Privacy Policy

What changed on 12 November 2026: we now say what the Translate page on app.windyword.ai and our servers record about your translations, never the text, and how long we keep it (sections 2, 7 and 8); we now say that the Windy Fly phone app does not have the Help improve switch yet (section 2); the Windy Vault activity log, including the activity list for your connected Google account, will be kept 24 months, not 13 (sections 4b and 7); we list every company whose own key you can connect, and what happens when that company does not answer (section 8); we no longer call our database backups encrypted, and we say that our hosting provider keeps whole-server backups for about 14 days (sections 5 and 7); section 4e now says what we keep when someone texts STOP; section 7 now says what closing your Windy account does to your Windy Calendar data; and texts sent to your helper's number are now erased together 30 days after the first one arrived, never later (sections 4e and 7). Section 8 now says that on iPhone, voice typing in the Windy Fly app and the Windy keyboard uses Apple's speech recognition, which Apple may run on its own servers.

Windstorm Labs LLC ("we", "us") provides Windy Word, including the Windy Fly phone app. This policy explains what we receive, what we do not, and what you can do about it.

---

1. The short version

Windy Word transcribes speech on your device, using engine files stored on your computer. Dictating does not require an internet connection, and when you dictate locally your audio and the resulting text stay on your machine.

We do receive measurements about how the app is used — how long, how often, how long each dictation runs, which engines and languages you choose, what kind of machine you run it on, and approximately where you are (country, region, and city or metro area, from your network address). Measurements are about usage, not about what you said.

Optional cloud features work differently, and section 4 says how. Windy Vault, when it opens and if you use it, will hold secrets for you (section 4b). Windy Mail will keep an address book for you if you turn it on (section 4c). The helpers (AI agents) you create will also have a housing history, a record of the machines they run on (section 5a; coming soon).

We have tried to write this without absolutes. Instead of promising that something can never happen, we describe how the system is built and what we do if something goes wrong (section 9).

2. What the app sends us

For the local app, the app reports:

Category	Examples
Account	Your Windy account identifier; whether your email or phone is confirmed
Usage volume	Hours of use per day and per week; number of dictation sessions; total words produced (a count, not the words); for each translation, how many characters it had (a count, not the text)
Activity state	Whether the app is actively in use or idle
Recording characteristics	Length of each dictation (a duration, not the audio); average and distribution of lengths
Configuration	Which engines are installed and selected, and the share of your dictation time each one accounts for; preferred and detected languages; translation language pairs used; app version; operating system and platform
Settings choices	Which options you have picked in the app — for example recording mode, paste behaviour, theme, widget, alert interval, audio and video quality settings, and which keyboard shortcuts are assigned (the assignment, never what you type with them)
Library size	How much space your local recordings and transcripts occupy on your own disk (a byte count and item count — the library itself never leaves your machine)
Clone Capture readiness	If you use Clone Capture: how many minutes of usable audio you have captured and coverage percentages — measurements of quantity and completeness, not the audio itself
Device characteristics	Processor family and core count; memory; graphics hardware and video memory; architecture; device model identifier (for example "MacBook Air M2"); number of displays; whether running on battery or mains; free disk space at install
Approximate location	Country, region, and city or metro area, derived from the network address your app connects from, plus your timezone and the local time of day you use the app
Machine condition during a dictation and in app health reports	How busy the processor and the graphics processor were, as percentages; how full the graphics memory was; and how hot the machine was, as a coarse state only (normal, warm, hot, or slowing itself down), where your system reports it. Measured around the moment of a transcription and in the app's periodic health reports, so we can tell a slow engine apart from a busy or overheating computer. These are readings only: never an exact temperature, and never a serial number or any other identifier of your hardware
Reliability	Crash and error reports (which error happened, as a code, and how often), performance timings, install and update outcomes, permission grants and denials. With Help improve Windy Word on, the app also sends short lines from its own log, automatically and without asking each time: with its regular health report, up to 12 of the warnings and errors it logged since the last report (and any still waiting when it quits), and, when the speech engine fails, the last lines the engine printed. Before those lines leave your computer, Windy Word removes your user name, your computer's name, email addresses, network addresses, the names you gave your files, what was passed to a command, long quoted text, any run of eight or more ordinary words, and text in non-Latin scripts. Windy Word 1.9.59 and earlier could include a file or folder name in such a line when a file could not be opened or saved. The full log stays on your computer
Notices	Whether an in-app notice was shown, dismissed, or acted on
Browser button	Whether each press of the Windy Word browser button worked and, if not, at which step and why (for example, the app was not running, or the page does not allow typing); the kind of box it was used in (a text box, a PDF, a browser-internal page, or other); and which browser brand and extension version. Whether the Windy Word extension is installed and switched on in Chrome on this computer: the app reads Chrome's own setting for our extension and nothing else in Chrome's settings, and sends only one of 'not installed', 'off', 'on' or 'unknown'. The measurement is sent by the Windy Word app on your computer; the extension itself sends nothing. Never the page address, site name, page title, field name, or anything you said or typed

What is not in that list: your audio, your dictated text, your transcripts, your translations, your clipboard, the names of your files, the identity of the applications you paste into (apart from the browser brand shown in the table above), or the contents of your screen.

