WhisperBoard Privacy Policy

Effective date

September 9, 2026

Operator

Pribadi Tech ("we", "us", "our")

Contact

pribadi.technology@gmail.com

Applies to

the WhisperBoard Android app and WhisperBoard Services (together, the "Service")

Policy URL

https://whisperboard.pribadi.tech/privacy-policy

WhisperBoard is a voice keyboard: you speak, and your words become typed text. This policy describes how WhisperBoard handles personal information when you use the Service, and the choices you have.

1. The short version

• There are two ways to dictate, and they are very different. Section 3 explains both. In one (WhisperBoard Services) your audio is sent to our service to be turned into text. In the other (bring your own key or self-hosted server) your audio goes straight from your device to a service you choose and does not pass through our servers.
• In WhisperBoard Services mode, your audio is processed and then discarded. It is not saved to a database, and we do not build a history of what you said on our side.
• We do not sell your data or show ads, and WhisperBoard does not use your audio or text to train its own AI models.
• Firebase Crashlytics (Google) helps us find and fix bugs. If the app crashes, a small diagnostic report is sent to Google. It is used for app stability only. We configure crash reporting not to intentionally include your audio, dictated text, typed text, API keys, or authentication credentials. We explain what is in it in Section 7.
• Your transcription history stays on your device. The app keeps your recent transcriptions (up to 40) in its private storage on your phone. It is not synced to us. You can delete it at any time.
• If you sign in, you sign in with Google. We receive your email address, display name, and a Google account identifier. We do not receive your Google password. Signing in is needed only for WhisperBoard Services mode.
• You can delete your data. Email us to request deletion of your account and server-side data, or see the options in Section 12.

2. About WhisperBoard

WhisperBoard is independently developed and funded through subscriptions and credit purchases, not advertising or the sale of personal data. It is built and operated by Pribadi Tech. If you have a question about this policy, email pribadi.technology@gmail.com.

3. The two ways to dictate

WhisperBoard works in two different modes. Which one you are in depends on the settings you choose. The privacy consequences are different, so please read this section.

3.1 Bring your own key (BYOK) or self-hosted server

In this mode you do not need an account. You provide your own speech-to-text provider, either by entering your own API key (for example an OpenAI API key) or by pointing the app at a Whisper server you host yourself or rent from a provider of your choice.

In this mode:

1. The app records audio from your microphone, after you grant microphone permission.
2. The audio is sent directly from your device to the provider you chose, using the endpoint and key you configured.
3. The resulting text is returned to your device and typed into the app you are using.

WhisperBoard's servers are not involved in this mode. We do not receive your audio, your transcripts, or anything you dictate. The provider you chose handles your audio under its own terms and privacy policy, and that relationship is between you and them. In this mode the information that leaves your device is the audio you send to your provider, the credential that provider needs to authenticate your request (your API key, sent directly to that provider, as described in Section 5), and, if the app crashes, the crash report described in Section 7.

3.2 WhisperBoard Services (the managed mode)

In this mode you sign in with Google, and audio is sent to WhisperBoard's own service, which arranges speech-to-text on your behalf using third-party providers. This mode is what allows the free tier, subscriptions, credit packs, and referral rewards.

In this mode:

1. The app records audio from your microphone, after you grant microphone permission.
2. The audio is sent over an encrypted connection to the WhisperBoard service.
3. Our service forwards it to a speech-to-text provider that performs the transcription on our behalf.
4. The resulting text is returned to your device.

On our servers the audio is held in memory for the duration of the request. We do not write audio files to disk and do not store them in a database. When the request finishes, the audio is discarded from our systems.

Along with the audio, we send the small details the transcription needs: its language (if you set one) and, if you selected one, the short mode hint that controls formatting (for example, a mode that formats speech as a clean paragraph or a list).

What this means in practice: in this mode your voice leaves your phone and passes through our service and the provider's systems. We send only what is needed to process that single request, and WhisperBoard does not keep it. The provider's own processing and retention are governed by its applicable terms and policies. If you would rather your audio not pass through WhisperBoard's service, use the bring-your-own-key mode described above. Your audio will still be processed by the provider you configure, under that provider's terms.

3.3 Speech translation

WhisperBoard can also translate speech into text in another language. Translation works in whichever mode you are in, using the same path as transcription:

• In BYOK mode, the audio goes to your own provider, which performs the translation.
• In WhisperBoard Services mode, the audio goes to our service, and the resulting transcript is sent to a translation provider. WhisperBoard does not store the audio or translated text in its application database after processing. The provider's processing and retention are governed by its applicable terms and policies.

