Polityka prywatności Voxmill

What stays on your computer

Your audio and video files, the transcripts, speaker labels and file paths never leave your computer. Transcription, voice detection and speaker labelling run in the Voxmill worker process on your computer (crates/worker). Voxmill has no server of its own for your data. It contacts tenzanlogic.com for three things only: a daily update check that carries nothing about you (below), the update itself once you select “Update and restart”, and error reports, only after you switched them on.

When Voxmill records a meeting it writes only to one WAV file in its own data directory (the recordings/ folder named below), plus, when it repairs the sound your computer played, a copy of that file as it was recorded (below), and it asks your operating system for the microphone and for the sound your computer plays before it can hear either (crates/capture). With Settings, Recording, “Record from” set to “Microphone only”, it records the microphone alone and does not listen to the sound your computer plays (apps/desktop/src-tauri/src/record.rs). A summary, when you switch summaries on, is written by a second process of Voxmill’s own on your computer (crates/summary): it reads the transcript and stores the summary back into the same database, and nothing of it leaves your computer either.

What leaves your computer, and when

• Model downloads. On first use Voxmill downloads the speech models from Hugging Face and GitHub over HTTPS (crates/models/manifest.json: each Hugging Face address is pinned to one published revision; the two GitHub addresses are release files under a named tag, which is not pinned to one revision, so the SHA-256 check below is what holds each of them to one file). Those services see three things: your IP address, the file requested and the program name “voxmill” in the request. Nothing else. Voxmill checks each downloaded file against the SHA-256 digest in the manifest built into the app when it arrives, records the file’s length and modification time beside it, and checks the digest again whenever either has changed since. The Core ML encoder is the one exception at launch: it arrives as a zip archive and is unpacked into a folder, so at launch Voxmill compares the archive’s digest, recorded beside the folder on arrival, with the manifest’s, rather than hashing the folder again (crates/models). If you switch on “Summaries (experimental)” under Settings, this also downloads the summary model, Qwen3.5-4B (Apache-2.0 licence, from the unsloth/Qwen3.5-4B-GGUF repository), from Hugging Face the same way; the summary itself runs on your computer, in a program of its own, and reads only the transcript already on your machine.

• Licence activation. When you enter a licence key bought through Polar, Voxmill sends the licence key, Tenzan Logic’s organisation id at Polar and a machine fingerprint to api.polar.sh. The fingerprint goes with that activation only. Polar answers with an activation id and the e-mail address the licence key was bought with. Every 30 days after that, Voxmill confirms the licence key still stands by sending the licence key, the organisation id and the activation id, without the fingerprint (crates/licence; while Voxmill runs it looks every six hours at whether that check is due). A licence key this computer already holds, entered again, is confirmed the same way instead of activated again; if Polar answers that it no longer knows that activation, or that the licence key is no longer active, Voxmill activates the licence key again as above, fingerprint included. The same three values, again without the fingerprint, give an activation back to Polar: when you remove the licence key in Voxmill; when you enter a different licence key, a hand-signed one included, for the old one; when a licence key turns out not to unlock Voxmill, for the activation it just took; and when Voxmill could not store a new activation in its database, for that activation. When Voxmill drops an activation without having given it back (a licence record it no longer trusts, a licence key Polar refused twice at the 30-day check, or a give-back that did not get through), it keeps that activation and tries again at the next start, the next six-hourly check or the next activation, until Polar takes it back or refuses it (apps/desktop/src-tauri/src/tier.rs). Polar’s first refusal at the 30-day check only makes Voxmill note its time and kind; Voxmill removes that licence key from this computer when Polar refuses it again in the same way between 24 hours and 30 days later. One activation is not kept that way: the activation a licence key that does not unlock Voxmill just took, when Polar does not take it back at once. Voxmill writes that to its log and keeps nothing. It can stay at Polar, where you can remove it in the customer portal named below. The machine fingerprint is the first 16 bytes of a SHA-256 hash of two values: your machine identifier (the id your operating system gives this computer) and your user account id. Nobody can turn the fingerprint back into either value. Voxmill also uses it locally to seal the licence record in its database, so a copied record does not work on another computer. Polar stores it as the label of the activation. You can see and remove activations in Polar’s customer portal, https://polar.sh/tenzanlogic/portal. Polar Software, Inc. is the merchant of record for the purchase, which means it is the legal seller, and it holds the purchase data (name, e-mail, payment) under its own privacy policy.