This is enforced rather than merely intended: our measurement endpoint rejects events whose fields match content-like names — text, body, message, prompt, transcript, subject, completion and similar. An event carrying your words is refused by the server rather than stored.

You can turn this off. Settings ▸ Help improve Windy Word is on unless you turn it off, and the setup wizard explains it before you start. Turning this off stops the usage measurements. Windy Word still checks our servers for updates and for its settings (section 8); with the switch off, those checks carry no installation identifier. Delete my usage data, next to it, erases what was collected: it asks us to erase the usage measurements this installation has sent, and it works whether the switch is on or off. We keep a record that you asked, and of your on/off choice, but not the measurements themselves. The Windy Fly phone app does not have this switch yet. Until it does, it sends these measurements whenever it runs; you can stop them by uninstalling the app.

2a. Recordings on your computer

Unless you turn on a cloud feature (section 4), recordings you keep stay on your computer: by default Windy Word saves each recording's audio, including Clone Capture recordings, as a plain .webm file in your archive folder (Documents/WindyProArchive unless you choose another), and saves video only if you turn on Settings ▸ Save video recordings. These files use your computer's ordinary file permissions, and if your computer syncs Documents to iCloud, OneDrive or similar, that service may copy them too; that is your computer's setting, not ours. (On a Mac, Windy Word asks iCloud Drive not to upload the audio and video files in the default folder.) You can switch audio saving off in Settings ▸ Save audio recordings. Then no audio file is saved in your archive folder, and a video clip (if you save video) is saved without sound. The one exception is the private temporary safety copy described below, which Windy Word deletes on its own. Nothing deletes these files for you: to remove a recording, delete its file, or use the delete buttons in History (each removes the file it names: the transcript, the audio or the video; Delete All removes all three for that recording); deleting your account or uninstalling does not remove them. Delete my usage data erases only the usage measurements described in section 2, not the recordings on your computer. Voice samples recorded in Manage Voice Clones in earlier versions stay on your computer; Windy Clone does not accept voice uploads yet.

While you record, if Settings ▸ Keep an unfinished recording is on (on by default from version 1.9.59), Windy Word also keeps the recording in a private temporary file, so it can offer to finish it if the app closes unexpectedly or, from version 1.9.62, if you quit Windy Word while recording. This happens whether or not Save audio recordings is on: in /Users/<you>/.windy-pro/recording-spill on macOS and /home/<you>/.windy-pro/recording-spill on Linux, readable only by your account; in C:\Users\<you>\.windy-pro\recording-spill on Windows, private to your account by your user profile's normal permissions. That file is deleted as soon as your words are delivered, you cancel, or you choose Delete. If you choose Transcribe and no words come out, or you choose Not now, it is kept so Windy Word can offer it again the next time it starts, unless the recording is already saved in your Recordings Library (then Not now deletes the temporary file, because the recording is still there). Any temporary file older than 7 days is deleted the next time Windy Word starts. Windy Word does not upload it.

3. Approximate location — what we do and do not derive

We derive an approximate location — country, region, and city or metro area — from the network address your app connects from, together with your device's timezone. "Metro area" means a broad market region (for example, the Albany metro), not a neighbourhood and not a point on a map.

We do not collect GPS or precise location, we do not collect your street address, and we do not collect the identity of your wireless network. Location derived from a network address is approximate by nature: it is often wrong at city level, particularly on mobile networks, and we treat it accordingly.

We use it to understand which places the product is used in, which languages matter where, when during the day people dictate, and to make regional offers and announcements relevant to where you are.

3a. Device characteristics, and why we look at them

We record what kind of machine you run the app on — processor, memory, graphics hardware, architecture and device model — and which engines you actually use on it. The engines have very different speed and accuracy characteristics, and the only way we can recommend the right one for a given machine is to measure which ones perform well on which hardware in real use.

We identify the machine by model (for example "MacBook Air M2"), not by serial number, and each installation is associated with a randomly generated identifier rather than anything derived from your hardware. That identifier can be reset by reinstalling and is deleted when you delete your account.

When Help improve is on, two pages Windy Word opens in your browser carry this identifier: the welcome page after a first install, and the page behind the "Create a free account" card. That lets us connect the installation to that browser and, if you sign up or are signed in there, to your account. With the switch off, they open without it.

This section is about the Windy Word app on your computer. A helper's housing history is different and is described in section 5a, which will record some hardware details.

We also record how busy and how hot the machine was at the moment of a dictation, because without it the speed figures are unreadable. The same engine on the same laptop can transcribe twice as fast as you speak or three times slower, and the difference is usually that the computer was busy doing something else or had heated up enough to throttle itself. Measured on real machines, one engine fell from 4.9x to 1.5x for exactly that reason. Without knowing the machine's condition we would have blamed the engine and "fixed" the wrong thing.

This is a percentage and a coarse state — never a temperature reading tied to you, never a list of what else you were running, and never the names of other applications.

4. Optional cloud features

If you choose to turn on a cloud feature — cloud compute, Windy storage, or cross-device sync — then the content you send to that feature does leave your device, because that is what the feature does. When you use one:

• audio and text you submit are transmitted to our servers, and processed there or by a service provider acting for us (section 8 names them);
• content is encrypted in transit. Not all of our storage is encrypted at rest yet: the words you keep in Windy storage are stored as plain text in our database;
• content is retained per section 7 and deleted on request;
• you can stop using cloud features at any time and continue locally.

