Legal · Privacy

Privacy Policy

Last updated: 2026-05-30 GDPR-aligned Version 2.0

SpeechKey translates speech in real time. It is built around a simple idea: you bring your own AI provider keys (BYOK), and your audio and text are sent directly from your device to the providers you choose. We deliberately keep ourselves out of the data path. This policy explains exactly what is processed, where it goes, and what we never do. It is written to align with the EU General Data Protection Regulation (GDPR) and equivalent frameworks.

The one thing to know SpeechKey has no user accounts, no analytics and no tracking. But translation only works by sending your audio or its transcribed text to a third-party AI provider over the internet. That transfer is the core of how the app functions — this policy makes it transparent.

01Privacy at a glance

  • We do not require an account. There is no login, no profile, no email collection by us.
  • We do not run analytics or advertising SDKs, and we do not track you across apps or websites.
  • Audio is processed only while the translator is actively running. It is streamed to your chosen provider to produce a translation and is not stored by us.
  • Transcripts and translations stay on your device by default. You can export or delete them at any time.
  • Your API keys are stored only on your device in the platform secure storage (iOS Keychain). We never receive them.
  • We do not sell personal data and we do not use your conversations to train any model.

02Data controller

  • Controller
    Markus Vaitl
  • Address
    Wengertstr. 18, 72766 Reutlingen, Germany
  • Privacy contact
    privacy@vaitl.ai

Because SpeechKey has no backend account system, most processing happens locally on your device or directly between your device and the AI provider you select. For those direct transfers, the relevant AI provider is an independent controller under its own privacy policy (see section 06).

03Data we process

Audio data

Microphone audio captured while a translation session is active. Used solely to produce a transcript and translation. See Microphone & audio.

User content — transcripts & translations

The text transcripts, translation outputs and any meeting content generated from your speech. Stored on your device; see Transcripts & translations.

Configuration data

Your language pair, selected providers, encrypted API keys, voice choice and accessibility settings. Held locally on your device.

Diagnostics (optional)

If something crashes, the app may generate a diagnostic report. These reports are kept local and exportable by you — they are not transmitted to us automatically. If you choose to send a report to support, it is shared only with your explicit action.

Purchase state

Whether you have purchased SpeechKey. The one-time purchase is handled by Apple (see One-time purchase). We do not receive your name, card number or address from Apple.

04Microphone & audio processing

SpeechKey needs microphone access to translate speech. When you tap Start Translator:

  • Audio is captured in short streamed chunks.
  • Each chunk is sent over an encrypted (TLS) connection directly to the AI provider you selected, using your own API key.
  • The provider returns a transcript and/or translation, which is rendered — and optionally spoken aloud — on your device.
  • When you stop the translator, audio chunks held in transit are discarded.

05Transcripts & translations

Transcripts and translation outputs are stored locally on your device so you can review a conversation after the fact. They are not uploaded to a SpeechKey server. You can delete any transcript individually, or clear all history, from within the app — deletion is permanent on that device.

Because this content is generated from spoken conversations, it may contain personal or sensitive information. Treat exported transcripts the same way you would any other sensitive document.

06AI providers & data flow

SpeechKey is a resilient speech layer — the actual translation and voice synthesis are performed by third-party AI providers that you connect with your own keys. When you run a session, the active provider (or the one adaptive routing selects on your behalf) receives:

  • your audio, or its transcribed text;
  • session metadata required by that provider's API (language codes, voice ID, audio format).

Translation engines you may connect:

Voice providers (spoken output) you may connect:

  • ElevenLabs — natural expressive voices. Privacy policy
  • Minimax — fast multilingual text-to-speech.

Each provider is an independent data controller for the data it receives, governed by its own privacy policy and data-retention and model-training terms. We surface the current list and links in-app under Settings → Providers. We recommend reviewing the terms of any provider before connecting it — in particular whether that provider may retain or train on submitted content, which is outside our control.