4. Information we handle in WhisperBoard Services mode

This section applies only to the managed mode (Section 3.2). In BYOK mode, none of this applies, because your audio does not reach us in that mode.

4.1 Your Google account details

To create your account we receive from Google:

• your email address,
• your display name (if Google provides it), and
• the Google account identifier (a random string Google assigns, not your password or account number).

We use these to create and show your account, keep you signed in, and apply your plan's limits.

4.2 Usage records (no content)

For each transcription or translation request our service keeps a small technical record: date and time, which provider handled it, the duration of the audio, whether it succeeded, and an error code if it failed. These records contain no audio and no text. We use them to apply your quota, prevent abuse, and fix problems.

4.3 Purchases and subscriptions

Payments are processed entirely by Google Play Billing. We do not receive your payment card details. To verify purchases and manage your subscription we use RevenueCat, a subscription management provider. RevenueCat receives:

• a random identifier generated for your account (not your email address),
• purchase and subscription status from Google Play, and
• basic technical information such as app version and device platform.

We store your plan tier (FREE, PLUS, PRO, or MAX) so the app knows which features to unlock.

4.4 Referral program

If you use the referral program we store your referral code, the credits it issues, and redemptions. To keep the program fair we also store a pseudonymous value derived from a device identifier using a one-way cryptographic process, and, briefly, your IP address to limit rate abuse. IP addresses used directly by our application for temporary rate limiting expire automatically after a short period. Our infrastructure providers may retain technical logs under their applicable retention policies. How long referral and other credits remain usable is explained in our Terms of Service.

4.5 Technical logs

Our servers keep logs of requests (time, URL, status code, duration, and a random correlation ID) to operate and debug the service. These logs do not include your dictation content.

5. Information primarily stored on your device (both modes)

Most of what WhisperBoard deals with is stored on your device rather than on our servers. In both modes, the following is kept in the app's private storage on your phone. Android normally isolates this storage from other apps, subject to the security and configuration of your device:

• your dictation history (the last 40 transcriptions, stored so you can copy or review them),
• your app settings and preferences,
• in BYOK mode, your API key and the endpoint you configured,
• any cached credit or balance information, and
• your sign-in session (in WhisperBoard Services mode).

Most of this information is used only on your device. Two items are credentials, and credentials have to be sent again when they are used to make a request you asked for:

• Your BYOK credentials (your API key and endpoint) are stored locally and are transmitted directly to the provider you configure when needed to authenticate your request to that provider.
• Your sign-in credential is stored locally and is sent to WhisperBoard only when needed to authenticate a WhisperBoard Services request.

Removing this information is in your hands:

• Sign out in the app clears your session and account details.
• Delete or clear history in the app removes saved transcriptions.
• Clear storage (Android Settings, Apps, WhisperBoard, Storage) or uninstalling the app removes everything on your device, including any cached recordings.

If you have Android's device backup enabled, the operating system may include app data in your own Google account backup as part of that feature. That is controlled by Android and your Google account, not by us.

6. Microphone permission

WhisperBoard is a voice keyboard, so it needs to use your microphone. Recording is started by you, and a clear visual indicator (a blinking mic and a voice-level ring) is shown the whole time recording is happening:

• Tap to start, tap to stop. You tap the mic button to start recording, and tap it again (or press space/enter) to finish and transcribe. The app does not record continuously, and it does not listen in the background.
• Optional auto-start (off by default). One setting, "Automatically start microphone recording when WhisperBoard opens", makes recording begin by itself as soon as the keyboard opens, so you can speak right away. It is off unless you turn it on, and when it is on, the same recording indicator is shown.
• Cancel is available. While recording you can cancel without sending the audio anywhere, and a cancelled recording is deleted from the app's cache rather than kept.

WhisperBoard accesses the microphone only during an active recording session, and the recording is shown on screen while it happens. Outside of a recording, the microphone is not in use.

7. Crash reports (Firebase Crashlytics)

Firebase Crashlytics (a Google service) is built into the app to help us keep it stable. When the app crashes or hits an unexpected error, a crash report is sent to Firebase Crashlytics. This is the diagnostic tool in the app, and it runs in both modes, because a crash can happen whether or not you are signed in.