Cloud features are off unless you turn them on. We say this explicitly because "your words stay on your device" is only true of local use, and we would rather be accurate than tidy.

Windy does not keep training copies of your cloud transcripts, translations or audio today, except Voice Project donations you choose to make (section 4d). The training choices in your account settings apply from the day we start, and we will tell you before that happens.

4a. The browser extension

The Windy Word browser extension is a separate, optional install from the Chrome Web Store or Microsoft Edge Add-ons. The app works without it, and removing it from your browser removes everything in this section.

It runs on every website you visit, and we would rather explain that than bury it. The extension's job is to put a dictate button next to the message box you are already typing in. We cannot know in advance which sites those are — for you it may be a support desk, a hospital portal, or your own company's tools — so the extension asks to run on all https pages rather than keeping a list of approved ones. On each page it looks for the site's own microphone or composer, puts our button beside it, and otherwise does nothing.

The extension has no server of its own, and sends nothing to us. It talks to one place: the Windy Word application already installed on the same computer, over the browser's native-messaging channel — a pipe between two programs on your machine that does not cross the network. The messages it sends are the commands start, stop, state and level. They do not include the address of the page, its title, or its contents.

Specifically, the extension does not collect your browsing history, does not record which sites you visit, does not read pages for us, and does not run any code it downloads.

When you dictate through the button, the recording and transcription are done by the desktop app, so sections 1, 2 and 3 apply to them unchanged. The resulting text goes to the message box you clicked in — either typed in by the app or written directly into the editor by the extension. Your archive is the same local archive the app already keeps.

The permissions the browser shows you at install are used as follows: nativeMessaging to reach the desktop app; scripting and access to https pages to place the button; activeTab to act on the tab whose button you clicked.

4b. Windy Vault

Coming soon. Not available yet. Today no Windy product holds your secrets in Windy Vault or connects to your Google account. This section describes what Windy Vault will do when it opens, and we will update this policy if that changes.

Windy Vault will keep the passwords, tokens and keys you choose to store, and let your helpers use some of them for you without you pasting them anywhere. It will be off unless you turn it on, and you will agree to the Windy Vault terms first.

• What we will hold. Your items, encrypted (each with its own key); the names of the services you connect, which permissions you gave, and the connection details those services give us; an activity log of every time an item was used or changed (who, what kind of action, which item by an opaque reference, when, and whether it worked, never the secret itself); and the settings you choose.
• How it will be protected. Items will be encrypted before they are stored. Some items will be "agent-usable" (the default): the Vault can open them so your helper can work while you are away. Others will be "passkey-only" (your choice): only you can open them, and the Vault cannot. We will say "encrypted, used only through the Vault" for the first kind and we do not call it zero-knowledge.
• Who can reach it. The Vault will run on Cloudflare. The keys that let it work for your helpers will be held in the same Cloudflare account, so Cloudflare, and the one person who logs in to that account, could technically reach agent-usable items. Passkey-only items are not reachable that way. We do not read your items, and we will not give anyone else a way to. If a court or authority orders us to hand over agent-usable items we may have to, and where the law allows we will tell you first; passkey-only items we cannot open.
• Your helpers. A helper will get only what you approved: a short-lived token for one service (up to 15 minutes for GitHub and up to 1 hour for others), or, for services that only have a permanent key, the key itself under a logged lease. A token a helper already holds keeps working until it expires even if you revoke it, unless the service lets us cancel it. A tricked helper can misuse a token it legitimately holds for that time. Google is the exception: Windy Vault performs Google actions itself (sends the email, creates or changes the event); a helper never receives Google access.
• Copies. We may keep encrypted copies at Cloudflare (R2) and at Backblaze, and, if you choose, in Windy Git, Windy Cloud storage, GitHub or your own server. They will be unreadable without your keys. Your own recovery kit and your own storage copy will be able to open your lockbox on your own computer even if Windy disappeared.
• What we will send to Windy's own monitoring. Counts, timings and pseudonymous references (not your name, not the item, not the secret) so we can notice failures and abuse. This is a security measurement made by our servers; it does not depend on the "Help improve Windy Word" switch in section 2.
• Deleting. Disconnecting a service will delete our copy of its token. That does not cancel the token at that service unless the service lets us, and we will say which when you disconnect. If you delete your account, everything will be locked at once, and 30 days later we will destroy your keys, delete the copies we host, and remove our connections to your services. Encrypted backups can remain until they expire, and they cannot be opened once your keys are gone. Copies you keep in your own storage remain yours.

4b.1 Google data in Windy Vault

Coming soon. Not available yet. Today no Windy product connects to your Google account. This section describes what Windy Vault will ask for and do when the feature opens.

If you connect your Google account to Windy Vault, you will choose which of three permissions to give. We will ask for no others.

• Send email on your behalf (gmail.send). This will let Windy Vault send an email from your Google account when you or a helper you approved asks it to. It is a send-only permission: with it we cannot read, search or delete your email, and we will not ask for permission to.
• View and edit events on all your calendars (calendar.events). This will let Windy Vault create and change calendar events. Google does not offer a narrower permission that can only create and change events, so this one can also read and delete events on every calendar you can edit. We therefore will set it up so that the Vault makes the create or change itself and never hands a helper the raw token (Google access will never be handed to a helper); and deleting an event will always need your tap.
• View your availability in your calendars (calendar.freebusy). Windy may check when you are free or busy on your Google calendars, only to avoid double-booking you. Windy will see busy and free times, not event titles or details. When a helper asks whether you are free, Windy will tell it only the busy times.

