1. Operator (data controller)

• Company: SIA Inc. (SIA株式会社)
• Address: 2-2-13 2F Minami-Azabu, Minato-ku, Tokyo, Japan
• Privacy contact: contact form

2. Scope

This policy covers the macOS app Otonota ("the app") and the website www.otonota.com ("the site"), both provided by SIA Inc. ("we").

The app is distributed through Apple's App Store. Purchases, downloads, and in-app purchases are handled by Apple Inc. under Apple's privacy policy. We receive no information from Apple that identifies individual buyers.

3. Information we handle

3.1 Data processed inside the app (we never receive it)

Recordings, transcripts, summaries, translations, glossaries, and session data are stored only on your Mac, in the app's own data folder, and are processed on the Mac as a rule (the exceptions are listed in 3.2). We never receive them, and we run no server that could.

3.2 Network access

The app makes no network requests by default. It connects only in these cases:

• Downloading on-device models: when you choose a WhisperKit or MLX model, the model files are fetched from their distributor (for example Hugging Face). The distributor receives the technical information that comes with any download, such as your IP address. No audio or text is sent.
• Using a cloud engine (planned paid feature): only if you explicitly select a cloud engine in Settings and enter your own API key. A cloud language model receives the text to be summarized or translated; cloud speech recognition receives the audio being recorded. Both are handled under that provider's privacy policy, and usage is billed to your own account.
• Apple services: Apple Speech and Apple Intelligence are on-device features from Apple; they may contact Apple's servers, for example to fetch a language model the first time. One exception: if you choose Apple Speech for transcription and on-device recognition for that language isn't available on your Mac, macOS may process the audio on Apple's speech recognition servers as part of the operating system. That processing is governed by Apple's privacy policy and never reaches us. If you don't want audio to leave the Mac, choose Apple Intelligence transcription or WhisperKit.

3.3 API keys

API keys you enter for cloud engines are stored in the macOS Keychain and are never sent to us.

3.4 Technical information (generated automatically)

• Site access logs: IP address, user agent, OS and device information, language settings, access times, and error logs, used for abuse prevention, troubleshooting, and quality improvement. The site is served through Cloudflare's infrastructure.
• App diagnostics: crash and performance diagnostics are collected by Apple through standard macOS mechanisms (MetricKit and Apple's "Analytics & Improvements"). They are shared with us only if you have allowed "Share with App Developers" in those settings, and only as anonymized statistics and crash logs. They never contain audio or transcript content.

3.5 Contact and feedback

What you enter in the site's forms, and the history of any follow-up correspondence. The contact form requires your name and email address; organization is optional. The feedback form makes name and email optional, except that an email address is required if you allow us to follow up by email. Bug reports can optionally include environment details (app version, macOS version, memory, engine) and a satisfaction rating.

4. Purposes

• Providing, operating, and maintaining the app and the site, and resolving problems
• Responding to enquiries (we reply only when needed and cannot promise an individual reply to every message)
• Fixing bugs and improving quality
• Detecting and preventing abuse; keeping the service secure
• Complying with the law and handling disputes
• Sending important notices (changes, outages, security)

We do not send marketing email about the app or the site without your consent.

5. Legal basis (EEA/UK users)

Where the GDPR or UK GDPR applies, we rely mainly on:

• Performance of a contract — providing the app and the site, and support
• Compliance with legal obligations
• Legitimate interests — abuse prevention, safe operation, quality
• Consent — where processing is based on consent

Where the law requires it, we will appoint a representative in the EEA/UK and publish the contact details in this policy or on our site.

6. Third parties and processors

• We do not sell personal information.
• Apple Inc. — distributes the app and handles purchases, in-app purchases, and the diagnostics described in 3.4, under Apple's privacy policy.
• Cloudflare, Inc. — serves the site and protects the forms from bots (Turnstile). Technical information about your visit passes through Cloudflare.
• Email delivery service — form submissions are delivered to us as email through a delivery service (Resend, or an SMTP service we contract) acting as our processor. Only the data needed for delivery is passed on.
• Model distributors (e.g. Hugging Face) — receive the technical information that comes with a download when you choose to download a model (3.2).
• Cloud engine providers (OpenAI, Google, and others) — only if you explicitly enable one with your own API key: language models receive the text to be summarized or translated, speech recognition receives the audio (3.2). That relationship is between you and the provider.
• We may disclose information where the law requires it, or where necessary to protect someone's life, body, or property and obtaining consent is impractical, to the extent permitted by applicable law.

7. International transfers

We handle information primarily in Japan. Using Apple, Cloudflare, the email delivery service, and model distributors may involve processing outside Japan. Where it does, we take the safeguards required by applicable law, such as contractual protections.

8. Retention

• Data inside the app (3.1) — exists only on your Mac and can be deleted by you at any time. Deleted sessions are removed from the trash after 30 days. Uninstalling the app lets you remove its data folder as well.
• Contact and feedback — kept for a reasonable period after the matter is closed, for reference when improving the app, then deleted or anonymized.
• Site access logs — for a reasonable period needed for abuse prevention and troubleshooting.

9. Security

We take reasonable measures against leakage, loss, and damage, including access control, encryption, and log monitoring. The app runs in the macOS sandbox, and API keys are stored in the Keychain.

10. Your rights and how to exercise them

10.1 EEA/UK (where the GDPR/UK GDPR applies)

You may request access, rectification, erasure, restriction, data portability, and object to processing or withdraw consent. You also have the right to lodge a complaint with a supervisory authority.

10.2 California (where the CCPA/CPRA applies)

Where applicable, you have the right to know what information we collect, and to request deletion and correction. We do not "sell" or "share" (for behavioral advertising) personal information.

10.3 Japan (where the Act on the Protection of Personal Information applies)

You may request disclosure, correction, and suspension of use of your retained personal data.

10.4 Requests and identity verification

• Contact: contact form
• Verification: normally by the email address you used to contact us; we may ask for additional information where necessary.
• Response: within a reasonable period, in accordance with applicable law.

Because the data inside the app (3.1) never reaches us, we cannot disclose or delete it on your behalf. Please delete it on your own Mac.

11. Children

Our services are not intended for people under 16 (or the age set by the law of your country). If we learn that we have collected such information inappropriately, we will delete it to the extent reasonable.

12. Cookies

The site uses no analytics tools and no advertising cookies. The bot protection on the forms (Cloudflare Turnstile) may set technical cookies or local storage for abuse prevention. Where consent is required, for example in the EEA/UK, we will provide a way to give it.

13. Changes

We may revise this policy when the law or our services change. Significant changes will be announced on the site.