only FlowSim uses, is based in China, so your data may be processed there.

04Optional website analytics

If you choose Allow analytics, we use Google Analytics 4 to understand visits to our public pages. Google receives page views, browser and device information, a referring website, approximate location, and cookie identifiers used to distinguish visits. Your IP address is transmitted to Google during collection. For visitors in the EU, Switzerland or UK, Google says it uses the IP address to derive location and then discards it before logging Analytics data.

The legal basis is your consent. The Google tag stays blocked until you allow analytics. We exclude account, sign-in, purchase and activation pages, remove query strings and fragments from measured page URLs, and do not send names, email addresses or form contents. Advertising personalization and Google signals are disabled.

Analytics cookies (such as _ga and _ga_*) last up to 180 days. Your choice is saved in local storage for 180 days. You can refuse analytics and still use the website, or withdraw consent at any time through Cookie settings in the footer. Withdrawing stops future measurement and removes this website's Analytics cookies; it does not erase data already collected. Event-level data is retained in Analytics for two months; aggregated reports may be kept longer.

Google may process this data outside the European Economic Area under its applicable data processing and transfer terms. See Google's Privacy Policy, data processing terms and Analytics privacy information.

05Other apps on your JohFlow account

Your johflow.com account also signs you in to our other apps: JohData (desktop and iPhone) and FlowSim (iPhone). This policy covers them too, and what it says about your account, how long we keep data and your rights applies to them as well. If you only use johTalk, nothing in this section concerns you.

JohData. JohData records your day on your own computer or iPhone. When you sign in, the records it keeps for you, such as days, focus sessions, goals, to-dos, plans, notes, exercise (including daily steps from Apple Health, if you allow it), your first and last activity each day, and a daily summary of computer use worked out on your computer, are stored in our database at Supabase so they appear on your other devices (legal basis: performance of a contract). Window and page titles and the raw activity log stay on your computer, and which apps you use on your iPhone, and for how long, never leave it.

FlowSim. When you build profiles from a conversation or run a rehearsal, the app sends the conversation excerpt, the profiles and the goal you set up to our server, which passes them to an AI model provider (currently DeepSeek) to generate the result. Our server keeps a count of the profiles and rehearsals you used, not their content; the results are kept on your iPhone.

Purchases on iPhone. Subscriptions and purchases in JohData and FlowSim on iPhone go through Apple's App Store. Apple processes the payment; we never see your payment details. RevenueCat manages these purchases for us and tells our server which are active for your account, so the right features unlock.

06How long we keep it

Account data, and the list of your computers, live as long as the account. Purchase and billing records are kept as long as tax law requires. Email-list records are kept while you are subscribed, plus the consent proof for as long as we could be asked to show it. When you delete your account (on your account page) or ask us to, everything not legally required to be kept is removed.

07Your rights

Under the GDPR you can ask for access to your data, correction, deletion, a portable copy, and restriction of or objection to processing; where processing rests on consent you can withdraw it with effect for the future. Email joh@johflow.com and we'll handle it. You also have the right to complain to a data protection supervisory authority.