• Update check. Once when the window opens, and once a day after that, Voxmill asks tenzanlogic.com for one small file, https://tenzanlogic.com/download/voxmill-macos.json, to learn whether a newer version exists (apps/desktop/src-tauri/src/update.rs, apps/desktop/src/main.ts). The address is the same for every copy of Voxmill. The request says nothing about you, your files or your computer, and names no Voxmill version. The one thing it says about itself is the name and version number of the updater component inside Voxmill (tauri-plugin-updater/ and that number), which changes only when Voxmill moves to a newer updater, so at most it hints at a range of Voxmill versions. The server sees your IP address and the name of that file, as it would for any page you open. Voxmill downloads nothing until you select “Update and restart”. Then it asks for that small file once more and downloads the update archive from tenzanlogic.com, from the address that small file names, saying the same about itself and nothing more, and it checks the archive against Tenzan Logic’s signature before it replaces Voxmill. The server sees your IP address and the archive’s name for that download too.

• Hand-signed licence keys. Tenzan Logic issues these directly. Voxmill checks them offline and never sends them anywhere. Entering one on a computer that holds a licence key bought through Polar gives that licence key’s activation back to Polar, and at every start Voxmill tries again to give back an activation it still keeps, whichever licence key the computer holds, both as described above.

• Links you open. These open outside Voxmill, in your own browser or mail app, and only when you click:

  • “Buy Pro” opens Polar’s checkout page with Pro chosen, and the address tells Polar only that the visit came from the app and in which window language (nothing about you), and “Open the buyer’s portal” opens Polar’s customer portal.
  • “Voxmill Help” in the Help menu, “Voxmill on the web”, “Licence terms” and “Privacy notice” open pages on tenzanlogic.com.
  • “Email Support…” in the Help menu opens your mail app with a subject line that names the Voxmill version.
  • “Open Screen & System Audio Recording” on the recording screen opens the macOS privacy pane for audio capture.

  apps/desktop/src-tauri/capabilities/default.json allows exactly these five destinations: Polar’s checkout, Polar’s customer portal for Tenzan Logic, tenzanlogic.com, mail to contact@tenzanlogic.com and that one System Settings pane.

Voxmill sends no telemetry and no usage data. It never reports that something worked, and it counts nothing. The one thing it can send about itself is an anonymous error report, and only because you asked it to.

• Anonymous error reports. Only if you chose “Send reports” at the first launch, or ticked “Send anonymous error reports” later under Settings, Privacy. Clearing that box turns them off again. Nothing is sent before you answer, and “Do not send” is a complete answer. Voxmill sends one small JSON object to https://tenzanlogic.com/api/diagnostics/ when it crashes, when a file fails for good, when a speech model will not load, when an update fails to install, and once a session when the Pro model runs without its Neural Engine file. Each report carries twelve fields and nothing else: the schema version, which of those five things happened, the Voxmill version, your system version, the chip, the memory in whole gigabytes, whether the Lite or the Pro model is in use, the backend, which language the window is in, a one-word code for what went wrong, and, for a crash, two 16-character fingerprints of the message and of the trace. It carries no file name, no path, no transcript text, no licence key, no e-mail address, no IP-based identifier and no installation id, so two reports from your computer cannot be told apart from two reports from two computers. There is one attempt with a five-second limit, on a background thread; a report that does not get through is dropped and never stored or retried. apps/desktop/src-tauri/src/diagnostics.rs is the whole of it.
• Where those reports go. To tenzanlogic.com, which runs on Vercel (Vercel Inc., a processor for Tenzan Logic). The address that takes them keeps no IP address with a report, writes none to its own log and stores the twelve fields alone, in a private store that adds the time it wrote them, under a name made from the day and the content of the report, so two identical reports on one day stay one file. Tenzan Logic reads them as one summary mailed once a day. A stored report is deleted 90 days after it arrives.

