Privacy policy

Last updated: September 22, 2026

Who processes the data

Data controller: Roberto Collura. For any request: dimmitutto.info@gmail.com.

In short

• Your voice is recorded only while you hold the dictation key, and it is transcribed by cloud speech recognition services.
• To write consistently with what you have already written, a short piece of the text around your cursor is sent along with your voice.
• The dictated text is not saved in our database, and neither is the audio.
• Our servers keep your account, your personal vocabulary and usage counters: numbers, not content.
• We do not sell data, we do not run ads, and we do not use your content to train artificial intelligence models.

What is processed, and why

• Account data. Email address and account identifier; if you sign in with Google, the verified email Google shares with us. Used to authenticate you and to manage your trial and subscription.
• Dictation audio. Recorded only while the key is held and sent to the transcription providers listed below, for as long as it takes to produce the text. We do not keep it. If a dictation fails, the app keeps at most the last ten recordings on your computer, so it can be retried.
• Text around the cursor. When you start dictating, the app reads up to 400 characters before the cursor and 200 after it in the field you are typing in (never in password fields), and sends them along with the audio: they are used to punctuate and to spell names consistently with the rest of the text. Proper names found in the field or in the window title may be passed to the transcription service as vocabulary hints. The name of the program you are using is not sent, only its category (for example "email" or "chat").
• Dictated text. Transcription and correction go through our server and the artificial intelligence providers, which process it to give it back to you. It is not saved in our database. Short fragments (for example an uncertain word or a proper name) may appear in the server's technical logs, used only to track down malfunctions and kept for a limited time.
• Learning from your corrections. After pasting the text, the app watches the field while it stays in the foreground, to notice if you correct a word by hand. The corrected passage may be sent to the artificial intelligence model that decides whether it is a spelling worth learning; learned words go into your personal vocabulary.
• Personal vocabulary. The words you teach it or that it learns (term, variants, category, number of uses) are synced with your account, so that your computer and phone share the same vocabulary. They are also sent to the transcription and correction providers as hints.
• Usage. Minutes of audio, words and number of dictations per month, to apply the trial and the subscription; the cost of the services used, to keep the service sustainable. For some accounts the details of each request are also recorded (service, model, duration): numbers, never content.
• Subscription. Paddle customer and subscription identifiers, status and renewal date. Card data is handled by Paddle: we never see it or store it.
• Data that stays on your computer. History of the last 200 dictations, daily backups (the last 14), settings, vocabulary, account session (encrypted) and activity logs, which may contain excerpts of the dictated text and of the text around the cursor: those logs delete themselves after 14 days. They are kept in the %APPDATA%\DimmiTutto folder, are not uploaded anywhere, and you can delete them at any time.
• With no connection. Dimmi Tutto only dictates online: transcription and correction happen on the services listed below. With no network, dictation does not start and no audio is processed.
• Your own keys. If you enter your own API key for a transcription or correction service, data goes directly from your computer to that service, under your own agreement with it.
• Weather. If you enter your city in your profile, its name is sent to Open-Meteo to show the weather on the main screen.
• Android app. The accessibility service reads the field you are typing in, to insert the dictated text and to learn from your corrections. Learning happens on the phone and only the vocabulary is synced.
• Updates. The app downloaded from the website checks GitHub for new versions, and GitHub sees your IP address at that moment. The app installed from the Microsoft Store is updated by the Store, under Microsoft's terms.

Legal bases

Performance of the contract (Art. 6(1)(b) GDPR) for the features of the service: transcription and correction, reading the text around the cursor, learning from corrections, vocabulary sync, trial and subscription management. Legitimate interest (Art. 6(1)(f)) for security, abuse prevention, cost control and the technical logs used to fix malfunctions. Legal obligations (Art. 6(1)(c)) for tax records.

Third-party providers

They process data on our behalf, only to provide the service:

• Supabase Inc. (United States) — accounts, database and the server functions dictations go through.
• AssemblyAI Inc. (United States) — speech transcription: receives the audio and the vocabulary hints.
• OpenAI (United States) — backup speech transcription.
• OpenRouter Inc. (United States) — routes requests to the artificial intelligence models that correct the text and, when needed, transcribe it: currently Google (Gemini), Microsoft, OpenAI and Anthropic (Claude).
• Groq Inc. (United States) — backup text correction, for when the main corrector does not answer.
• Cloudflare Inc. (United States) — website and Android app download.
• GitHub Inc. (United States) — distribution of the Windows app files, update checks, and the one-off download of the small model that detects when you are speaking.
• Hugging Face Inc. (United States) — the same, if GitHub does not answer.
• Open-Meteo — weather, only if you enter a city.

They process data as independent controllers, under their own privacy policies:

• Paddle.com Market Ltd (United Kingdom) — reseller of the subscription to the end customer: payments, invoices, refunds.
• Google Ireland Ltd — only for those who choose to sign in with a Google account.
• Microsoft Corporation — only for those who install the app from the Microsoft Store.

Transfers outside the European Economic Area are covered by the European Commission's standard contractual clauses and, for certified providers, by the EU-U.S. Data Privacy Framework. Artificial intelligence providers receive content through their developer interfaces, and may keep it for a limited period under their own terms, for example for security and abuse prevention.

Retention

Audio and dictated text are not saved in our database. The server's technical logs are kept for the period set by the infrastructure provider, usually a few days. The personal vocabulary and usage counters are kept as long as the account exists. Account data is deleted within 30 days of closing the account, except for records that the law requires us to keep. The activity logs on your computer — the ones that may contain excerpts of the dictated text — are deleted automatically after 14 days, every time the app starts. Other data on your computer stays there until you delete it or uninstall the app.

Your rights

Access, rectification, erasure, restriction, portability and objection to processing, by writing to the address above: we reply within one month. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of your country.

Children

The service is not intended for children under 14. If we find out that an account belongs to a child under 14, we close it and delete its data.

Cookies and local storage

This site does not use profiling cookies or analytics tools that identify visitors, which is why there is no consent banner. We do not load fonts, scripts or images from third-party domains.

Two exceptions, both technical. The home page asks GitHub for the number of the latest app version, to show it next to the download button: GitHub sees the visitor's IP address at that moment. And when you press "Start the subscription" in your account area, the browser loads Paddle's payment script, which opens the secure window where you enter your card details. Paddle is not contacted before that click. The script is technically necessary for the payment you asked for, and card data goes to Paddle, not to us: it never passes through our systems.

On the sign-in pages and in the account area the browser keeps, in its own local storage, the code that keeps your session open, so you are not asked for your password on every page; for the duration of the visit it also remembers whether you closed the language notice. These are technically necessary: they do not track your browsing and do not require consent. They are removed when you sign out or clear the site's data in your browser.

Use of artificial intelligence systems

Dimmi Tutto transcribes your voice and refines the text using generative artificial intelligence models: processing is automatic and no person is involved. The result may contain mistakes, so review it before sending it. No automated decisions are taken that produce legal effects for the user. To report inappropriate output: dimmitutto.info@gmail.com.

Changes

If the way we process data changes, we update this page and the date at the top. Changes involving new uses of your data are also announced by email or in the app.