Wisper AI: Flow Voice-to-Text — Privacy Policy
Last updated August 21, 2026
Thank you for choosing Wisper AI: Flow Voice-to-Text, a voice-to-text application developed by Candy Studio Apps ("we", "us", "our"). We value your privacy and are committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights.
This Privacy Policy applies to the Wisper AI: Flow Voice-to-Text app for Solana Mobile ("the App"), distributed through the Solana dApp Store, and to any related services. If you have any questions or concerns regarding this policy or our privacy practices, please contact us at choizzyio@gmail.com.
1. DATA CONTROLLER
The data controller responsible for processing your personal data is:
Candy Studio Apps
Filtrowa 65/38, 02-055 Warszawa, Poland
Email: choizzyio@gmail.com
2. INFORMATION WE COLLECT
2.1 Information You Provide
- Email address (when you contact our support)
- Voice recordings (temporarily captured during active dictation only — see Section 4)
- Transcribed text content (stored locally on your device in your voice history)
- Your Solana wallet address (public key), when you connect a wallet to make a purchase
- Language preferences you select for transcription
We never ask for, receive, or store your seed phrase, private keys, or recovery details. Every transaction is approved by you inside your own wallet application.
2.2 Information Collected Automatically
- Device information: device model, operating system version, screen density, device language
- App usage data: features used, session duration, in-app events (for example, dictation started or completed)
- Technical identifiers: IP address, Android Advertising ID (if you have not opted out in system settings), Firebase installation ID, Firebase Cloud Messaging (FCM) token
- On-chain payment records linked to your connected wallet (transaction signature, amount, token, timestamp)
- Crash reports and performance data (via Firebase Crashlytics)
- Analytics data (via Firebase Analytics and Amplitude)
We do not collect your name, phone number, contacts, photos, location, or biometric data.
3. HOW WE USE YOUR INFORMATION AND LEGAL BASIS
We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Polish data protection law. The purposes and legal bases are:
- Providing voice-to-text dictation and AI text cleanup — performance of a contract (Art. 6(1)(b))
- Verifying on-chain payments and managing entitlements — performance of a contract (Art. 6(1)(b))
- Crash reporting, app stability, security — legitimate interest (Art. 6(1)(f)), to keep the App functional and secure
- Product analytics and internal research — legitimate interest (Art. 6(1)(f)), to improve the App
- Sending push notifications about product updates — consent (Art. 6(1)(a)), revocable in system settings
- Complying with legal obligations, for example tax law or responding to authorities — legal obligation (Art. 6(1)(c))
4. VOICE RECORDING AND TRANSCRIPTION
The App records audio only when you explicitly tap the record button, in the app or via the floating bubble. When you use the dictation feature:
1. Your audio is transmitted securely from the App to our backend infrastructure, which relays it to our transcription provider (OpenAI) for speech-to-text processing. Audio is not stored on our servers.
2. The transcribed text is then processed by Anthropic Claude for cleanup — removing filler words, adding punctuation, fixing grammar.
3. The cleaned text is returned to your device and stored locally in your on-device transcription history.
Data retention by our transcription providers
- On our side: we do not operate voice storage infrastructure. We do not retain, archive, or use your audio recordings after processing.
- OpenAI (transcription): under OpenAI's standard API Data Usage Policy, API request data may be retained for up to 30 days for abuse monitoring, after which it is permanently deleted. OpenAI does not use API data to train its models.
- Anthropic (text cleanup): Anthropic does not use API inputs or outputs for model training by default. Data may be temporarily retained for safety and abuse monitoring in accordance with Anthropic's Commercial Terms.
Neither OpenAI nor Anthropic uses your voice data or transcriptions to train their AI models. In summary: the App uses OpenAI and Anthropic as third-party AI providers to deliver transcription and text cleanup, these providers do not train on your data, and all shared data is deleted within 30 days.
Before your first recording the App asks you to agree to this processing. You can decline, and you can stop using the voice and AI features at any time.
5. ACCESSIBILITY SERVICE USAGE
The App uses the Android Accessibility Service solely to provide cross-app voice dictation. Specifically:
- Detecting keyboard visibility — to show the floating dictation bubble when the on-screen keyboard opens in another app, and hide it when it closes.
- Inserting dictated text — to paste your transcribed speech into the focused text field after you tap Done.
- Reading the focused field — only at the moment of insertion, to append your dictation without replacing existing text.
- Identifying the destination app — at the moment of insertion, to record the package name and display name of the app where text was pasted (for example, "com.whatsapp", "WhatsApp"). This metadata displays app icons in your Library and usage statistics in the Insights tab, and is stored only on your device.
The App does NOT use the Accessibility Service to:
- Read, collect, or store any text content from other apps
- Read, collect, or store any other content visible on your screen
- Monitor which apps or websites you visit outside of dictation moments
- Access passwords, payment fields, or other sensitive inputs
- Collect or transmit any data when dictation is not active
- Work around Android's built-in privacy controls or change system settings
- Share any collected data with third parties or our servers
You can disable destination app metadata collection at any time in App Settings, under Privacy. Disabling it does not affect core dictation functionality.
6. DATA STORAGE
- Transcription history — stored locally on your device in an on-device database. We do not have access to your stored transcriptions and cannot retrieve them remotely.