What Voxmill stores on your computer

• Voxmill’s local data directory holds these files: voxmill.sqlite, with the queue, transcripts, settings and the licence record (plus its -wal and -shm companions while Voxmill runs), the downloaded models under models/, and, once “Reset Voxmill” has been used, one voxmill.sqlite.reset-<time> file: a whole copy of the database as it was before that reset, with the list and its transcripts, speaker names, details, marks and summaries, and the settings, among them your name and its other forms, the folders you chose, the licence record and any activation still to be given back. Voxmill keeps one such copy, the newest, and deletes the earlier one at the next reset; it is yours to delete whenever you like. On macOS that directory is ~/Library/Application Support/com.tenzanlogic.voxmill/, where Voxmill creates the database readable by your user only. On Windows it is %LOCALAPPDATA%\com.tenzanlogic.voxmill\, which is your user’s own profile folder. Recordings you make with Voxmill’s own record button are written to a recordings/ folder in that same directory, one WAV each, named after the date and time you started them. When the sound your computer played arrived squeezed, Voxmill repairs the recording when it stops and keeps the file as it was recorded beside it, under the same name with .damaged added (crates/capture). Voxmill deletes a recording in two cases only: when it stopped before any audio reached it, and when you remove its row from the list with “Remove” or “Clear the list”, which also deletes the .part and .damaged files of the same name beside it (apps/desktop/src-tauri/src/record.rs). “Clear the list” leaves a row whose recording failed to transcribe in the list, with its recording, until you remove that row with “Remove” (apps/desktop/src-tauri/src/db.rs). Voxmill deletes only files that sit directly in recordings/: a file anywhere else is never deleted, even when you added it to the list yourself, and a recording that another row of the list still names stays until that row goes too. Every other recording is yours to move or remove whenever you like. A recording grows under a .part name until it stops, so one cut short by a crash or a forced quit takes a .wav name at the next launch and is added to the list, or is deleted when it holds no audio (crates/capture, apps/desktop/src-tauri/src/record.rs). A model download stopped halfway leaves a .part file in models/ until it finishes or you delete the models. Voxmill clears such a leftover itself: when it starts, it deletes the unfinished download files in models/ that are more than seven days old and the empty .unpack folders an interrupted unpacking left there, whatever their age, and nothing else (apps/desktop/src-tauri/src/models.rs).

• The name you type under Settings, Transcription (“Your name”), and its other forms beside it (“Nicknames”) are kept in voxmill.sqlite until you change or clear them, and in the reset copy above if you used “Reset Voxmill” after typing them (apps/desktop/src-tauri/src/lib.rs). The title, the people present, the languages and the focus you type into Details, next to Record or on a row, are kept there with that row and deleted with it (apps/desktop/src-tauri/src/db.rs). While a recording runs, what you typed and your marks stay in memory, and Voxmill stores them on the recording’s row when it stops or when Voxmill quits (apps/desktop/src-tauri/src/record.rs).

• The marks you set while recording, each the time it was set and the note you typed for it, are kept in voxmill.sqlite with the recording’s row and deleted with it (apps/desktop/src-tauri/src/record.rs).

• A log file, voxmill.log, sits in the platform’s log directory: macOS ~/Library/Logs/com.tenzanlogic.voxmill/, Windows %LOCALAPPDATA%\com.tenzanlogic.voxmill\logs\. It records errors, and a few plain notes about the work, such as an update check, the housekeeping at startup, a job carrying on from where it stopped, a job starting over because speaker labels need the whole file, a summary waiting for free memory, or the microphone or the sound output changing during a recording. Those lines name a file or a folder by its name alone, never by the path it sits in, and never any transcript text (apps/desktop/src-tauri/src/lib.rs, watch.rs, queue.rs, crates/capture). Voxmill keeps one older copy: when it starts and the file has grown past 1 MB, it is renamed to voxmill.log.1 over the previous older copy, so the run before a crash survives. While Voxmill runs, the file is emptied whenever the next write would take it past 2 MB, which is the log plugin’s own ceiling; a session can start with up to 1 MB already in the file, so that can happen after about 1 MB of the session’s own lines. “Show the Log” in the Help menu opens it for you. It exists so you can attach it to a support mail if you choose to.

• Nothing in that directory is sent anywhere. “Copy Diagnostics” in the Help menu puts a short text on your clipboard for you to paste into a support mail yourself: the Voxmill version, your system version, the chip and memory of this computer, the model and backend in use, and the last 50 lines of the log. Those lines are cleaned first: anything that looks like a licence key or an e-mail address is removed, and every path is cut down to the file name at the end of it, folders named after a person included (apps/desktop/src-tauri/src/logs.rs, diagnostics). You can read the whole text before you send it, and you can send nothing.

