Privacy Policy

Yap is a product of O-mega Enterprise Inc. This Privacy Policy ("Policy") explains how O-mega Enterprise Inc. ("we", "us", or "our") collects, uses, discloses, and protects personal information when you visit or use the Yap website, applications, and related services (together, the "Service").

By using the Service, you acknowledge the practices described in this Policy. If you do not agree with this Policy, please do not use the Service.

The "Last updated" date shown with this Policy indicates when it was most recently changed.

O-mega Enterprise Inc. operates Yap and is the controller responsible for the personal information described in this Policy, meaning we decide how and why that information is used. Yap is the product name, not a separate legal entity.

If you have any questions about this Policy or about how we handle personal information, you can reach us using the details in the Contact Us section at the end of this Policy.

Desktop dictation. The Mac app transcribes recordings locally on your device. It does not upload audio to us. Audio is saved on your device only when you stop a recording with Esc: the recording is kept in your local dictation history until its text is ready, then deleted, or until you delete it. Completed text is stored in a local dictation-history database on your Mac, retained until you delete it from Dictation history. This history is not synced to our servers. The speech library and model are downloaded from third-party content hosts, which receive ordinary connection information such as your IP address. In the edition downloaded from our website, completed text is inserted into your active text field using macOS Accessibility permission, and dictation does not change the clipboard: only selecting Copy in Dictation history writes text to it.

Mac App Store edition. The edition from the Mac App Store also transcribes on your Mac and keeps its history there. App Store apps cannot type into other apps, so it copies each completed dictation to the clipboard for you to paste. Its subscriptions are sold and billed by Apple through your Apple Account: we receive no payment details, and this edition does not contact our servers for accounts or subscription checks. Apple tells our server when a subscription bought through the App Store (in this edition or the iPhone app) starts, renews, ends or is refunded: the plan, its dates and status, Apple's number for the purchase and the country of the App Store it was bought in. Apple does not give us your name, email address or payment details.

Accounts and free days. To dictate with an edition downloaded from our website, you create or sign in to a Yap account in the app with your email address and a 6-digit code we email to it, and your free days start with the account. Our server stores your email address, your account's free days and plan, a random identifier for each device you connect, a hash of a random credential the device created for itself, the device's operating system, and a keyed hash of the network address used when free days start (never the address itself), used only to limit how many free periods can start from one network. No audio, transcript text, device name or hardware identifier is sent.

Accounts and Mac activation. If you activate a subscription, our server stores your account, subscription status, a random device identifier, and a hash of the device activation credential. The Mac stores its credential encrypted using the macOS login keychain and receives a signed, time-limited access record. Subscription checks do not send audio, transcript text, your Mac’s name, or a hardware identifier. Payment details are collected by Stripe. You can revoke a Mac from your account without deleting its local dictation history.

Updates. The Mac and Windows apps downloaded from our website ask our server whether a newer version exists, and download it when one does. The request carries only the app's version, its operating system and its processor type, with the ordinary connection information every request has, such as your IP address: no account, audio or text. The Windows installer and its updates download from GitHub, which receives the same ordinary connection information.

Phone apps (Android and iPhone). The Yap apps for Android and iPhone recognize speech on the phone with a speech model downloaded once from Hugging Face, which receives ordinary connection information such as your IP address. Audio and dictated text are not sent to us, and the Yap keyboard sends nothing to us. On Android, the Yap button (which you can turn on in Accessibility settings, after the app explains it) uses Android's accessibility service only on the phone: to see whether a keyboard is open and where, and whether the text field you are typing in takes text and is not a password field, so the button can appear next to the keyboard; and to write your dictation into that field when you tap it (on Android 12 and older it reads that field's text and cursor position to insert the dictation at the cursor). It does not store, log or send anything it sees, never reads password fields, and acts only when you tap it. Dictation history stays on the phone until you delete it or the app. To dictate, you create or sign in to a Yap account with your email address and a code we email to it. Our server then stores your email address, your account's free days and plan, a random identifier for the phone, a hash of a random credential the phone created for itself, the phone's platform (Android or iOS), and a keyed hash of the network address used when free days start. In the edition from Google Play, a Yap Pro subscription is sold and billed by Google through your Google account: we receive no payment details, only the purchase's token, plan, status and renewal date, which our server checks with Google to link the subscription to your Yap account.

Days used. Each app connected to an account (Mac, Windows, iPhone, Android) tells our server, with its regular subscription check, the calendar days on which it finished at least one dictation and how many dictations it finished that day. Nothing else: never audio, dictated text, word counts, the apps you dictated into or the languages you spoke. We use it to know whether and how often Yap is used by each account. The Mac App Store edition and the browser extension do not send it.