- Language preferences — stored locally on your device.
- Entitlements — premium access is unlocked by an on-chain payment from your connected wallet. We record that the payment was made and what it unlocked; we never hold your funds.
- Analytics and crash data — stored by Firebase and Amplitude on their respective servers (see Section 7).
You can delete your transcription history at any time from within the App settings.
7. THIRD-PARTY SERVICE PROVIDERS (SUB-PROCESSORS)
We do not sell your personal information. We share data only with the following trusted sub-processors, who process it on our behalf under contractual data protection obligations:
- OpenAI, L.L.C. (USA) — speech-to-text transcription — audio recordings (ephemeral, up to 30 days)
- Anthropic, PBC (USA) — AI text cleanup and formatting — transcribed text
- Google LLC / Firebase (USA, EU) — analytics, crash reporting, push notifications, remote config — technical identifiers, usage data
- Amplitude, Inc. (USA) — product analytics — anonymised usage events, device info
- Solana RPC and blockchain infrastructure providers — reading and submitting transactions — wallet address, IP address, request metadata
We may also disclose your data:
- with your explicit consent;
- to comply with legal obligations, court orders, or lawful requests from public authorities;
- in connection with a business transfer, merger, or acquisition, in which case we will notify you.
8. INTERNATIONAL DATA TRANSFERS
Some of our sub-processors are based in the United States. When we transfer your personal data outside the European Economic Area (EEA), we ensure appropriate safeguards under GDPR Chapter V by relying on:
- Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our Data Processing Agreements with each sub-processor;
- the EU–US Data Privacy Framework adequacy decision where applicable, for example for Google LLC and other DPF-certified providers;
- supplementary technical measures including TLS encryption in transit.
You may request a copy of the relevant safeguards by contacting us at choizzyio@gmail.com.
9. DATA RETENTION
- Voice recordings (our side) — not retained
- Voice recordings (OpenAI side) — up to 30 days per OpenAI API policy
- Transcription history — stored locally on your device until you delete it
- Analytics data (Firebase, Amplitude) — up to 14 months per provider defaults
- Wallet address and payment records — as long as the entitlement is active, plus the period required by Polish tax law (typically 5 years)
- Crash reports — up to 90 days
Transactions recorded on the Solana blockchain are public and permanent. They are outside our control and cannot be edited or erased by us or by you — see Section 12.
10. DATA SECURITY
We implement appropriate technical and organizational measures to protect your data, including:
- Encrypted data transmission (HTTPS/TLS 1.2+) between the App and all service providers;
- Access controls limiting who can access backend configurations;
- Contractual data protection with all sub-processors.
No method of electronic transmission or storage is 100% secure. In the event of a personal data breach affecting your rights and freedoms, we will notify you and the competent supervisory authority (UODO) without undue delay, and in any case within 72 hours where required by GDPR Art. 33.
11. YOUR PRIVACY RIGHTS
Under GDPR and applicable Polish law, you have the following rights regarding your personal data:
- Right of access — to obtain confirmation of whether we process your data and receive a copy;
- Right to rectification — to correct inaccurate or incomplete data;
- Right to erasure ("right to be forgotten");
- Right to restriction of processing;
- Right to data portability — to receive your data in a structured, machine-readable format;
- Right to object to processing based on legitimate interest;
- Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- Right not to be subject to automated decision-making producing legal effects — we do not engage in such decision-making.
You can delete all locally stored transcription history at any time from within the App settings, and you can disconnect your wallet at any time. Neither we nor you can remove transactions already recorded on the Solana blockchain — see Section 12.
To exercise any of these rights, contact us at choizzyio@gmail.com. We will respond within 30 days as required by GDPR Art. 12(3). This period may be extended by up to two further months for complex requests, and we will inform you of any such extension.
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Poland, the competent supervisory authority is:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
Website: www.uodo.gov.pl
12. SOLANA WALLET AND BLOCKCHAIN DATA
The App can connect to a Solana wallet you choose, using the Solana Mobile Wallet Adapter. Connecting a wallet is voluntary and is required only to buy premium access.
When you connect, we receive your wallet's public address. We use it to recognise your payment and unlock the corresponding entitlement. We never receive your seed phrase, private keys, or recovery phrase; every transaction is reviewed and approved by you inside your own wallet application, which we do not control. We do not hold or custody your funds.
Payments are settled on the Solana blockchain. Blockchain transactions are public, permanent, and outside our control: anyone can view them, and once confirmed neither we nor you can alter or delete them. A wallet address can in some circumstances be linked to your real identity by third parties analysing public chain data. Consider this before connecting a wallet you also use elsewhere.
To read and submit transactions we rely on third-party Solana RPC and infrastructure providers, which may log your IP address and request metadata under their own privacy policies. Your wallet provider acts as an independent controller of the data it processes.
13. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. The latest version will always be accessible within the App and on this website. The "Last Updated" date at the top indicates when it was last revised.
We will notify you of material changes through an in-app notice or push notification before they take effect.
14. CONTACT US
If you have any questions, concerns, or feedback about this Privacy Policy or our data practices, please contact us:
Candy Studio Apps
Filtrowa 65/38, 02-055 Warszawa, Poland
Email: choizzyio@gmail.com