• A few window details. The text size and a copy of the window language sit in the webview’s own storage, which the first paint reads before the database can answer (apps/desktop/src/main.ts, apps/desktop/src/i18n.ts). The window’s size and position sit in .window-state.json (tauri-plugin-window-state). On macOS the webview keeps its storage in ~/Library/WebKit/com.tenzanlogic.voxmill/, the webview and macOS keep caches for Voxmill in ~/Library/Caches/com.tenzanlogic.voxmill/, macOS keeps its own preferences file for Voxmill, ~/Library/Preferences/com.tenzanlogic.voxmill.plist, and the window file sits in the data directory above. On Windows the webview keeps its storage inside the data directory above, and the window file is %APPDATA%\com.tenzanlogic.voxmill\.window-state.json. None of these is sent anywhere.

• Two caches macOS keeps for Voxmill on its own. Metal keeps the graphics shaders it compiled for Voxmill in com.tenzanlogic.voxmill/ inside your user cache folder; they hold no audio, transcripts, file names or anything else of yours. WebKit keeps working folders in com.tenzanlogic.voxmill/ inside your user temporary folder. One of them, WebKit/MediaCache/, fills when the window shows the transcript of a finished file, which it does on its own when the file finishes and whenever you open its row: the window’s player then reads the file, whether or not you press Play. It notes the full path of each such file and can keep pieces of its audio. Voxmill deletes that folder when it quits and again when it starts, so it lasts one session at most; after a crash or a forced quit it stays until Voxmill next starts (apps/desktop/src-tauri/src/lib.rs). The other WebKit folders hold nothing of yours. In Terminal, getconf DARWIN_USER_CACHE_DIR and getconf DARWIN_USER_TEMP_DIR print where those two folders are; quit Voxmill and delete the com.tenzanlogic.voxmill folder in each to remove them.

• A socket file on macOS, /tmp/com_tenzanlogic_voxmill_si.sock. When Voxmill is opened a second time on the same account, the second launch sends the running copy the folder it was started from and the files it was asked to open through that file, then quits (tauri-plugin-single-instance, apps/desktop/src-tauri/src/lib.rs). The file holds nothing itself, but any account on the Mac can list /tmp and see which account owns it, and so that this account runs Voxmill. Voxmill removes it when it quits; after a crash or a forced quit it stays until Voxmill next quits normally or the Mac restarts.

• A notes folder, only if you chose one under Settings. Every file that finishes writes one Markdown note there with the transcript, the marks you set while recording it, and the summary when summaries are on. Each note opens with a header naming the recording, the day, its length, the model, the language and the number of speakers. The folder is yours, wherever you put it: Voxmill writes new files there and rewrites the ones it wrote itself, and never overwrites a file it did not write (apps/desktop/src-tauri/src/queue.rs, crates/export).

Delete those directories and files, and the notes folder if you chose one, and nothing of Voxmill remains in your files. macOS keeps two records about Voxmill outside them: the permissions you gave it in System Settings, Privacy & Security (the microphone, Screen & System Audio Recording, and access to folders such as Downloads), which tccutil reset All com.tenzanlogic.voxmill in Terminal clears, and its entry under Notifications, which holds only your choices for its notifications.

What Voxmill hands to your operating system

• Notifications. When the queue runs dry while the Voxmill window is not in front, Voxmill posts one system notification for the whole batch: the file’s name when it was the only one, the counts of ready and failed files when it was not (apps/desktop/src-tauri/src/queue.rs). Your operating system keeps it in its notification centre under its own rules. You can switch it off with “Notify when a batch finishes” in Settings, or switch Voxmill’s notifications off in the system settings.
• Copy and save. “Copy transcript” puts the transcript on the system clipboard. “Save as” writes it to the file you pick. Both happen only when you click.
• What a saved document says about itself. A Word document you save opens with the recording’s file name, the date you saved it and the name of the model that read it, and its document properties (File, Info in Word) carry the same date as the day it was created and last changed. A JSON file names the recording and the model in its first fields. A Markdown file opens with the recording’s file name. Text, subtitle (SRT, VTT) and CSV files hold only the transcript and the speaker names (crates/export, apps/desktop/src-tauri/src/lib.rs). Delete that header before you pass the document on if you would rather not say those things; the date in a Word document’s properties stays until you clear it there too.

