Privacy Policy

The short version

• Speech recognition runs on your Mac. Recordings are never uploaded.
• The iPhone app works the same way, on your iPhone. Its speech models come with it, and it doesn’t contact our servers. See The iPhone app.
• AI cleanup is optional and off when you install. If you turn it on, text goes straight from your Mac to the provider you choose. It never passes through us.
• We hold only what we need to sell and license the app: your purchase email and order details from Paddle (for App Store purchases, only Apple’s transaction ID), your license key, and hashed IDs for up to two Macs and two iPhones.
• No accounts, no tracking, no ads, no in-app analytics, no crash-report uploads. We don’t sell personal data or share it for advertising.

Who we are

Belltongue (木铎 in Chinese) is made and sold by Guohui Lin, an individual developer (“we”, “us”). For the personal data we receive, mainly licensing, orders and support, we are the controller.

Postal address

Xitian Plastic Factory, Lane 3, Huancheng 1st Road, Huangbu Town, Huidong County, Huizhou, Guangdong 516353, China

Email

[email protected]

Two other parties may receive data, and each answers for it under its own policy:

• Paddle sells Belltongue for us as Merchant of Record and controls the payment data it collects. See Licenses and purchases.
• The cleanup provider you choose, if you use AI cleanup. You deal with that provider directly. See Optional AI cleanup.

What stays on your Mac

Belltongue processes everything below on your Mac. The app doesn’t upload any of it, and we never receive it. Most of it lives in ~/Library/Application Support/Belltongue/.

• Audio. Belltongue records only while you hold or tap the dictation shortcut, or while hands-free mode is on. On-device models turn speech into text. Recordings are never uploaded. They are not saved unless you turn on “Also save recordings (for playback)”, which is off by default. If you turn it on, recordings are kept for 7 days and use at most 500 MB by default. You can change both limits.
• History. Your dictated text, cleaned up, plus the raw transcript and the app you dictated into. It’s kept for 30 days by default. You can change that, including keeping nothing (“Don’t Save”: each dictation is then deleted at the next cleanup, within about an hour).
• API keys and sign-in tokens. Stored only in the macOS Keychain. They aren’t written to settings files, backups or logs.
• Personal dictionary and learned habits. The terms you add or Belltongue learns (each learned term with a short example of where it came from), examples of your corrections and of results you rated as good, and dictations waiting to be checked for terms. If you use a cleanup service, your dictionary and some of the examples go with cleanup requests (see Optional AI cleanup).
• Voiceprint. Only if you turn on Voiceprint Recognition. See Your voiceprint.
• Diagnostic log. Kept in ~/Library/Logs/Belltongue/. It records events, timings and errors, the IDs of the apps you dictate into, and the names of your microphones. It never records what you dictate, and never audio. Error messages from your cleanup provider are logged as the provider sent them, with keys removed. The log stays on your Mac unless you choose to email it to us.
• Backups. “Export Data…” makes a file with your history, saved recordings (if “Also save recordings” is on), your dictionary, correction examples, settings and your Mac’s name. It never includes API keys, voiceprints or paired iPhones. The file is yours to keep safe.

To remove everything, delete the app, the two folders above, the settings file ~/Library/Preferences/app.belltongue.Belltongue.plist (it holds your settings and dictionary), and Belltongue’s items in Keychain Access.

Your voiceprint

Voiceprint Recognition ignores other people talking near you. It is off by default.

• When you turn it on, Belltongue learns your voice from your first everyday dictations on each microphone. You don’t need to set anything up. You can also record a short sample yourself.
• It stores only numbers that describe your voice (speaker embeddings), one profile per microphone. It never stores audio for this. While it is still learning a microphone, it keeps the numbers from up to 12 recent dictations on it to compare them.
• It learns only while the feature is on. When you turn it off, learning stops; your voiceprints and the feature’s models stay until you delete them.
• It is built to learn one voice. A dictation with more than one voice in it, or one that doesn’t match the others, is left out.
• Removing other people’s speech also happens on your Mac.
• You can delete your voiceprint at any time in Settings.