Setup steps. Each Yap app for Mac, Windows, iPhone and Android tells our server how far its setup got, from its first launch on, before you have an account: that it opened, that the account screen appeared, that a sign-in code was requested and confirmed, whether the microphone and typing permissions were allowed or refused (and, on Windows, whether the microphone worked although Windows reported it as refused), when the speech model started downloading, was ready or failed, the first finished dictation, that setup was finished, how often the dictation key was pressed and a dictation finished with text, and when one ended without text, only why (the key was let go too soon, the microphone would not open or gave only silence, nothing was loud enough to hear, no words were recognized, recognition failed, or the words could not be typed where the cursor was), whether the app could listen for its dictation key, and how often the reminder that the free days end, the screen after them and a trial button were shown or tapped, each with the time it first happened. With it the app sends a random identifier it made for itself on its first launch, its version, which edition it is (from our website, the Microsoft Store or the Mac App Store), the system version, the device's model (such as "Mac14,2" or "iPhone15,2"; a Windows PC its processor type) and its memory size, with the ordinary connection information every request has, such as your IP address, of which we keep only a keyed hash. Once the device is connected to your account, its steps are linked to the account. Never audio, dictated text, the apps you use, your device's name or its serial number. We use it to see where setting up Yap gets stuck, and to fix it.

Deleting your account. You can delete your account in the apps (Settings, then Delete account) or on our website at https://yapapp.cc/account/delete. This removes your account and the data we keep for it at once and stops any subscription from renewing. We keep only your address on our do-not-email list, so we never write to you again.

Website voice demo. The demo requests microphone access only when you start it. Speech recognition runs locally in a worker in your browser. Audio and transcript text are not uploaded to us or a speech-recognition provider. The transcript stays in page memory until you clear it or leave. The speech library and model download from third-party content hosts, which receive ordinary connection information such as your IP address. Your browser caches the model files for reuse; recordings and transcripts are not stored in that cache.

Yap Voice Typing browser extension. The extension for Chrome, Edge and Firefox works the same way: it opens the microphone only after you press its shortcut or click its icon, recognizes speech on your device, and types the text into the field you are in on the current tab (or copies it to your clipboard when a page refuses typed text). It reads nothing from a page until you start it, and then only the current tab. It collects no data: audio, text, page content and browsing activity are never sent to us or anyone else, and it has no account, analytics or tracking. It stores only its own settings (on or off, language mode, whether a speech model was downloaded) on your device. The only network requests it makes download the speech model files from Hugging Face, which receives ordinary connection information such as your IP address.

Other personal information depends on how you interact with the Service. It may include:

• Information you provide to us, such as details you share if you create an account, complete a form, make a purchase where the Service offers paid features, subscribe to communications, respond to a survey, or contact us.
• Identifiers and contact details, such as a name, username, email address, or similar identifiers, where you choose to provide them.
• Transaction and billing information, such as records of purchases or subscriptions and related details, where the Service offers paid features. Payment card details are typically handled by our payment providers rather than stored by us.
• Usage and device information, such as how you interact with the Service, browser and device type, and general location inferred from technical data, collected automatically when you use the Service.
• Cookies and similar technologies, as described in the Cookies and Similar Technologies section below.
• Communications, such as the content of messages, requests, or feedback you send to us.

We may also derive or combine information from the categories above, such as preferences or inferences drawn from how the Service is used.

You are generally not required to provide personal information, but some features may not be available if you choose not to.

We use personal information for purposes that may include:

• Providing, operating, maintaining, and improving the Service.
• Creating and managing accounts and providing related support, if you create an account.
• Processing transactions and providing related features, where the Service offers paid features.
• Responding to your inquiries, requests, or feedback, if you contact us.
• Personalizing content and understanding how the Service is used so that we can improve it.
• Sending administrative or service-related messages and, where applicable and permitted, marketing communications that you can opt out of at any time.
• Maintaining the safety, security, and integrity of the Service, and detecting, preventing, or addressing fraud, abuse, or technical issues.
• Complying with applicable law and enforcing our terms and agreements.

The Service may be operated, in whole or in part, using automated and AI-assisted tools. We use personal information only for the purposes for which it was collected or for compatible purposes, unless we obtain your consent or are otherwise permitted by law.

We do not generally make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where any such processing takes place, we will provide the information and safeguards required by applicable law.

If you are located in the European Economic Area, the United Kingdom, or a region with similar laws, we process personal information only where we have a valid legal basis to do so. Depending on the situation, these bases may include:

• Consent, where you have given us permission to process your information for a specific purpose, which you may withdraw at any time.
• Performance of a contract, where processing is necessary to provide a service or feature you have requested, or to take steps at your request before entering into a contract.
• Compliance with a legal obligation, where we are required to process information under applicable law.
• Legitimate interests, where processing is necessary for our legitimate interests (such as operating, improving, and securing the Service), provided those interests are not overridden by your rights and interests.

Where we rely on legitimate interests, you may object as described in the Your Data Protection Rights section below. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing that already took place.

We and our providers may use cookies, pixels, tags, local storage, and similar technologies to operate the Service, remember your preferences, understand how the Service is used, and, where applicable, support analytics and marketing.

You can usually control these technologies through your browser or device settings and, where we make one available, through a cookie preferences tool. Some parts of the Service may not function properly if certain cookies are disabled.

Depending on how the Service is configured, some of these technologies may be provided by third parties whose own privacy practices apply to the information they collect.

