Legal

Privacy Policy

Last updated October 13, 2026

1. What stays on your device

• Dictation audio. Recordings are saved on your device before they are transcribed, so a failed take is not lost. You choose how long audio and transcripts are kept, in Settings, Storage.
• Speech recognition, punctuation, capitalization and cleanup. These run on your iPhone or Mac, using Apple's on-device speech engine and the models that ship with Cofactor. Nothing is sent to a server to be formatted unless you turn on your own AI provider (section 4).
• Larger optional speech models are downloaded once, when you start the download, from Hugging Face and from GitHub. The download does not include anything you dictated.
• Your transcripts, notes, saved phrases, personal vocabulary, settings and statistics, kept in the app on your device.
• Voice insights, search by meaning and keyboard learning. These are computed on your device. Search by meaning uses Apple's on-device sentence embeddings. Keyboard typing data stays on the device and is excluded from device backups.
• Apple Watch. The watch records on its own microphone. Each recording goes only to your iPhone, through Apple's Watch connection, and the watch deletes its copy once the iPhone has it. The watch app has no network code. Your iPhone transcribes the audio on the device.

You can use Cofactor without an account. Recordings, transcripts, notes and My Info are included in iPhone device backups, such as iCloud Backup or a backup to your computer.

2. Sync My Devices (iCloud and your account)

Sync My Devices is on by default. You can turn it off in Settings. While it is on, Cofactor copies these items to iCloud key-value storage in your Apple account, so your other devices can read them:

• Settings, personal vocabulary and statistics (counts and totals).
• A recent window of transcript history and notes. Session notes are included only while Sync Session Notes is also on.

Apple stores this copy under iCloud's own protections, and Apple's privacy policy applies. Cofactor adds no encryption layer on this path and cannot read the copy. Contact names are never included (section 6).

If you are signed in, your settings, vocabulary, saved phrases, statistics, transcript history and notes also go to our servers. They are encrypted on your device before upload, with a key kept in your iCloud Keychain that we never receive. We store only the encrypted data and cannot read it. This runs only while Sync My Devices is on.

Turning sync off stops new copies from being sent. It does not delete copies already in your iCloud account, or the encrypted copy on our servers. To remove the iCloud copy, delete Cofactor data in iCloud Settings. Deleting your Cofactor account removes the encrypted copy on our servers, but not copies already stored in your iCloud account.

3. Automation API (off by default)

The Automation API is off until you turn it on in Settings, under Advanced, Automation API. While it is on:

• New dictations and notes you make are copied to our servers in readable form, so the tools you authorize can read them. Existing history is not copied.
• The tools use access tokens that you create and can revoke. Notes that a tool sends you wait in your inbox until you delete them.
• If you add a webhook, your device sends the text of each new dictation or note to the https web address you give, signed with a secret kept in your iPhone's Keychain. We keep a delivery receipt for each delivery, with the event name, attempt number and status.

Turning the API off revokes every token, deletes the stored copies and deletes your webhook settings. Notes a tool sent you stay in your inbox until you delete them.

4. Your own AI provider (off by default)

You can connect an AI provider of your own choice. It is off unless you turn it on and enter a server address and an API key. The address must use https, or be a loopback address on your own computer. When it is on, the text you dictated is sent to that server so it can be polished, and any extra context you switch on is sent too. The key is stored in your device Keychain.

When it is on, your provider is used for dictation polish and for Redo, including its shorter, more formal and friendlier rewrites. If the provider fails or takes longer than three seconds, Cofactor polishes on the device instead. The privacy policy of the provider you chose applies to what it receives.

5. Pairing an Android phone (optional)

If you pair an Android phone for sync, the two phones exchange the sync key directly, by scanning QR codes between them. No server is part of the pairing. Both phones then show the same six-digit code, which you confirm before the key is sent. The key is sealed so that only the two phones can open it.