Some laws treat voiceprints as biometric or sensitive data. Examples are the GDPR (Article 9), China’s Personal Information Protection Law, and US state laws such as Illinois’s Biometric Information Privacy Act. So we want to be clear: your voiceprint never leaves your Mac. It isn’t sent to a cleanup service, to our servers, or to anyone else. We never receive it and have no access to it. It is used only to tell your voice apart from others on your own Mac, never to identify you to anyone.

Your iPhone as the microphone

You can use the Belltongue iPhone app as your Mac’s microphone. This is optional and needs the Local Network permission.

• While the iPhone is chosen as the microphone, while you pair one, or once one is paired, your Mac announces itself on your local network (Bonjour, also over peer-to-peer Wi-Fi) under a random ID, so the phone can find it.
• To pair, your Mac plays a short, quiet sound that carries a one-time code, and you approve the phone on the Mac.
• Between the two devices travel: the audio while you dictate, the phone’s name and standby status, your Mac’s name, and your personal dictionary, which they keep in sync each time they connect. Everything is encrypted with keys set up when you pair. It stays on your local network and never reaches us.
• Your Mac keeps the list of paired phones and the dictionary sync state in its support folder, and the pairing keys in the Keychain. Audio from the iPhone is handled like audio from any other microphone.

The iPhone app

The Belltongue iPhone app works like the Mac app, and the rest of this page applies to it too, including Optional AI cleanup (what is sent, to whom, and our role) and your rights. Where the iPhone app differs:

• Speech recognition on your iPhone. The speech models (SenseVoice, a speech-detection model and Whisper) come with the app, so it downloads nothing to recognize speech. Recordings are recognized on the phone and are never uploaded or saved.
• What stays on your iPhone. Your History (the cleaned-up text and the raw transcript, text only, kept for 30 days), your personal dictionary and learned terms, and your settings, in the app’s own storage. API keys and sign-in tokens are in the iPhone’s Keychain. If you back up your iPhone (to iCloud or a computer), this data is included like any app’s. We never receive your backups. Deleting the app removes its data; to remove your API keys too, clear them in the app’s cleanup settings first.
• The Belltongue keyboard. To type dictations into other apps, the keyboard needs Full Access, which iOS asks you to allow. Full Access lets the keyboard reach the Belltongue app through a container the two share on your iPhone (an App Group). The keyboard itself never connects to the internet, and it doesn’t log or send what you type. It reads the text just before the cursor, on the phone, only to undo its own insertion and for swipe-to-delete. The dictated text reaches the keyboard through the shared container and stays there until the next dictation replaces it. The keyboard also notes which app it was last shown in (that app’s ID), so Belltongue can take you back there after you dictate.
• Action Button, Shortcuts and Live Activity. When you dictate with the Action Button or a shortcut, a Live Activity shows the recording on the Lock Screen and in the Dynamic Island. It shows the state and the time, never what you said, and the app updates it on the phone, not through a server. When no Belltongue keyboard is on screen to type the result, the app copies it to the clipboard or hands it to the shortcut.
• Pairing with your Mac. To be your Mac’s microphone (see Your iPhone as the microphone), the app looks for your Mac on your local network (Bonjour) and connects with keys set up when you pair. To pair, it listens with the microphone for your Mac’s pairing sound and reads the one-time code from it. Nothing it hears is kept. The iPhone keeps your Mac’s ID and name in the app’s settings, and the pairing key in the Keychain.
• “Learn from My Usage” (Settings › Privacy) does one thing on the iPhone: with a cleanup service, your dictations are sent again in small batches to find names and terms you use often. The iPhone can’t see edits you make in other apps, so it never watches text fields. Dictations already in your History are sent only if you agree when Settings › Privacy asks. Turn it off and nothing more is collected or sent, and dictations waiting to be checked are dropped.
• Less context. The iPhone app sends no app names, window titles or text around the cursor with cleanup requests. For a voice command, it sends the text you’re changing (your last result) and your instruction.
• No voiceprints. Voiceprint Recognition isn’t available in the iPhone app, and the app makes no voiceprints.
• No contact with us. The iPhone app doesn’t talk to our servers: no account, no license checks, no analytics, no crash reports. Its diagnostic log (events, timings and errors, including error messages from your cleanup provider with keys removed; never what you dictate, never audio) stays on the phone.

iPhone permissions

iOS asks for your permission before the app can use these. You can change them in the Settings app.

