Privacy Policy

This policy explains what Stilou (“we,” “us”) does and doesn't collect when you use the Stilou macOS app and the stilou.ai website. We wrote it in plain language on purpose.

1. What the app stores and sends

Your content lives on your Mac. What leaves it depends on the feature and the mode:

• Your own API keys (if you add any) are stored in the macOS Keychain. They authenticate your requests to your chosen provider; we never receive them.
• Bring-your-own-key mode: text you dictate, rewrite or chat with goes directly from your Mac to the provider you chose (Anthropic, OpenAI, Groq, or OpenRouter) over an encrypted connection. It does not pass through our servers.
• Included plan (the default, no key needed): dictation audio and the text of rewrites, chats and memory-organising passes travel over an encrypted connection to our relay at stilou.ai, which calls the AI with our key and returns the result. The relay does not store or log the content — it keeps only anonymous usage counts (keyed to a random device id) for metering the free tier. The app's nightly memory-organising pass also uses this path unless Private mode is on. IP addresses are used transiently for rate-limiting and abuse prevention; our hosting provider (Vercel) keeps standard request logs under its own policy. Usage counters are retained only as long as metering needs them.
• Your memory, notes, screenshots, voice profile and preferences are stored locally on your device (the stores are encrypted at rest). Deleting the app's data removes them.
• Connected services are optional and off until you connect them. If you connect Slack, Google (Gmail/Calendar) or Read.ai, the app fetches your data from those services to your Mac and processes it there; the sign-in tokens live in your Keychain. The optional meeting-capture feature is off by default: if you deliberately enable it, a notetaker bot joins the meeting you point it at via our capture service, the transcript is delivered to your Mac and a copy is retained by the capture service until deleted. You are responsible for telling meeting participants a notetaker is present, as recording-consent laws in your jurisdiction may require.

2. The AI providers handle the text they process

Whichever path your text takes, the provider that actually runs the model does so under their terms and privacy policy:

• Anthropic (Claude) and OpenAI — API usage is generally not used to train their models.
• Groq — runs the included plan's dictation and cleanup models; API data is not used for training per their terms.

In bring-your-own-key mode you're billed directly by your provider and we're not party to that transaction. On the included plan we cover the provider call with our key; the relay passes your content through without storing it.

3. Crash & error reporting

The shipped app currently sends no crash reports and no analytics. If we ever enable crash reporting, it will be disclosed here first, will contain technical diagnostics only (stack trace, app and macOS version), and will never include your text, audio, or keys.

4. The website and payments

stilou.ai is a static site hosted on Vercel. We may use privacy-respecting, cookieless analytics to count visits. We do not run advertising trackers. Payments are handled by Lemon Squeezy under their privacy terms; we receive only the order details needed to deliver your license key — never your card number.

5. What we never do

• We don't sell or rent your data.
• We don't store your writing, audio, or memory on our servers — content passes through the relay transiently and is gone.
• We don't require an account. Optional sign-in adds an identity to your license — it never creates a second copy of your memory.

6. Your rights

Because your content lives on your device, you're in control: delete the app's data or the app itself to remove everything locally. For anything website-side (an email you gave us, a purchase record), email us and we'll access, correct, or delete it. Depending on where you live, you may have rights under the GDPR or CCPA; we honor them.

7. Children

Stilou isn't directed at children under 13 (or the equivalent age in your region) and we don't knowingly collect their data.

8. Changes

If we change this policy, we'll update the date above and, for material changes, note it on the site.

9. Contact

Stilou is operated by Przemyslaw Siwek (the data controller for the purposes of the GDPR). Questions or data requests? Email hi@stilou.ai.

Questions about this policy? Write to hi@stilou.ai — a human reads it.