Important — BYOK does not mean nothing leaves your device Even though your keys are stored locally and we never see your sessions, translation inherently requires sending your audio and/or text to an external AI provider. What that provider does with the data is governed by its policy, not ours. This is the central data flow of the app and we want it to be unambiguous.

07BYOK & key storage

  • Your API keys are encrypted on-device using the platform secure storage (iOS Keychain).
  • Audio and text are sent directly from your device to your provider — not via SpeechKey servers.
  • We never receive, log or store the contents of your translation sessions, and we never receive your keys.
  • You can remove a key at any time; removal deletes it from the device secure store.

08What we do not do

  • No tracking. SpeechKey does not track you across other companies' apps or websites and contains no advertising identifiers.
  • No analytics SDKs. We do not embed third-party analytics or attribution frameworks.
  • No accounts. No sign-up, no profile, no email collected by us.
  • No model training on your data by us. (Your chosen AI provider's own training terms still apply to data you send it — review them.)
  • No sale or sharing of personal data for advertising or any commercial purpose.
  • Audio & translation
    Contract (Art. 6(1)(b)) — strictly necessary to provide the translation you requested
  • On-device storage
    Contract (Art. 6(1)(b)) — to deliver the feature you enabled
  • Purchase
    Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
  • Diagnostics you send
    Consent (Art. 6(1)(a)) — only when you actively share a report

10Retention

  • Live audio — discarded immediately after the session; never stored by us.
  • Transcripts & translations — kept on your device until you delete them. We hold no server copy.
  • API keys & settings — kept on your device until you remove them or uninstall the app.
  • Diagnostic reports — local until you delete or share them.
  • Provider-side retention — governed by each provider's own policy; we cannot control or delete data held by a provider.

11One-time purchase

SpeechKey is a one-time purchase through the Apple App Store (9,99 € worldwide, ¥99 in China). Payment, billing and refunds are handled entirely by Apple under Apple's terms and privacy policy. We do not receive or store your payment card details, billing address or full name. We only learn whether the app has been purchased. Any usage costs for the AI providers you connect are billed to you directly by those providers (BYOK), with no markup, and never flow through us.

12International transfers

Some AI providers operate outside the European Economic Area (EEA) — for example in the United States or, for China-domestic routing, within China. When you connect such a provider and run a session, your audio or text is transferred to that provider's infrastructure in its region. Where you are in the EEA, these transfers rely on the provider's own transfer mechanisms (such as Standard Contractual Clauses). Because the transfer is initiated directly from your device with your own key and provider choice, you control which providers — and therefore which regions — your data is sent to.

13App Store privacy labels

For transparency, this is how SpeechKey is declared in Apple's App Privacy ("nutrition label"):

  • Used to track you
    No
  • Linked to your identity
    No
  • Audio Data
    Collected to provide the app (not linked, not for tracking)
  • Other User Content
    Transcripts & translations (not linked, not for tracking)
  • Diagnostics
    Only if you choose to send a report

The full mapping we file in App Store Connect, including the per-provider third-party data flow, is documented on our App Store privacy declarations page.

14Your rights

Under GDPR and equivalent frameworks you have the rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent. Because we hold essentially no personal data about you on a server, most of these you can exercise directly in the app — your transcripts, keys and settings live on your device and you can export or delete them at any time. For anything else, or to complain, email privacy@vaitl.ai or contact your local data-protection authority. We respond within 30 days.

15Children

SpeechKey is not directed to children under 16. We do not knowingly collect personal data from anyone under 16.

16Changes to this policy

We may update this policy. Material changes will be notified in-app before they take effect, with the updated date shown above.

17Contact

  • Privacy
    privacy@vaitl.ai
  • Postal
    Markus Vaitl, Wengertstr. 18, 72766 Reutlingen, Germany

This document is provided for informational purposes and is not legal advice. Review with qualified counsel before launch.