1. Overview
AttaBoy is built local-first: speech is transcribed on your Mac using on-device models, and your notes are stored on your device by default. This Privacy Policy explains what information we process, where it goes, and what choices you have.
Data controller: AttaBoy. Contact: hey@attaboy.app
2. Information we process
2.1 Voice and transcripts
When you record or listen, AttaBoy processes audio in memory to produce text transcripts, speaker-labelled dialogue, bullet points, and related note fields. We do not save raw audio files to your library or our servers — only the resulting text and metadata you see in the app.
2.2 Notes and tasks
Stored locally via SwiftData, including titles, transcripts, summaries, topics, action items, detected languages, duration, and soft-delete timestamps.
2.3 Account and sync (optional)
If you sign in with email, we collect your email address for authentication (one-time codes, no password). When sync is active, note and task data is replicated to our Supabase project so it stays consistent across devices signed into the same account. We also store basic device metadata (device identifier, host name, platform, hardware model, app version, last seen time) to manage sync.
2.4 API keys (optional)
If you enable AI features, your API keys are stored in the macOS Keychain on your device. They are sent only to the AI provider you choose — not to AttaBoy servers.
2.5 Preferences and diagnostics
Settings such as language, appearance, provider choice, and local token usage counters are stored in UserDefaults on your device. We do not run third-party analytics or advertising trackers in the app.
3. How we use information
- Transcribe and organize your spoken ideas
- Sync your notes and tasks when you use an account
- Authenticate you via email one-time codes
- Deliver app updates through Sparkle
- Improve reliability and security of the service
We do not sell your personal information. We do not use your note content to train AI models.
4. On-device processing
Speech recognition uses WhisperKit (OpenAI Whisper models) running on Apple Silicon. Speaker diarization uses FluidAudio on-device. Model files may be downloaded to your Mac on first use from third-party model hosts (for example, Hugging Face). That download does not include your personal recordings.
5. Third-party services
- Supabase — authentication and optional cloud sync when you sign in
- AI providers you configure — Anthropic, OpenAI, Google, xAI, Mistral, and others supported in settings; only when you add a key and trigger an AI action
- Sparkle / attaboy.app — update checks and installer downloads
- Apple frameworks — Calendar and Reminders when you grant permission and use scheduling features
When you use BYOK AI, the provider receives the prompts and note content required for that feature (for example, transcript text for summarization or chat). Review each provider's privacy policy before enabling keys.
6. Permissions
- Microphone — to transcribe what you say into notes
- Screen Recording — to capture system or call audio when you choose to record a conversation (not for screen video)
- Calendar / Reminders — to create events or reminders from dates and tasks in your notes
- Accessibility — only if you use the feature that pastes prompts into other desktop AI apps on your behalf
- Network — for sync, updates, model downloads, and BYOK API calls
7. Data retention and deletion
Local notes remain on your Mac until you delete them or erase your library in settings. Cloud copies remain until you delete them or close your account — contact us if you need help removing synced data.
Signing out stops sync on that device but does not automatically delete cloud data. Uninstalling the app removes local data unless iCloud or backups restore it separately.
8. Security
Sync and authentication traffic use HTTPS. API keys use the macOS Keychain. No system is perfectly secure; use strong device passwords and protect your email account if you enable sync.
9. International transfers
If you use cloud sync or third-party AI providers, your data may be processed in countries where those services operate (including the United States and the European Union). We rely on appropriate safeguards offered by those providers where applicable.
10. Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, or to object to certain processing. Contact hey@attaboy.app to exercise these rights. EU/UK users may also lodge a complaint with their local data protection authority.
11. Children
AttaBoy is not directed at children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information.
12. Changes
We may update this policy and will post changes at attaboy.app/privacy with an updated date.