Optional AI cleanup

Belltongue can send the recognized text to an AI model that fixes punctuation, removes filler words and spells names correctly. In the app this is the cleanup service.

It is off when you install Belltongue. It stays off until you sign in with OpenRouter or enter an API key. When it’s off, nothing is sent and the on-device transcript is inserted as is. That also happens automatically when you have no network.

When it’s on, the app sends requests directly from your Mac to the provider you picked, over HTTPS. They never pass through our servers, and we can’t see them.

What is sent

• The recognized text. When “English Enhanced” (on by default) is ready, two recognition results of the same audio, so the model can pick the better words. Very long dictations are sent in parts, with one result.
• Your dictionary and style examples. Your personal dictionary and, while “Learn from My Usage” is on, up to 6 recent examples of your corrections and 3 results you rated as good. These help the model follow your spelling and style. To speed things up, Belltongue contacts the provider as soon as you start talking. With Anthropic or a proxy, that early request carries only these instructions and examples. With other providers it only opens the connection and sends no text.
• Context, unless you turn it off. The name of the app you’re dictating into, its window title, the web page address (domain and path only), about 1,500 characters before and after the cursor (the end of the text field, when the app doesn’t report where the cursor is), and any selected text. It’s used only to spell names correctly and match your tone. Turn it off with “Include Text Around the Cursor”.
• Voice commands. If you select text and speak an instruction (for example, “make this shorter”), the selected text, your instruction and the app’s name are sent so the model can rewrite it. This happens even when context is off, because the command needs that text. It never happens in password managers.
• Cancelled dictations. If you cancel after speaking for 2 seconds or more, what you said is still recognized and cleaned up, with context, and saved to History, so it isn’t lost. “Clean Up Again” in History sends that dictation’s raw transcript.
• “Learn from My Usage” (on by default; it does something only while a cleanup service is on):
  • For about 3 minutes after Belltongue inserts text in another app, it reads that text field to see whether you correct what it typed. It never does this in password managers or in apps under “Never Read These Apps”. If you correct something, the text Belltongue inserted and your corrected version are sent, so the model can pick out the names and terms you fixed.
  • Your dictations are sent again in small batches, as text only, to find names and terms you use often.
  • Dictations already in your History are sent only if you agree. When learning first becomes possible and your History has dictations, Settings › Privacy asks whether to learn from them too (up to 3,000, once). Until you choose “Send and Learn”, none of them are sent.
  • When you edit a dictation in History, a small fix is kept as an example, and the old and new text are sent to find the terms you corrected. A better version you write after rating a result 👎, and results you rate 👍, are kept as examples.
  • Turn it off and Belltongue stops reading text fields after it inserts, keeps no new examples, sends nothing to learn from, drops dictations still waiting to be checked, and stops sending earlier examples with cleanup requests. What it already learned stays on your Mac until you clear it.
• “Also learn in apps like WeChat that don’t expose the text field” (off by default; needs Screen Recording permission; works only while “Learn from My Usage” is on). For about 2½ minutes after you dictate into such an app, Belltongue captures the lower part of that window. It reads the text on your Mac (OCR) to see what you changed before sending. Screenshots stay in memory and are never saved or uploaded. If you changed something, the inserted text and your changed version, as read from the screen, are sent, as with other edits.
• Dictionary import. When you import terms from files, a notes folder, links, or another dictation app’s history, Belltongue first looks for terms on your Mac. It sends part of that text (up to about 150,000 characters; one long document may be sent whole) to your cleanup service only if you say yes when it asks.

