Scope and controller
This Privacy Policy explains how Verbaform collects, uses, stores, and discloses personal information when you visit tryverbaform.com, join the waitlist, use the Verbaform macOS app, create an account, contact support, or use optional cloud features.
Verbaform is the controller of the information described here, except where a third-party provider acts as an independent controller under its own terms. Questions and privacy requests can be sent to support@tryverbaform.com.
The short version
Verbaform is local by default. Local speech recognition and deterministic editing run on your Mac. Raw audio is held in memory only long enough to transcribe an utterance and is not saved by Verbaform.
Content leaves your Mac only when you deliberately choose a network feature, such as a cloud speech model, a provider-backed AI edit, an account action, a model download, or an update check. We do not sell personal information, share it for cross-context behavioral advertising, or use your dictation to train Verbaform models.
Information we process
Website and waitlist
When you join the waitlist, we collect your email address and the time you joined. Our hosting provider also processes ordinary request information such as IP address, browser details, requested pages, and timestamps to deliver and secure the site. If bot protection is enabled, Cloudflare Turnstile processes security signals such as IP address, user agent, TLS characteristics, site key, and origin.
Account and purchase information
If you sign in, we process your email address, account identifier, authentication state, credit balance, credit grants and spends, and associated timestamps. Authentication tokens are stored in the macOS Keychain or held in memory. If you purchase a paid offering, the merchant of record named at checkout processes your payment details. Verbaform receives the information needed to provide the purchase, such as your email, transaction or subscription status, entitlement, and credit grant. We do not receive your complete payment-card number.
App content and preferences
The app stores sessions, transcript tokens, edits, macros, templates, variables, library entries, and preferences in a local SQLite database. Provider API keys and account refresh tokens are stored in the macOS Keychain. Audio is not written to that database. Content imported through the Lens may be archived locally in Captures if the relevant setting is enabled.
Support and diagnostics
If you contact support, we process the information you choose to send. The app can prepare diagnostics containing app and build versions, macOS version and architecture, selected model, provider configuration status, and the local log path. Diagnostics exclude transcript content. Logs remain on your Mac unless you choose to share them.
Local processing and macOS permissions
Verbaform uses macOS permissions only to provide features you activate:
- Microphone: captures speech while dictation is active. Local models process audio on your Mac. Verbaform does not persist raw audio.
- Accessibility: identifies the focused app and text field, reads an active selection when you invoke the Lens, places text at the cursor, and sends the keyboard events needed for insertion.
- Clipboard: may place text on the clipboard for insertion, then restore the prior clipboard if no other app changed it. Verbaform reads clipboard text only when you explicitly invoke a clipboard-dependent action or configure a Lens copy fallback.
- Keychain: protects provider keys, refresh tokens, and other credentials that should not be stored in the app database.
Verbaform refuses to insert into detected secure fields. macOS controls permission grants, and you can revoke them in System Settings. Revoking a permission can disable the features that depend on it.
Optional cloud processing
Cloud speech recognition
If you choose Scribe or another cloud speech model, the current microphone utterance is sent to ElevenLabs either directly with your own API key or through Verbaform Cloud. Verbaform Cloud holds the audio in memory while forwarding the request and does not write the audio or resulting transcript to its database or logs. It records account and metering metadata such as audio duration, credits, provider latency, and status.
ElevenLabs processes the request under its own policy. Its standard API configuration may retain request history and use information as described in that policy. Zero Retention Mode is a separate enterprise configuration and is not promised by Verbaform unless the product expressly says it is active. Avoid cloud transcription for sensitive material if the selected provider terms do not meet your needs.
AI commands and rewrites
When you ask Verbaform to compile a natural-language command, the request can include your instruction, command schema, macro and marker names, and document counts. It does not include the full document. A library value is included only if you turned on its share-with-AI setting.
When an approved program includes an AI rewrite, Verbaform sends only the text inside the approved scope plus the instruction needed to perform that edit. Managed requests use Anthropic. Bring-your-own-key requests may use Anthropic or OpenAI. The provider may retain or review request content under its terms, including for abuse prevention. Verbaform does not use that content to train its own models.