What we will do with it. We will use Google data only to do what you asked in Windy Vault: send the email, create or change the event, or check when you are free or busy to avoid double-booking you. We will store the connection credential Google gives us, encrypted, and the details of the connection (which permissions, when connected). Windy Vault will not keep the text of an email you send, the details of an event it creates or changes, or free or busy results: it will keep only an opaque reference (Google's message or event id), what kind of action it was, whether it worked, a count and the time. The email address of the Google account you connect will be kept only as an encrypted label that only you can read. (Windy Calendar is a separate product: the busy times it uses are covered in its own section 7 rows.)

Who it will be shared with. Your Google data will not be sold, will not be used for advertising, and will not be shared with anyone except as follows: the calls we make to Google on your behalf; the people you or your helper address an email or invite to an event; the infrastructure providers in section 8 that run the Vault (they will hold only encrypted data and cannot use it for their own purposes); and where the law requires it. We will not use Google data to train AI models. When a helper you use asks Windy Vault to send an email or change an event, the result (for example that the event was created, or the times you are busy) will go back to that helper, and so to the AI model the helper runs on, as part of the feature you asked for. The Vault itself will not send your Google data to a model. Before Windy Vault opens, we will make sure that any helper of an owner who has connected Google uses, through Windy's routing service, only providers whose terms do not allow training on that content. If your helper runs on a model outside Windy, that model's own terms apply. We cannot promise how long a model provider keeps what it receives.

Who can read it. No one at Windy will read your Google data unless you ask us to, or it is needed for security or to follow the law.

How long. The credential will be kept until you disconnect Google or delete your account, then handled as above. Your activity list (the time, which helper, and the kind of action; never the message or event text) will be kept for 24 months, also after you disconnect (section 7).

How to stop it. Disconnect Google in the Vault part of your Windy profile page, and also remove Windy Vault in your Google Account permissions. Removing it at Google is what stops the credential working. When you disconnect, we will ask Google to cancel the permission and delete our copy of the credential; if Google cannot be reached we will still delete our copy and tell you to remove Windy Vault in your Google Account permissions.

Questions or concerns about Windy Vault or your Google data: write to privacy@windyword.ai, security@windyword.ai or legal@windyword.ai.

Limited Use. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. In plain words, we: (1) use Google user data only to provide or improve the Windy Vault features you can see and use; (2) do not transfer it to anyone, except to provide those features with your consent, for security (for example investigating abuse), to comply with the law, or in a sale or merger after your explicit prior consent; (3) do not let people at Windy read it, except with your explicit agreement for specific data, for security, to comply with the law, or in an anonymous aggregated form for running the service; and (4) do not sell it, use it for advertising (including retargeting or interest-based ads), use it to decide credit or lending, or use it to create, train or improve any machine-learning or AI model beyond your own personalised use of the feature.

4c. Your address book in Windy Mail

Coming soon. Not available yet. This section describes what will happen when you turn the feature on.

When you turn it on, Windy Mail will keep an address book for you. For each contact we will store the name, organisation, up to 10 email addresses and up to 10 phone numbers (with your own labels), where the contact came from (a phone import, learned from mail you sent, or added by hand), how many times you emailed them and when last, and when the entry was made or changed. We will not store photos, notes or birthdays. A search string made from the name and emails will be kept only to fill the dropdown when you type an address. A contact will be learned only from addresses you send mail to or reply to, never from mail you receive. A phone import will happen only when you tap Import. When you delete a contact we will keep its email address, with the date, so it is not added again by itself; adding it by hand clears that. Your helpers will not be able to read or change your address book. We will not share it. It will be kept until you delete a contact or your account (up to 20,000 contacts), and it will be included in your account export and removed when you delete your account, including those kept addresses.

4d. The Windy Voice Project (optional)

The Windy Voice Project (optional). If you turn on Contribute my voice, recordings you make while it's on are donated to train and test Windy's own speech models. It's off unless you turn it on, it's separate from everything else you agree to, and you can turn it off or delete your donations at any time. You must be 18 or older. Only donate your own voice, or the voices of people who have agreed to take part.

If you turn it on, we receive the recordings you make in Windy Word while it's on, and their transcripts. We store them separately from your account under a random donor code, keep them for as long as they're useful for training and testing our speech models, up to 24 months, and delete them within 30 days of your request. Our staff and contractors may listen to them to check transcripts, under confidentiality. We don't use them to identify you or to make a voice of you, we don't sell them, and we don't share them with anyone to train their own models. Legal basis: your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time; withdrawing doesn't affect what happened before. Deleting your Windy account also deletes your Voice Project donations, 30 days later.

Where donations are kept: in a private storage bucket in our own account with Cloudflare, Inc. (its R2 storage), located in Eastern North America.

4e. Texts to your helper's phone number (Windy Text)

If you connect your own Twilio account and give your helper a phone number, people can text that number. Here is what we keep.

What we keep. For each text, we keep its words, the time it arrived, and who sent it. We keep only whether it came from you or from one of your approved contacts, and their number with all but the last four digits hidden (for example "+1 •••-•••-0101"). We don't keep the full number with the message. The words are stored as plain text, not encrypted, in our database.