What is never sent

• Audio, screenshots, or the contents of your whole screen.
• Anything from password managers. Belltongue never reads context in 1Password, Bitwarden, LastPass, Dashlane, Keychain Access or the Passwords app, and never watches them for edits. You can add other apps under “Never Read These Apps”.
• Your voiceprint.
• Secrets near the cursor. Before sending context (the app name, window title, the text around the cursor and the selection), Belltongue removes, on your Mac, anything that looks like a private key, a common API key or token (such as Anthropic, OpenAI, AWS, GitHub or Slack keys, and JSON web tokens), a labelled password, secret or token, a card number or a Chinese ID card number. Web addresses are cut down to domain and path.

Cleanup requests go over HTTPS only, also to an address you enter. Belltongue won’t follow redirects for them, or for the OpenRouter sign-in and balance checks, so your key can’t be sent somewhere else.

Who receives it

Some providers store data in mainland China or other countries. Some may use API data to improve their models. Please read your provider’s terms before you choose. OpenRouter lets you avoid providers that may train on your data, in your OpenRouter privacy settings. See OpenRouter’s privacy policy.

Sign in with OpenRouter uses OpenRouter’s standard sign-in (OAuth). For the few minutes while you sign in, Belltongue opens a temporary port on your Mac (localhost) to receive the redirect from your browser. The key you get is stored in your Keychain. We never handle your OpenRouter payments. When you use OpenRouter, Belltongue also downloads OpenRouter’s public list of models and uses your key to show your usage and credit balance.

Our role

We are not a party to these transfers. Whether to use a cleanup service, and which one, is your choice. The provider works for you under your own account and key. It is not our processor, and we never receive the content.

Downloads and update checks

These requests contain none of your content. Like any web request, they show the server your IP address and standard request details, such as the app and macOS version in the user agent.

• Downloading the app from dl.belltongue.com.
• Speech models. On first launch, Belltongue downloads its speech recognition models from where they are published: SenseVoice and a speech-detection model from the sherpa-onnx releases on GitHub and, with “English Enhanced” on (the default), Whisper from Hugging Face. If you turn on Voiceprint Recognition, it downloads that feature’s models from dl.belltongue.com. Files are checked against checksums fixed in the app or, for Whisper’s model files, the checksums Hugging Face publishes. GitHub and Hugging Face handle their logs under their own policies (GitHub, Hugging Face).
• Update checks. Once a day, Belltongue checks belltongue.com for new versions, and downloads updates from dl.belltongue.com. The request shows your IP address and app version. No other information about your Mac is sent.
• Links you paste. If you import dictionary terms from a link, such as a Google Docs link, Belltongue fetches that page directly from your Mac. That site sees your IP address.

Licenses and purchases

Our license server

Belltongue contacts our license server when you activate, check or deactivate a license. Trial and license status checks may also contact it, using your device’s hashed identifier. The Belltongue iPhone app contacts it too: when you sign in with a license key, and after you buy in the app, to get the license key that also unlocks your Macs. The server is hosted with a cloud infrastructure provider acting as our processor. It stores:

• your purchase email address, for purchases through Paddle;
• for purchases in the iPhone app through the App Store, the App Store’s original transaction ID for the purchase. Apple doesn’t give us your Apple ID, name or email address, so the server holds no email for these licenses;
• your license key;
• hashed device identifiers for up to two Macs and two iPhones. These are one-way hashes, not your device’s raw hardware ID. They are pseudonymous: they don’t name you, but they are linked to your license;
• when each device was activated and deactivated.

The server also sees your IP address when an app connects. We use this data to activate, check and deactivate licenses, to prevent abuse (such as one key used on many devices), and to help you when you contact us.

This website talks to the license server in two places. Right after you pay, the thanks page sends your Paddle order number and the email you bought with, and shows the license key it gets back (only for purchases from the last two hours that weren’t refunded). Your browser keeps those two values for that tab only (session storage) and nothing else. On Lost your key? you enter an email address and the server emails that address its keys, if it has any; it gives the same answer either way.