A crash report contains:

• a stack trace showing where in the app's code the problem happened,
• a scrubbed, truncated error message (limited to 200 characters, with anything that looks like a key or credential replaced by "[redacted]"). We configure this reporting not to intentionally include your audio, dictated text, typed text, API keys, or authentication credentials,
• the app version,
• your device model and operating system version,
• technical information about the app and device at the time of the problem, such as available memory, and
• a Firebase Installation ID used to distinguish app installations and group related diagnostic reports. We do not intentionally link this identifier to your WhisperBoard account.

Crash reports are used for app stability only. We do not intentionally use them to track what you dictate or how you interact with the app, and we do not intentionally link them to your WhisperBoard account or dictation history. Crash reports are kept for about 90 days.

8. What we do not do

• We do not sell or rent your personal information.
• We do not show ads in the app.
• WhisperBoard does not use your audio or transcripts to train its own AI models. Providers you use may process information under their own terms, particularly in BYOK mode, where the provider is your own choice and relationship.
• We do not track you across other apps or websites. As of the effective date, the app contains no behavioral analytics, no advertising SDKs, and no tracking SDKs. The telemetry SDK in the app is Firebase Crashlytics, described in Section 7. (The Google Sign-In libraries let you sign in, and Google Play services process your purchases; neither is used to track you.)
• What you type stays between you and the app you are typing into. WhisperBoard is an on-screen keyboard, so the text you type passes from your finger to the field you are typing in, as with any keyboard. WhisperBoard does not collect the ordinary text you type. Information transmitted from your device may include audio and related transcription settings, authentication credentials, account and purchase information, and crash diagnostics, as described in this policy.

9. Who receives your data

We share data as needed to run the service.

In WhisperBoard Services mode:

In bring-your-own-key mode:

In WhisperBoard Services mode, service providers process information as necessary to provide services to WhisperBoard, subject to their applicable terms and agreements.

In BYOK mode, the provider you configure receives information directly under your relationship with that provider. WhisperBoard does not control that provider's privacy or retention practices.

You can email us to ask which providers we currently use.

We may also disclose information if we are legally required to (for example, a valid legal request), or to protect the rights and safety of our users, to the extent the law allows.

10. How long we keep data

When you ask us to delete your account, we delete the account record and the data listed above, except where we need to keep certain information for the legitimate reasons described in Section 12. Residual copies in encrypted backups, if any, are removed on our normal backup cycle.

This table covers how long we keep records. It does not describe how long a credit itself remains usable. Credit expiration and the order credits are consumed are explained in our Terms of Service.

11. How we protect data

• Audio is not written to disk on our servers. In-memory processing is a design decision, not an afterthought.
• Sign-in sessions are stored as cryptographic hashes, so a stolen copy is not directly usable to sign in.
• Device identifiers used for referral abuse prevention are stored as pseudonymous values derived using a one-way cryptographic process.
• All traffic between the app and our service uses TLS encryption.
• Billing webhooks are cryptographically verified, and administrative functions require secret keys.

No system is perfectly secure. If a breach affecting your data ever occurs, we will notify affected users as required by applicable law.

12. Your choices and rights

You can, at any time:

• Sign out in the app, which also revokes your session on our side.
• Delete dictation history: remove single entries or clear all history in the app.
• Remove app data from this device: clear the app's storage or uninstall it. If Android backup is enabled, copies held in your Google account are managed through your Android and Google backup settings.
• Delete your account and server-side data: email us at pribadi.technology@gmail.com from the address you signed in with (or include enough detail for us to find the account). We aim to complete verified deletion requests within 30 days, unless we need to keep some information longer for security, fraud prevention, transaction records, dispute resolution, or legal obligations. We will confirm when the deletion is done.
• Revoke Google access for WhisperBoard at any time via your Google Account settings (myaccount.google.com, Security, Third-party access).
• Request a copy or correction of your personal data by emailing the same address.
• Cancel a subscription through Google Play. Cancelling stops future billing.

Depending on where you live, you may have additional rights over your personal information under local law, including the right to access, correct, export, or object to processing. We will not discriminate against you for exercising those rights.

13. Children

WhisperBoard is a general-audience productivity tool and is not directed at children. We do not knowingly collect personal information from children under 13 (or the higher minimum age that applies in your country). If you believe a child has created an account, contact us and we will take steps to remove it.

14. International transfers

Our providers may process information in countries other than your own, including the United States. Their privacy protections and international-transfer arrangements are governed by their applicable terms and policies.

15. Changes to this policy

We will post updates to this policy on this page and revise the effective date at the top. Where appropriate or required, we may also provide notice through the app or by email.

16. Contact

Contact us at pribadi.technology@gmail.com with privacy questions or requests. You can also visit https://whisperboard.pribadi.tech.