Who is responsible, on what basis, for how long

• Controller. Szymon Jędryczko, trading as Tenzan Logic, Poland, contact@tenzanlogic.com. GDPR asks for the controller’s identity and contact details, and e-mail is the contact channel. Tenzan Logic gives a postal address on request by e-mail. (An unregistered sole trader has no company registration number. Tenzan Logic updates this notice when that changes.)
• The purchase. Polar Software, Inc. (Delaware, USA) is the merchant of record and an independent controller for the purchase. It processes your name, e-mail, payment and invoice data under its own privacy policy and its own legal basis, and you can exercise your rights towards Polar directly. Tenzan Logic sees the buyer’s name, e-mail and the licence key in Polar’s dashboard in order to deliver and support the licence (the contract with you, GDPR article 6(1)(b)).
• The activation record. At Polar, the activation record is the licence key, the machine fingerprint as the label of the activation, and the activation time. On your computer, Voxmill’s licence record in its own database holds the licence key, the e-mail address Polar gave for it, Polar’s activation id, the tier, the time of the last successful check with Polar, the latest time on this computer’s clock at which Voxmill stored the record, the time and kind of a first refusal while it waits for a second, and a seal made from those fields and the machine fingerprint; the fingerprint itself is not stored (crates/licence). “Manage key” shows that e-mail address. An activation Voxmill still has to give back is kept with the same fields, without the seal, until Polar takes it back or refuses it. A hand-signed licence key is stored as the key itself, which names the e-mail address and the tier it was issued for, the day it was issued and any last day. Two bases apply: the contract (article 6(1)(b)) for counting activations, and Tenzan Logic’s legitimate interest (article 6(1)(f)) in stopping a licence key from being shared beyond its seats. The fingerprint is a hash that identifies a computer and user account, not a person, and it is the least data that does the job. A transfer to the USA happens because Polar is there. It rests on Polar’s data processing terms with standard contractual clauses, the European Commission’s approved contract terms for sending personal data outside the EU (see Polar’s policy for the current instrument).
• The update check and the update download. Tenzan Logic’s legitimate interest (article 6(1)(f)) in delivering updates and security fixes. Neither request carries personal data of its own; the IP address each arrives from is seen by Vercel, which hosts tenzanlogic.com as a processor for Tenzan Logic, under its data processing terms. Tenzan Logic keeps no record of these requests and does not tie them to a person.
• Error reports. Your consent (article 6(1)(a)), given with “Send reports” at the first launch or by ticking “Send anonymous error reports” under Settings, Privacy. You withdraw it by clearing that box at any time; reports sent before that stay lawful. A report carries none of the data listed above that could point to you, so Tenzan Logic cannot find or delete the reports of one person, and deletes every report 90 days after it arrives.
• Retention. Your transcripts stay on your computer until you remove them. Voxmill never deletes a transcript on its own, on a timer or otherwise: “Clear the list” in the window removes the finished and failed rows with their transcripts, details and marks, and the recordings Voxmill made for them, except a failed row that holds a recording, which stays with it until its own “Remove”; “Remove” does the same for one row, “Reset Voxmill” empties the list into the one copy named above and leaves every recording in recordings/, and deleting the data directory above removes everything at once (apps/desktop/src-tauri/src/db.rs). A removed transcript leaves the list at once, and in the same step Voxmill overwrites its text, file path, details and marks inside voxmill.sqlite and empties the -wal companion. A copy made before that keeps what it held: the one “Reset Voxmill” leaves, and any Time Machine backup or snapshot of the data directory. The activation record lives as long as the licence key is active, plus what Polar’s own retention says. Tenzan Logic keeps purchase records for the time Polish tax law requires (five years from the end of the tax year). Tenzan Logic keeps support mail for as long as the matter is open and up to two years after, then deletes it.
• Your rights. You have the rights of access, rectification, erasure, restriction, portability and objection (GDPR articles 15 to 21). Write to contact@tenzanlogic.com. To have an activation removed, you can also do it yourself in Polar’s customer portal. You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or to the authority of the country where you live.
• No profiling, no automated decisions, no sale of data.

The site’s own privacy notice covers the Windows notification and contact forms on tenzanlogic.com, and the count of installer downloads behind its download button.