When. Texts from your approved contacts are always kept this way. Your own texts are kept this way only when your helper isn't connected to Windy Chat. When it is connected, your text goes straight to your helper and isn't kept here. Texts from numbers that aren't approved aren't kept at all.

Who can read them. Your helper reads them through its own sign-in, using its Eternitas passport. Other helpers and other people's helpers can't read them. Our staff who run the service could see them if they looked at the database directly. We don't share them and don't use them for anything else. You can't yet read or delete them yourself, and they aren't in your account export yet.

How long. We keep up to 100 texts for each helper; a new one pushes out the oldest. Reading a text doesn't remove it. All of a helper's texts are erased together, 30 days after the first of them arrived (even if newer texts have since pushed that one out); a new text doesn't extend that, so no text is kept more than 30 days. They can be removed sooner if the server runs short of memory.

When you disconnect or delete your account. Disconnecting your Twilio account stops new texts. It doesn't erase texts already kept; those go at the 30-day mark above. Deleting your Windy account erases them when the account is erased (30 days after you ask, or at once if you ask us to erase it immediately).

If someone texts STOP. If anyone texts STOP, or asks in another way to stop getting texts, to a number your helper texts from, we keep a scrambled fingerprint of their number, not the text, so that your helper doesn't text them again, even if you later approve them as a contact. It is removed if they text START, or when your Windy account is erased. If your helper texts through its own connection on the computer that runs it, that fingerprint is kept on that computer instead (if your helper has lost the key it uses for this, the number itself is kept there until the key is back), and in your helper's backups if you turned backups on, and it is removed there if they text START. Your helper's activity log on that computer keeps only the last four digits of their number, for 30 days.

5. Account data

We hold your name, email address, optional telephone number, confirmation status, password hash (we do not store your password itself), account creation and sign-in metadata, and entitlements.

Your devices. When you sign in to Windy Word on a computer, Windy may add that computer to the devices list kept in your Windy account: a random ID made on that computer, a plain name such as "Windy Word on macOS" or "Unknown Device" (never your computer's name or your user name), its system, and when it was added and last seen. The list is erased with your account.

Your email address is your recovery channel. Confirming by text message does not replace it: password reset and account recovery are available only by email.

Windy Mind keys. A Windy Mind key lets an app or helper use Windy Mind for you. We keep only a scrambled fingerprint of it, never the key itself, plus when it was made, when it was last used and when it expires. Every key has an end date.

Your own AI provider keys. If you connect your own AI provider key, Windy Mind stores it encrypted, bound to your account, and uses it only for your own calls to that provider, under your contract with them. We show you only its last few characters. The key that unlocks the vault is stored in a separate file, not in the database, but our hosting provider's whole-server backups of that machine (kept for about 14 days) can hold both. If you delete your account, your stored provider keys are deleted 30 days later. Backups that may still hold them expire within 90 days.

5a. Your helper's housing history

Every helper will have a record, kept by Eternitas (the registry that issues helper numbers), of the machines it runs on and for how long, a bit like a credit file for a computer. It will help you see where your helper has lived, and help us investigate if a helper is used to do harm. Coming soon. Not collected yet. Everything below describes what will happen when it opens.

What we will record, for each machine: the network address the helper connected from; a scrambled machine identifier; the kind of machine (laptop, desktop, server, phone or unknown); the operating system; the processor type (arm64 or x86_64) and model; the graphics model; the type and size of storage; how it connects to the internet; whether it is a virtual machine; the version of the Windy software reporting; the machine's serial number, kept only as a scrambled fingerprint (the full serial number will not be stored in readable form), with its last four characters so you can recognise your own machine; and the dates it was first and last seen there. Anything the helper's software cannot read is simply left out.

Where it will come from. (a) Eternitas will note the network address on three kinds of request from your helper only: when it gets a new access pass, when it registers a key, and when it sends a housing report. It records a new address only when it changes. (b) Your helper's software (Windy Fly or Windy Connect) will send a hardware snapshot when it starts and when something changes, at most once a month. We will not ask you each time.

Who will see it. You will see the details for your own helpers. The public will see only the kind of machine and how long (for example "laptop, 6 months"), never an address, model or serial. Other Windy products will not receive it. Windy staff will not read it unless you ask us to, or it is needed for security or to follow the law.

How long. Network address records: 13 months, then deleted on a rolling basis. Hardware snapshots: for as long as the helper's number exists.

When a helper is deleted. We will not erase the record. The details will be sealed with the rest of the helper's history: you and the public will stop seeing them, and no part of our service shows them. Today there is no way to open sealed details; if we ever build one, it will be only for an investigation of misuse, and we will describe it here first. The kind of machine and how long will stay visible.

Your own network address. A network address can identify you or your household. We will not sell it or use it for advertising.

6. Communications, and how consent works

Service messages — account, security, billing and material service changes. These are part of operating your account and are not marketing.

In-app notices — from time to time, dismissible.

Marketing email and text messages — sent only if you opt in. At signup this is a separate, unticked checkbox, not something bundled into accepting the Terms. You can withdraw at any time from account settings, by the unsubscribe link, or by replying STOP to a text. Withdrawing marketing consent does not affect your free local licence or your ability to use the app.