6. Contacts, calendar, and other permissions

• Contacts. If you allow Contacts, Cofactor reads the given name, family name, nickname and organization name of your contacts on your device, so it can spell those names correctly in dictation. The name import does not read phone numbers, email addresses or postal addresses, and it never uploads your contacts. Contact names stay on your device. They are never included in Sync My Devices and never sent to our servers. Once you have granted access, names are refreshed about once a day, and you can turn that off in Settings.
• My Info. If you choose a contact to fill in your own details for keyboard suggestions, Cofactor saves that contact's name, email, phone number and address on your device only. These details are not synced or uploaded.
• Calendar. If you turn on Calendar names, Cofactor reads event titles and attendee names from the 30 days before and the 30 days after today, so it can recognize those names in dictation. That list is cached on your device, excluded from device backups, and never uploaded or synced. Cofactor does not write to your calendar.
• Microphone. Used to record your voice so it can be transcribed on the device.
• Speech Recognition. Used to transcribe on the device.
• Camera. Used only to read a pairing QR code when you pair an Android phone. Nothing is recorded.
• Focus status. If you allow Focus status, Cofactor reads on the device whether a Focus is on, and that status never leaves the device.
• Mac updates. The Mac app checks outliyr.com for new versions once a day. The check identifies the app name and version in its request header. It does not send your macOS version or other system details, because system profiling is off.

7. Crash and reliability reports

Cofactor sends anonymous crash and reliability reports to our error tracking service, GlitchTip, so we can fix problems. This is on by default. To turn it off, go to Settings, then Privacy, then Share Crash Reports. When it is off, Cofactor stops sending reports and discards any that are waiting to be sent.

A report can contain:

• The kind of problem: for a crash, the exception type and signal; for a failure, a fixed name such as a dictation failure.
• A few entries from the crash's call stack, given as the binary name and an offset, without function names.
• The app version and build, the OS version, and the device type (iPhone, iPad or Mac).
• An optional short reference code, which you can give to Support.

A report never contains your audio, your words, your notes, your names, your email address or your device name. Our servers send reports of the same kind for their own failures: the route, the error class and a short error code. GlitchTip keeps only an anonymized form of the IP address that sent each report: the last part of an IPv4 address and the last 64 bits of an IPv6 address are set to zero. It deletes reports after 90 days.

8. If you join the beta

When you apply for the iPhone beta on this site, we store your email address, when you applied, and any answer you choose to give to the optional question about how you plan to use Cofactor. After we send an invite or waitlist message, we also store when we sent it. We use this to send your TestFlight invite and to tell you when Cofactor launches. Apple runs TestFlight under its own privacy policy. A beta record is not linked to your account, so deleting your account does not remove it. To be removed from the beta list, email hello+cofactor@nickurban.me.

9. What we collect if you create an account

An account is optional. You need one only for Sync My Devices across your devices, for Team features, or to buy Pro on the web. When you create one, we store:

• Your email address and display name. If you sign in with Apple or Google, we receive your account identifier from that provider, and the email address and display name it shares with us. An Apple email address can be an Apple private relay address.
• If you sign in with an email address and password, a bcrypt hash of your password. We never store the password itself.
• Passkeys, if you add one: the passkey's public key and ID, a sign-in counter, the transport and device type it reports, and an optional label you name (up to 80 characters).
• Session records that keep you signed in, and short-lived tokens for email verification and password reset.
• Your encrypted sync copy, if Sync My Devices is on (section 2).
• Team details, if you use Team: the team name, members and roles, and the shared vocabulary, saved phrases and defaults your team sets.
• Usage counts from the Mac app, for Team members only: how many dictations completed or failed, seconds of audio, and character totals. These are numbers. The server rejects any request that includes transcript text, and Team admins see totals, never anyone's words.
• Invite and referral records, including the email address of anyone you invite.

Staff with support access can open an account to help you. Changes they make to an account are recorded in an audit log that names the staff member and the reason.