Paddle

Purchases are handled by Paddle, our reseller and Merchant of Record. Depending on where you buy, that is Paddle.com Market Limited, Paddle.com Inc. or Paddle.com (Canada) Ltd. Paddle collects your payment details, billing address and tax information, and runs fraud checks. It does this as an independent controller under the Paddle privacy notice. We never see full card numbers.

Paddle shares with us what we need to deliver and support your license: your email address, your name if you gave one, your country and postcode, and the order details (product, price, tax, date and order ID).

The checkout on our pricing page is served by Paddle. Paddle’s script loads only when you click Buy. Inside the checkout, Paddle may use cookies or similar technology under its own policy.

App Store

Purchases in the Belltongue iPhone app are made through Apple’s App Store. Apple handles the payment under the Apple privacy policy; we never see your payment details or your Apple ID.

After you buy, the iPhone app sends our license server Apple’s signed record of the purchase. Besides the transaction ID it contains the product, the purchase date, the App Store country or region, the price and the currency. The server checks Apple’s signature and keeps only the original transaction ID, so that each purchase gets one license key. If Apple refunds or revokes the purchase, Apple’s servers tell ours by transaction ID, and the license stops working.

If you sign in on the iPhone with a key you bought through Paddle, the app sends the key and the email you bought with, so the server can check that they belong together.

Support emails

If you email us, we get your email address, your message and anything you attach, such as a log file you choose to send. We use it only to help you. We keep it for up to 2 years after your last message, then delete it, unless we need it longer for a legal claim.

This website

belltongue.com is a static site hosted on Cloudflare Pages.

• We don’t set cookies. We don’t use advertising or tracking.
• We may use Cloudflare Web Analytics. It doesn’t use cookies or local storage, and it gives us only totals, such as page views and referring sites.
• Cloudflare processes IP addresses to deliver the site and protect it from attacks. It does this as our processor. See the Cloudflare privacy policy.

macOS permissions

macOS asks for your permission before Belltongue can use these. You can turn any of them off in System Settings › Privacy & Security.

What we don’t do

• No user accounts.
• No usage analytics or telemetry in the app.
• No crash-report uploads. (macOS’s own diagnostics settings, which send reports to Apple, are separate.)
• No ads, and no third-party code in the app that collects data.
• We don’t sell personal data, and we don’t share it for advertising.

Legal bases (EU and UK)

Under the GDPR and UK GDPR, we rely on these legal bases for the data we handle ourselves:

We don’t currently rely on consent for our own processing. The optional features that send data from your Mac are turned on by you, and they send data directly to providers you choose.

Providing your email and order details is needed to buy and use a license. Everything else is optional.

How long we keep data

• License records: as long as your license exists, so you can activate it again later. When you deactivate a Mac, its entry is removed. After a refund, the license is deactivated, and we keep the record only as long as we need it for accounting and to prevent refund abuse.
• Order records: as long as tax and accounting law requires, usually 6 to 10 years depending on the country.
• Server logs with IP addresses (license and download servers): up to 30 days, unless we need them longer to look into abuse.
• Support emails: up to 2 years after your last message.
• Website: Cloudflare keeps its logs under its own policy. Analytics are totals only.
• On your Mac: you decide, using the settings described above.

You can ask us to delete your license record. We will, but we then can’t activate or restore that license for you.

Who we share data with

• Our processors, who handle data only on our instructions: the hosting provider for our license and download servers, Cloudflare for this website, and our email provider.
• Paddle, as described above. Paddle is an independent controller.
• Authorities, only when the law requires it.
• A buyer of Belltongue, if the app is ever sold. They would take over the license records and would have to respect this policy.

We don’t sell personal data or share it for advertising.

International transfers

We and our providers may process data outside your country. Some of our providers, such as Cloudflare, are based in the United States. Where EU or UK law requires it, we rely on an adequacy decision (for example the EU–US Data Privacy Framework and its UK extension, for certified providers) or on safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. Email us for a copy of the safeguards that apply.