We keep this separate on purpose. Under GDPR consent must be freely given, specific, informed and unambiguous, and consent buried inside accepted terms does not qualify. US law requires separate express written consent for marketing texts. A single "I agree" covering both verification and marketing would not be valid in either place.

7. How long we keep things

Data	Retention
Account record	While your account exists; deleted on request, subject to legal retention duties
Usage measurements	Aggregated; identifiable form kept no longer than 24 months
Crash and error reports	12 months
Recordings on your computer (audio, and video if you turn it on, in your archive folder; section 2a)	Kept on your computer until you delete them. We do not receive them unless you use a cloud feature
Unfinished-recording temporary file on your computer (section 2a)	Until your words are delivered, you cancel, or you choose Transcribe or Delete; one left over for more than 7 days is deleted the next time Windy Word starts
Cloud content (if you use cloud features)	Until you delete it, or account closure. Deleted items sit in the trash for 30 days. After that they are removed from the live service. Backups of our database can still hold the text of deleted words for up to 90 more days. Media copies are normally removed within about 8 days of the purge
Your helper's conversation history (what you and your helper said to each other, including its replies, which can mention people you know)	Kept in your helper's own memory, on the computer that runs it, with no automatic expiry yet. If your helper has its own backup key, a copy is backed up to Windy Cloud each day. Windy Cloud keeps the last 5 copies: each new copy removes the oldest one (from the second copy, held at another company, about 7 days later), and if new copies stop arriving, the last 5 are kept with no set end date yet. You cannot yet delete single messages
Translation history	12 months from each translation, or sooner if you delete it, clear your history, or close your account
Translation cache (the text of a translation, without your account details, kept to answer repeat requests faster)	Up to 1 hour, in memory only; never written to disk
Cloud dictation service records (which engine, how long it took, whether it worked; never the audio or the text)	13 months
Cloud translation records (which languages, how many characters, how long it took, whether it worked and if not why; never the text)	24 months; removed about 30 days after you delete your account
Voice Project donations (only if you choose to donate)	Up to 24 months; deleted within 30 days of your request
Marketing preferences and consent records	Kept as evidence of consent while relevant, and after withdrawal as evidence that you withdrew
Text-message and call consent proof (a protected fingerprint of the phone number, not the number itself; whether consent was given or withdrawn; how and when; and which consent wording was shown. It holds no names or message content)	4 years, then erased automatically. It stays after you delete your account, so that we can show consent if it is ever disputed
Texts sent to your helper's phone number (Windy Text; section 4e): the words, arrival time, and the sender with all but the last 4 digits hidden	Up to 100 per helper, for at most 30 days (all erased together 30 days after the first one arrived), or until your account is erased, whichever is first
Windy Calendar: your own calendar (your booking page, event types, availability and blocked times, reminder settings, your bookings, and the permissions you gave your helper)	Kept while your calendar exists. Hiding your booking page deletes nothing. Closing your Windy account takes your calendar offline at once and erases it when the 30-day undo window ends; we can't yet erase it sooner on request. Questions: privacy@windyword.ai
Windy Calendar: details of people who book you (name, email, phone, time zone, and the note they leave)	Until 180 days after the appointment ends, then erased; we keep only that an appointment took place, its time and its status. Closing your Windy account erases them, and those appointment records, when the 30-day undo window ends, if that comes first. We can't yet erase them sooner on request
Windy Calendar: busy times from another calendar you connect (only when you are busy, never what the event is)	The next 60 days only, refreshed about every 30 minutes; deleted at once when you disconnect it. The private link you gave us is stored encrypted, with its key kept outside our database, and deleted at the same time. Closing your Windy account stops the refresh at once and erases both when the 30-day undo window ends
Windy Calendar: people you invite to a meeting (name, email, and whether they accepted)	Until 180 days after the meeting ends, then erased. Sooner if you close your Windy account (erased when the 30-day undo window ends, if that comes first), or if that person presses "Forget me" on their invitation, which erases their address from every invitation, at every calendar
Windy Calendar: "don't email me again" requests from people you invited	Only a scrambled fingerprint of the address, never the address itself. Kept so that we never email that person again; it is not erased
Windy Calendar: booking-attempt records, used to stop abuse (a scrambled fingerprint of the network address, and one of the email address entered)	Kept for the 24-hour abuse window, then removed the next time someone tries to book on that calendar, so on a quiet calendar they can stay longer
Windy Calendar: activity log (what was done in your calendar, and when; never the details of the people who book you)	365 days
Windy Calendar: erased data in our database provider's recovery history (Cloudflare)	Up to 30 days after it is erased, then gone
Windy Mail address book (coming soon): contacts and the list of deleted addresses	Until you delete them or your account; included in your export; erased with your account
Helper housing history (coming soon): network addresses seen	13 months, rolling; a deleted helper's are sealed rather than deleted (section 5a)
Helper housing history (coming soon): hardware snapshots (machine kind, operating system, processor, graphics, storage, connection, virtual or not, version of the Windy software reporting, scrambled identifier and serial with last four characters, dates)	For as long as the helper's number exists; sealed, not erased, when the helper is deleted
Windy Vault (coming soon): your items (encrypted), the services you connected and the permissions you gave	Until you delete them or disconnect; then handled as in 4b. If you delete your account: locked at once, destroyed after 30 days
Windy Vault (coming soon): activity log (who, what kind of action, which item by reference, when, whether it worked)	Kept 24 months, then deleted. To prove the log was not changed, we keep, for as long as the Vault runs, a scrambled reference for each account and a fingerprint of its last deleted entry; never the item, the secret or what was done.
Windy Vault (coming soon): monitoring counts and pseudonymous references sent to Windy's monitoring	Will be kept 90 days
Windy Vault (coming soon): encrypted copies at Cloudflare and Backblaze, and in storage you choose	The Backblaze copy will have a 90-day lifecycle; others until you delete them or close your account. Copies in your own storage remain yours

