Privacy Policy

Last updated: September 14, 2026

1. Controller

Kevin Chromik
c/o Online-Impressum.de #4495
Europaring 90
53757 Sankt Augustin, Germany
Email: hi@kchromik.com

2. Overview

This privacy policy covers the WhisperBar application, this website, and purchases of WhisperBar. The app processes speech locally on your device. The following sections distinguish the app's local processing from data processed when you visit the website or make a purchase.

3. WhisperBar Application

Speech recognition and text enhancement using the built-in models run locally on your Mac. We do not receive your audio recordings or locally processed transcriptions through these features. The app does not include the website's analytics integration. Temporary audio files are automatically deleted within 24 hours.

If you choose an optional CLI integration for text enhancement, the text and instructions are passed to the tool you configure. Depending on that tool, they may be sent to its provider for processing. The data handling and account terms of the provider you choose apply to that integration.

An internet connection is used for model downloads and license activation. Purchase-related processing is described in section 6.

4. Website Hosting

This website is hosted using IONOS Deploy Now. When you visit our website, the hosting provider processes the technical information needed to deliver the pages and may store it in server log files. This may include:

This data is processed based on our legitimate interest in ensuring the secure and efficient operation of our website (Art. 6(1)(f) GDPR). It is used to deliver website content, diagnose faults, and investigate security incidents.

According to the IONOS Deploy Now documentation, access logs are kept available for a maximum of eight weeks.

5. Locally Hosted Fonts

The Outfit font is served directly by our website's hosting provider. Loading this font does not connect your browser to Google Fonts or Google's font servers. The hosting information in section 4 applies to these requests.

6. Payment Processing (Lemon Squeezy)

We use Lemon Squeezy (Lemon Squeezy, LLC) as our Merchant of Record to process purchases. When you buy WhisperBar, your payment and personal data (such as name, email address, and payment information) are collected and processed directly by Lemon Squeezy.

Lemon Squeezy acts as the Merchant of Record, meaning they are the legal seller and handle all payment processing, invoicing, tax collection, and refunds. We receive your name and email address to deliver your license key but do not have access to your full payment details.

The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). For more information, see Lemon Squeezy's privacy policy: https://www.lemonsqueezy.com/privacy.

7. Website Analytics (Self-Hosted Plausible)

We use Plausible Community Edition to understand how visitors use this website and improve its content. We operate the analytics service ourselves at track.kevinchromik.de on a VPS located in Germany. This website analytics integration does not run inside the WhisperBar app.

The server infrastructure is provided by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Website analytics requests are sent to our instance on the German VPS. We do not use Plausible's cloud service for this website.

The website measurements include:

The configured script also supports counting form submissions without reading form field contents; this website currently has no submission forms. A click on a checkout or download link is a website interaction and does not confirm a completed purchase or download. Audio, transcriptions, license keys, and payment details are not sent by this analytics integration.

Analytics requests include the page URL and referrer, together with the IP address and browser information sent with HTTP requests. Plausible processes the IP address and user-agent to derive the statistics and a daily visitor identifier. The identifier uses the website domain and a salt that rotates every 24 hours. Plausible does not retain raw IP addresses or full user-agent strings in its analytics database. Page URL query parameters are discarded during analytics processing, except for supported campaign parameters.

Plausible does not set analytics cookies or store persistent visitor identifiers in your browser. We use the statistics to evaluate website traffic, not to create advertising profiles or follow visitors across websites.

To the extent that personal data is processed to produce these statistics, we rely on our legitimate interest in understanding and improving the use of this website (Art. 6(1)(f) GDPR). You may object for reasons relating to your particular situation by contacting hi@kchromik.com. See section 9 for your other rights.

Storage Periods and Technical Logs

Analytics events and statistics currently have no automatic time-based expiry. They remain in our analytics database until we delete them. The daily rotation of the visitor-identifier salt does not delete these statistics after 24 hours.

The reverse proxy runs on the same VPS. Its visitor access logging is disabled. Its separate operational logs currently have no configured automatic expiry or file-size limit. Operational logs can contain technical connection details when errors occur; the absence of access logging does not mean that no technical logs exist.

The standard output and error logs of the Plausible application and its database containers rotate at a configured size of 10 MB, with three files retained per container. Additional database diagnostic files rotate at 1,000 MB with a configured file count of ten. These size limits do not define a fixed retention period in days. Database query logs use a 30-day expiry rule, with deletion performed by the database in the background.

More information about the software's data processing is available in the Plausible data policy. Hostinger's infrastructure processing is described in its Data Processing Addendum.

8. Cookies and Browser Storage

This website does not set any cookies. If you are redirected to Lemon Squeezy for payment, their website may use cookies as described in their privacy policy.

When you select a language, the website saves that preference in your browser's local storage to remember your choice on later visits. This storage serves your requested language setting (§ 25(2)(2) TDDDG). The preference remains on your device until you change it or clear the website's stored data. It is not used to identify you or analyse your browsing behaviour. If your browser blocks this storage, you can still use the website and switch languages for the current page.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at hi@kchromik.com.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) if you believe that the processing of your personal data violates the GDPR.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal reasons. The current version is always available on this page.