Your rights

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it;
• delete it;
• limit how we use it, or object to uses based on legitimate interests;
• send it to you or another company in a common format.

Email [email protected]. We may ask you to confirm that you control the purchase email. We answer within the time the law sets, usually one month. Requests are free.

Some data isn’t ours to hand over:

• Data on your Mac is in your hands. We can’t see it. Use the app’s settings, or delete the folders listed in What stays on your Mac.
• Payment data held by Paddle: contact Paddle at [email protected].
• Text you sent to a cleanup provider: contact that provider.

EU and UK

You can complain to a data protection authority. In the EU, that is usually the authority in the country where you live or work (list of EU authorities). In the UK, it is the Information Commissioner’s Office. We’d appreciate the chance to fix things first, so please email us.

United States and California

US state privacy laws such as the California Consumer Privacy Act (as amended by the CPRA) may not apply to a small seller like us. We follow these practices anyway, and anyone can make these requests.

In the last 12 months, we have collected these categories of personal information:

• Identifiers: email address, license key, App Store transaction ID, hashed device identifiers, IP address.
• Customer records and commercial information: name (if given), country and postcode, order details.
• Internet activity: technical details of requests to our servers and website.

Sources: you, your Mac (when the app talks to our servers), and Paddle. Purposes: the ones in Legal bases. We disclose this information only to the service providers listed in Who we share data with, for those purposes.

• We don’t sell personal information or share it for cross-context behavioral advertising.
• We don’t collect sensitive personal information. Your voiceprint stays on your Mac and never reaches us.
• You can ask to know, correct or delete your personal information. You can use an authorized agent. We won’t treat you differently for using these rights.

Mainland China

Under the Personal Information Protection Law (PIPL), you can ask to see, copy, correct, complete or delete your personal information, ask us to explain how we handle it, and ask to transfer it. Email us to do so.

• Cross-border transfer. Our license server and Paddle are outside mainland China. When you buy and activate Belltongue, your purchase email (or, for App Store purchases, the App Store transaction ID), license key, hashed device identifiers and IP address go to them for licensing. The overseas recipients are Cloudflare, Inc. (United States), which hosts the license server on our behalf, and Paddle for payment data (see “Paddle” above). We remain responsible for this data; contact us at [email protected].
• On-device processing. Your speech, dictated text and voiceprint are processed only on your device and are never provided to us.
• Sensitive personal information. PIPL treats biometric data as sensitive. Your voiceprint is created only when you turn the feature on, stays on your device, and is never provided to us or anyone else. For that reason, we don’t ask for separate consent to handle it.
• Cleanup providers. If you choose a provider, the text you send is handled under that provider’s rules, in the country where it stores data.

If PIPL requires us to appoint a representative in mainland China, we will list their details here.

Children

Belltongue isn’t aimed at children under 16, or under 13 in the United States. We don’t knowingly collect personal data from children. If you think a child has sent us personal data, email us and we’ll delete it.

Security

• Speech, text and voiceprints stay on your Mac. In the iPhone app, speech and text stay on your iPhone.
• API keys live in the macOS Keychain, or the iPhone’s Keychain in the iPhone app.
• Traffic to cleanup providers, our servers and model publishers uses HTTPS. The iPhone microphone link on your local network is encrypted with keys set up when you pair.
• We store hashed device identifiers, not raw hardware IDs.
• We keep as little data as we can, and limit who can reach it.

No system is perfectly secure. If you find a security problem, please email [email protected]. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Changes to this policy

If the app or the law changes, we’ll update this page and the date at the top. For important changes, we’ll also say so in the changelog before they take effect.

Contact

Questions or requests: [email protected]. By post: Guohui Lin, Xitian Plastic Factory, Lane 3, Huancheng 1st Road, Huangbu Town, Huidong County, Huizhou, Guangdong 516353, China. More ways to reach us are on the contact page.