Our hosting provider also keeps whole-server backups of our main server for about 14 days. They hold whatever was on that server, including data you have since deleted.

8. Who else is involved

We use service providers to operate the Service, including hosting and content delivery, email delivery, text-message delivery, payment processing for paid features, and error and usage measurement. They act on our instructions and are bound by contract.

Today, cloud features use:

• Cloud dictation (speech recognition): the audio of cloud dictation, and of spoken translation, is turned into text on Windy's own servers, unless your computer has your own key for an outside speech service (see "Your own AI keys" below).
• Voice typing in the Windy keyboard on Android. On Android, voice typing in the Windy keyboard uses your phone's built-in speech service (usually Google's), under that company's terms.
• Voice typing on iPhone. On iPhone, the microphone buttons in the Windy Fly app (in a message, in mail and on the Quick Dictate screen) and the microphone key on the Windy keyboard (it opens the Windy Fly app to listen) use Apple's built-in speech recognition, under Apple's terms. Depending on your iPhone and its language, Apple may do this on your iPhone or on Apple's servers. Recordings you make in the Word tab are turned into text by the Windy Fly app on your phone, not by Apple.
• Text translation. Your text is translated on Windy's own computers. If a language pair is not available there yet, or they are busy, Windy tells you so instead of sending your text anywhere else, unless you turn on the My AI switch described below. When a translation fails, our servers record which languages it was between, how long it took and why it failed, tied to your account; never the text.
• Your AI helper (its replies in Windy Chat and the other places your helper answers): what you say to your helper is sent, through Windy's own routing service, to Windy's own computers to get its answers. When they are busy, your helper may take longer or tell you it could not answer just now; it does not send what you said anywhere else. If you connect your own key for Anthropic, OpenAI, Google Gemini, xAI, Groq, Cerebras, SambaNova, OpenRouter or Cloudflare under Connections, requests that use it go to that company under your own agreement with it. OpenRouter passes each request on to the company that runs the model you picked, under OpenRouter's own terms. You can also connect your own Kimi or GLM account; Windy asks you to agree first, in its own box, and requests then go straight to that company, not through any other service. Kimi is run by Moonshot AI PTE. LTD., a company in Singapore with no parent company named in its own terms. It stores what it receives on servers in Singapore, keeps what you send it (and your account and payment details) for as long as your Kimi account is open, and may use what you send to develop and improve its services unless you have a written agreement with it that says otherwise. GLM is run by JINGSHENG HENGXING TECHNOLOGY PTE. LTD., the company in Singapore behind Z.ai, with no parent company named in its own terms either. For API use like this, its own terms say it does not store what you send or what it writes back, processing it only in real time. The My AI switch "Use outside AI companies for more free capacity", off unless you turn it on, lets your AI helpers and agents, and translation, also use Groq, Inc.; Cloudflare, Inc. (Workers AI); OpenRouter, Inc. (its free models); Google's free Gemini tier; and NVIDIA's trial service. Google and NVIDIA may use what your helpers and agents send to improve their models; they never get what you translate. You can turn the switch off, or disconnect your own key, at any time. If a request that uses your own key does not get an answer from that company (for example, the key has hit a usage limit, the company does not accept the request, or it does not answer), Windy may answer it instead on Windy's own computers or, only if the switch is on, through one of the outside companies above. Each provider's own terms govern what it does with a request it receives, including how long it keeps it. Windy's routing service keeps none of the words. For each request it keeps a record without them (for example its size, cost, model, provider and time) for 13 months, and it keeps daily totals of your use while your account exists. The notice shown when you hatch a helper says the same in short. If you delete your account, Windy Mind removes everything in its records that identifies you about 30 days later: your usage totals, your agents' settings and your saved keys. What remains are anonymous request counts that cannot be traced back to you. Backups that still hold the old records are deleted within 90 days.

• Cloudflare, Inc. will run the computers and the storage (R2) for Windy Vault. It will hold encrypted items and, as section 4b says, could technically reach the keys that let the Vault work for your helpers.
• Backblaze, Inc. will hold an encrypted backup copy for Windy Vault.
• GitHub, Inc., and the other services you connect (for example Cloudflare, Google) will receive the requests the Vault or your helper makes on your behalf, under their own terms.
• Google LLC: see 4b.1.

Downloading engines and languages. The engines and offline languages you add, on your computer or in the Windy Fly phone app, are downloaded from our own download server or from Hugging Face (huggingface.co), where our models are published. Like any website, the server you download from sees your device's IP address, which file was requested and, from the Windy Fly phone app, the app's name and version. We send it nothing else that identifies you. Versions of Windy Word before 1.9.60 also sent your Hugging Face sign-in token, if you had saved one on that computer, to Hugging Face only.