10. Purchases

• Apple. If you subscribe through the App Store, Apple handles payment and we never see your card number. We keep the transaction details Apple provides: the product, purchase and expiry dates, any revocation date, whether the purchase is from production or sandbox, and the renewal and status notices Apple sends to our server.
• Google Play. If you subscribe through Google Play, we keep the purchase token, package name, product, order ID, subscription state, expiry date and whether the purchase has been acknowledged.
• Stripe. If you pay for Team on our website, Stripe handles payment. We store Stripe's customer and subscription references and your plan status. We never see or store your card number.

11. Our website

cofactor.cc sets no tracking cookies and runs no analytics scripts. It stores one thing in your browser, your light or dark theme choice, and only on your device. The site loads its fonts from Google Fonts, and Google receives your IP address when the page loads.

12. Who handles data for us

We use these service providers, each only for the job described:

• A hosting provider for our servers and database.
• An email delivery service for verification, password reset, invite and waitlist messages.
• Apple, for App Store billing, Sign in with Apple, and iCloud.
• Google, for Google Play billing and for Google sign-in if it is offered.
• Stripe, for Team payments.
• GlitchTip, which we run ourselves on a server in Germany, for the reports in section 7.
• Google Fonts, for the website's fonts.

13. Server logs and security

Our application logs record the request method and error codes. They do not record request bodies, so they do not contain your audio, transcripts or notes. To limit abuse, our servers count requests by IP address in memory. Our hosting edge does not keep request access logs for Cofactor. Its error messages can include the IP address of the request that caused them, and those messages stay in the server's container logs, which are not rotated automatically. All connections to our servers use HTTPS.

14. How long we keep it

• Account data and your encrypted sync copy stay until you delete your account.
• Automation API copies stay until you turn the API off or delete them.
• Pairing relay records last two minutes at most.
• Beta records stay until you ask us to remove them.
• Account deletion removes the purchase records linked to your account in our database. Apple and Stripe keep their own records under their own policies, and deleting your account does not delete those records.

15. Your choices

• Delete your account from inside the app. This removes your account and the server data linked to it, including your encrypted sync copy. Recordings, transcripts, notes and settings on your own devices are not touched.
• Turn off Sync My Devices, the Automation API, your own AI provider, or Share Crash Reports in Settings. With all four off, your words stay on your device.
• Ask us for a copy or a correction of your account data, or ask us to delete it, by emailing hello+cofactor@nickurban.me.

16. Your rights (GDPR, UK GDPR and US state law)

Outliyr LLC is the controller of account, beta and website data. If you are in the European Economic Area, the United Kingdom or another place with similar laws, you can ask us to access, correct, delete, restrict or export your data, and you can object to how we use it. Our legal bases are: providing the service you ask for, such as accounts, the sync you turn on, and purchases; our legitimate interest in keeping the service secure, preventing abuse and fixing crashes; and your consent for the optional features, which you can withdraw in Settings. You can complain to your local data protection authority. California residents can ask what personal information we hold, and ask us to delete or correct it. We do not sell personal information, and we do not share it for cross-context behavioral advertising. Email us to use these rights, and we will respond within the time the law requires.

17. Where data is processed

Our application servers and database are in the United States. Crash reports and encrypted backup copies are stored on a server in Germany. Our service providers may process data in the United States and in other countries. Personal data from people in the European Economic Area and the United Kingdom is processed in the United States under the legal basis described in section 16.

18. What we do not do

• We do not sell your data.
• The app contains no advertising or analytics SDKs, and it does not track you across other companies' apps or websites.
• We do not use your voice or text to train AI models, and our servers do not call any AI model.

19. Children

Cofactor is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

20. Changes to this policy

If we change this policy in a meaningful way, we will update the date at the top and, for significant changes, tell account holders by email or in the app.

21. Contact and governing law

Outliyr LLC, 1500 E Riverside Dr, Austin, TX 78741. Questions about privacy? Email hello+cofactor@nickurban.me.

This policy is governed by the laws of the State of Texas, without regard to its conflict of law rules, except where the law of your place of residence gives you rights that cannot be waived.