← Back to Cotype

Privacy Policy

Last updated: August 14, 2026

1. Who we are

Cotype is a desktop application for macOS and Windows and related services (the “Service”) operated by Shiney Inc, a Delaware corporation (“Shiney”, “we”, “us”). This policy explains what information we collect, how we use it, and the choices you have. It covers both the Cotype desktop app and our website.

Shiney Inc is the data controller for the personal data described in this policy. Our registered address is: 2810 North Church Street, Wilmington, DE 19802, USA.

Questions or requests about your data: support@cotype.io.

2. Information we collect

Account information

We collect your email address to create your account and sign you in. Cotype uses passwordless magic-link login, so we never store a password. If you join the pre-launch waitlist, we store the email address you submit until launch invitations are complete, and we delete it on request via support@cotype.io.

Voice recordings

When you trigger dictation, Cotype records audio from your microphone and sends it to our servers for transcription. Audio is processed in memory to produce a transcript and is not stored on our servers after transcription completes. Recording only happens when you actively invoke a hotkey. The app does not listen in the background.

Transcripts and generated text

Transcripts of your dictation, text you select or provide as context, and AI-generated drafts are processed to provide the Service. We store a history of your transcriptions and generations in your account so you can review and reuse them. You can delete history items at any time from the app.

Personalization data

To make output sound like you, we store settings you configure, custom dictionary entries, writing-style samples, and knowledge or rules you add to your account.

Billing information

Payments are processed by Stripe. We never see or store your full card number. We keep records of your subscription status, plan, and usage against your plan’s quota.

Usage and diagnostic data

We collect basic usage metrics (for example, how many transcriptions you run, for quota enforcement) and error reports (via Sentry) that may include device and app-version information, to keep the Service reliable. We also process your IP address for session security and abuse prevention (a legitimate interest), and it appears in short-lived server logs.

Website analytics and cookies

Our website only sets non-essential cookies with your consent. When you first visit, a banner lets you accept or reject cookies per category: analytics (Google Analytics and Google Tag Manager, to understand traffic) and marketing (Meta Pixel and Google Ads signals, to measure advertising). These tools may collect your IP address, device information, and pages visited. If you reject them, none of these scripts load. We also use Vercel Analytics, which is cookieless and collects only aggregated, anonymized page statistics. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer, and additionally control cookies through your browser settings or your ad settings with Google and Meta.

3. How we use your information

  • To provide the Service: transcribe your speech, generate text, and paste it where you’re working.
  • To personalize output to your tone, vocabulary, and preferences.
  • To manage your account, subscription, billing, and usage quotas.
  • To send transactional emails such as magic sign-in links and billing notices.
  • To monitor, debug, and improve reliability and performance.
  • To prevent fraud and abuse and enforce our Terms of Service.
  • To comply with legal obligations.

4. Legal bases for processing

Where the GDPR applies, we rely on the following legal bases:

  • Performance of a contract: providing the dictation and reply service, managing your account, and billing.
  • Consent: non-essential cookies and analytics on our website, and marketing communications.
  • Legitimate interests: keeping the Service secure, preventing fraud and abuse, and diagnosing errors.
  • Legal obligation: keeping tax and accounting records.

5. AI processing: no training on your content

Your audio is transcribed and your text is generated using third-party AI providers via their APIs: currently Groq for speech-to-text, and Anthropic, OpenAI, and Google (Gemini) for text generation and analysis, with some requests routed through OpenRouter. Under the API terms we use with these providers, your content is not used to train their models. We do not use your voice recordings, transcripts, or generated text to train AI models either.

6. Service providers

We share data only with providers that help us run the Service, under contracts limiting their use of it:

  • Groq: speech-to-text transcription of your audio and AI processing.
  • Anthropic, OpenAI, and Google (Gemini): AI text generation and analysis.
  • OpenRouter: routing of some AI requests to the providers above.
  • Composio: connectivity for optional email and calendar integrations you connect.
  • Firecrawl: fetching web pages you reference for knowledge features.
  • Stripe: payment processing.
  • Resend: transactional email delivery (magic links).
  • Fly.io and MongoDB: application hosting and database.
  • Sentry: error monitoring.
  • Vercel, Google, Meta: website hosting, analytics, and advertising measurement.
  • Cloudflare, Inc.: video hosting and streaming for embedded product videos on our website (may receive your IP address when a video loads).

We do not sell your personal information. We may disclose information if required by law, to protect our rights or users’ safety, or as part of a merger or acquisition (in which case this policy will continue to apply to your data).

7. What stays on your device

Clipboard contents, simulated keystrokes, and the act of pasting text into other apps happen locally on your computer. Cotype reads your screen or clipboard only when you invoke it, and that content is sent to our servers only as context for the transcription or generation you requested.

8. Data retention and deletion

  • Audio recordings: not retained after transcription.
  • Transcription and generation history: retained until you delete it or your account is deleted.
  • Account, settings, and personalization data: retained while your account is active.
  • Billing records: retained as required for tax and accounting purposes.

You can request deletion or export of your account and associated data at any time by emailing support@cotype.io. We will verify that the request comes from the account owner, then delete your data within 30 days, including data held by our payment processor, except where retention is legally required. Residual copies in encrypted backups are removed within 90 days.

9. Security

Data is encrypted in transit (TLS) and at rest with our hosting providers. Access to production systems is restricted. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach affecting your data, we will notify you as required by law.

10. Your rights

Depending on where you live (including under the GDPR and the California Consumer Privacy Act), you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. We do not sell or share personal information for cross-context behavioral advertising as defined by the CCPA, and we do not discriminate against you for exercising your rights. To exercise any right, email support@cotype.io. If you are in the EEA or UK, you may also lodge a complaint with your local supervisory authority.

11. International transfers

We are based in the United States, and your data is processed there by us and by the service providers listed above. If you use the Service from the EEA or the UK, we transfer your personal data to the US under the EU Standard Contractual Clauses (and the UK equivalent safeguards) and, where a provider is certified, under the EU-US Data Privacy Framework.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or in the app before they take effect. The “Last updated” date above reflects the current version.

14. Contact

Shiney Inc, 2810 North Church Street, Wilmington, DE 19802, USA. Email: support@cotype.io