Identifying a song. If you use Identify in the Sound Library, Windy Word sends an audio fingerprint of that clip and its length (not the audio itself) to AcoustID (acoustid.org) to look up the song. Windy Word 1.9.64 and earlier do this.

Setting up. When Windy Word is set up, and again after each update, its setup screen loads a typeface from Google Fonts (fonts.googleapis.com) and measures your connection by downloading a small test file from Cloudflare (speed.cloudflare.com). Like any website, they see your IP address. On Linux, setup can install missing system tools from your distribution's own package servers through your system's package manager.

Updates and settings. Whether or not Help improve is on, Windy Word asks our servers for updates when it starts and about once an hour, and for its settings when it starts and every six hours. The update check carries the app version and your operating system; the settings check also carries your language and plan. Our servers see your IP address.

The Translate panel. While it is open, the Translate panel asks app.windyword.ai for its list of languages and checks every 30 seconds that the service can be reached. These requests carry nothing that identifies you beyond your IP address.

The Translate page. When you translate on app.windyword.ai while signed in, the page tells us, for each translation, which languages you translated between, how many characters it had, how long it took and whether it worked, tied to your Windy account. It never sends the text itself. The page has no switch to turn this off. We keep these records for up to 24 months, and remove them about 30 days after you delete your Windy account.

Paying. Payments are processed by Stripe (stripe.com). Depending on where you choose a plan, its payment page opens in a Windy Word window or in your browser. It receives what you type there, and it uses fraud-prevention services of its own (such as hCaptcha). The account page that Windy Word opens also loads Stripe's script, which Stripe uses to detect fraud.

Our website. windyword.ai measures how it is used with our own measurement service (admin.windyword.ai): when a visit starts, and steps such as viewing or clicking a download and signing up. These measurements carry the kind of browser and device (operating system, browser family, screen width, number of processor cores and a rough memory size), your browser's language and a random identifier kept in your browser. If you sign up or sign in on the site, these can be connected to your account, and the welcome page Windy Word opens after installing can connect them to that installation. As with the app, we derive an approximate location from your network address (section 3). The site, and the account page Windy Word opens (app.windyword.ai), load their typeface from Google Fonts (fonts.googleapis.com). Cloudflare, which serves the site, sees your IP address.

Your own AI keys. Since version 1.9.60, Windy Word has no place to enter your own OpenAI, Groq or Deepgram key, but it still uses one that an earlier version saved, or one set in your computer's environment (OPENAI_API_KEY, GROQ_API_KEY or DEEPGRAM_API_KEY). Only when such a key is present: if your dictation engine is set to one of those companies (a choice only earlier versions offered), the audio of each dictation goes to it; in Quick Translate's Live Listen, with Local Only switched off, the audio, and then the text to translate, go to Groq or OpenAI when you choose a cloud model or when the engine on your computer fails; and when another program on your computer asks Windy Word to translate text, that text goes to Groq or OpenAI. Each goes directly to that company under your key. The Translate panel does not use these keys.

We do not sell your personal data. We do not share it with data brokers.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

9. If data reaches us that should not have

Systems fail and people make mistakes. Rather than promise this cannot occur, here is our commitment if it does:

1. We will stop the flow as soon as we identify it.
2. We will delete the affected content, and confirm deletion with any processor that received it.
3. We will notify regulators and affected users where the law requires, within the time limits it sets.
4. We will publish what happened and what we changed.

This is a description of our process, not an admission that it has happened.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to processing of your personal data, to withdraw consent, and to complain to a supervisory authority. Residents of the EU/EEA and the UK have these under GDPR; residents of India have comparable rights under the DPDP Act; residents of California and several other US states have rights under state privacy laws.

We do not require you to give a reason, and exercising these rights will not degrade your use of the app.

• Access and export: available in the app, or by request
• Deletion: available in the app, or by request. Your helper's conversation history cannot yet be deleted from the app; see section 7
• Marketing withdrawal: account settings, unsubscribe link, or reply STOP

Your helper's housing history (coming soon). You will be able to see and export the details of your own helpers' housing history from your account. Because of the purpose in section 5a, a deleted helper's housing details will be kept sealed instead of erased; if you ask us about them we will tell you what we hold and why.

Contact privacy@windyword.ai. We respond within the period applicable law requires, and within 30 days where no period is set.

For EU/EEA users, our representative is [EU REPRESENTATIVE — REQUIRED IF NO EU ESTABLISHMENT]. For India, our Data Protection Officer is [DPO — REQUIRED UNDER DPDP FOR SIGNIFICANT DATA FIDUCIARIES].

11. International transfers

We operate globally, so data may be processed in countries other than yours, including the United States. Where we transfer personal data out of the EU/EEA or UK we rely on appropriate safeguards such as Standard Contractual Clauses.

12. Children

The Service is not directed at children under 13. We do not knowingly collect their personal data. If you believe a child has created an account, contact privacy@windyword.ai and we will delete it.

13. Changes

We will post changes here and update the date above. For material changes we will give notice in the app, by email, or both before they take effect, and we will ask for fresh consent where the law requires it.

14. Contact

Windstorm Labs LLC, 333 E. Main Street Ste 962, Lehi, UT 84043 · privacy@windyword.ai