Bring your own key
With BYOK, requests go from your Mac directly to the provider. Your relationship with that provider and its privacy terms govern that processing. Verbaform stores the key in Keychain and does not return it to the interface, place it in SQLite, or include it in logs.
How we use information
We use personal information to provide and secure the website and app, authenticate accounts, deliver requested cloud features, meter credits, process purchases, send sign-in codes and requested product communications, respond to support, prevent abuse, diagnose failures, comply with law, and enforce our agreements.
Where European or similar law requires a legal basis, we rely on performance of our contract to provide requested services, consent for optional cloud processing and marketing communications, legitimate interests in securing and improving the service without collecting content, and legal obligations such as tax and accounting requirements. You may withdraw consent at any time, without affecting earlier lawful processing.
Service providers and disclosures
The providers involved depend on what you choose to use. We limit disclosures to what is reasonably necessary for the service.
We may also disclose information to comply with valid legal process, protect users or the service, investigate fraud or security issues, or complete a merger, financing, acquisition, or sale. In a business transfer, the recipient must honor this Policy for information covered by it.
Provider policies can change. Current details are available from Cloudflare, Supabase, Resend, Fly.io, ElevenLabs, Anthropic, and OpenAI.
Retention and deletion
- Local app data: remains on your Mac until you delete a session, library item, setting, credential, or the app data. Deleting the application alone may not remove its Application Support, model cache, Keychain, or log files.
- Raw audio: is not persisted by Verbaform. A cloud provider may retain inputs under its own terms.
- Waitlist: is kept until the beta invitation and related product communication purpose is complete, you unsubscribe, or you ask us to delete it.
- Account and credit records: are kept while your account is active and as needed to provide the service, resolve disputes, prevent fraud, and meet legal, tax, and accounting obligations.
- Support: is kept as long as reasonably needed to resolve the request and maintain an appropriate record.
When you make a verified deletion request, we delete or de-identify covered information within a reasonable period unless we need to retain it for security, legal, accounting, or dispute-resolution reasons. Third-party retention periods remain subject to the provider policy and any account settings you control.
Security
We use measures designed for the sensitivity of the information, including encrypted transport, macOS Keychain storage for credentials, local storage for primary content, short-lived access tokens, signed license proofs, provider-key isolation, secure-field refusal, content-free release logging, and access controls around cloud records.
No system is perfectly secure. Protect your Mac account, keep macOS current, use trusted provider keys, and do not use a cloud feature for content that the provider is not suitable to process.
Your choices and rights
Depending on where you live, you may have rights to know, access, correct, delete, or obtain a copy of personal information; restrict or object to processing; withdraw consent; and appeal a decision. You may also have the right not to receive discriminatory treatment for exercising a privacy right.
You can manage local sessions, cloud consent, provider keys, telemetry consent, and account sign-out in the app. Telemetry is not transmitted in the current beta, even if the preference is on. Marketing email includes an unsubscribe option.
To make a request, email support@tryverbaform.com. We may verify that you control the relevant email or account. You may use an authorized agent where applicable. If you are in the EEA, UK, or another region with a privacy regulator, you may also complain to your local authority.
International processing
Verbaform and its providers may process information in the United States and other countries. Those countries may have different privacy laws. Where required, we use contractual or other recognized safeguards for covered transfers. Local-only app content does not become an international transfer unless you choose a network feature.
Children
Verbaform is not directed to children, and users must be at least 18 or the age of legal majority where they live. We do not knowingly collect personal information from a child through the service. If you believe a child has provided information, contact us so we can review and delete it where appropriate.
Changes to this Policy
We may update this Policy as the product, providers, or law changes. We will post the revised version with a new date. If a change materially affects how we use information already collected, we will provide additional notice when required.
Contact
Privacy questions, requests, and complaints can be sent to support@tryverbaform.com. Please use the subject “Privacy request” and identify the email associated with your waitlist or account.