We may share personal information with categories of recipients such as:

• Service providers and vendors who perform functions on our behalf, such as hosting, storage, analytics, payment processing where applicable, communications, customer support, and security, and who are permitted to use the information only to provide those services to us.
• Professional advisers, such as accountants, auditors, or legal advisers, where reasonably necessary.
• Legal, regulatory, and law enforcement bodies, where we believe in good faith that disclosure is required or permitted by applicable law, or is necessary to protect our rights, our users, or the public.
• Parties to a business transaction, such as in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case personal information may be among the transferred assets.
• Other parties with your consent or at your direction, or where you otherwise choose to share information through the Service.

We may also share information that has been aggregated or de-identified so that it does not reasonably identify you.

Some privacy laws define a "sale" or "sharing" of personal information broadly, so that certain uses of cookies, analytics, or advertising technologies may fall within those definitions even when no money is exchanged. Where that is the case, you can exercise the choices described in the Your California Privacy Rights section below.

The Service may be operated from, and information may be processed in, countries other than the one in which you are located. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer personal information across borders in a way that requires additional protection, we take steps to ensure appropriate safeguards are in place, such as relying on standard contractual clauses approved by the relevant authorities, an adequacy decision, or another lawful transfer mechanism, where applicable.

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law (for example, to comply with legal, tax, accounting, or reporting obligations, to resolve disputes, or to establish, exercise, or defend legal claims).

The criteria we use to determine how long to keep information include the nature and sensitivity of the information, the purposes for which it is processed, and applicable legal requirements. When personal information is no longer needed, we take reasonable steps to delete, anonymize, or otherwise remove it.

We use appropriate technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. The measures we consider appropriate take into account the state of the art, the nature, scope, and context of the processing, and the risks involved for individuals.

No method of transmission over the internet or method of electronic storage is completely secure, however, and we cannot guarantee absolute security. You also play an important role in keeping information secure, for example by protecting any account credentials and using the Service responsibly.

The Service may contain links to, or integrations with, third-party websites, products, or services that we do not operate or control. This Policy does not apply to those third parties, and we are not responsible for their content or their privacy practices.

We encourage you to review the privacy policy of any third party before providing it with personal information.

Depending on your location and applicable law, you may have some or all of the following rights in relation to your personal information:

• Access, to obtain confirmation of whether we process your information and a copy of it.
• Rectification, to have inaccurate or incomplete information corrected.
• Erasure, to request that we delete your information in certain circumstances.
• Restriction, to ask us to limit how we process your information in certain circumstances.
• Portability, to receive certain information in a structured, commonly used, machine-readable format, or to have it transferred to another provider where technically feasible.
• Objection, to object to certain processing, including processing based on legitimate interests and processing for direct marketing.
• Withdrawal of consent, where we rely on consent, at any time and without affecting processing that already took place.

You can exercise these rights by contacting us using the details in the Contact Us section. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law. Exercising these rights is free in most cases, and you will not receive discriminatory treatment for doing so.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection or supervisory authority. We would, however, appreciate the opportunity to address your concerns first, so we encourage you to contact us before doing so.

If you are a California resident, you may have the following rights under California privacy law, subject to certain exceptions:

• The right to know what categories of personal information we have collected, the purposes for collecting it, and the categories of sources and recipients.
• The right to access a copy of the personal information we have collected about you.
• The right to delete personal information we have collected from you.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information, as those terms are defined under California law.
• The right to limit the use and disclosure of sensitive personal information, where applicable.
• The right to non-discrimination for exercising your privacy rights.

The categories of personal information we may collect are described in the Information We Collect section, and the categories of recipients with whom we may share it are described in the How We Share Your Information section. We retain each category for the period described in the Data Retention section.

Do Not Sell or Share My Personal Information. Some privacy laws define "sale" and "sharing" broadly, so that certain uses of cookies, analytics, or advertising technologies may qualify even when no money is exchanged. To the extent O-mega Enterprise Inc. sells or shares personal information as defined under California law, you have the right to opt out. Where this applies, you can exercise that right by contacting us or, where we make them available, by using the "Do Not Sell or Share My Personal Information" controls or cookie preferences we provide.

You may submit a California rights request by contacting us using the details in the Contact Us section. You may also use an authorized agent to submit a request on your behalf, subject to verification. We will handle requests in accordance with applicable law.

The Service is not directed to children, and we do not knowingly collect personal information from children below the age at which consent is required under applicable law in their jurisdiction.

If you believe that a child has provided us with personal information, please contact us, and we will take reasonable steps to delete it in accordance with applicable law.

We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we do, we will revise the "Last updated" date shown with this Policy and, where required by law or where the changes are significant, we will provide additional notice.

The version of this Policy that applies is the one made available through the Service as of the relevant date. We encourage you to review this Policy periodically.

If you have any questions, requests, or concerns about this Policy or about how we handle personal information, or if you would like to exercise any of your rights, you can contact us at hello@yapapp.cc.

We will respond to your inquiry within the timeframe required by applicable law.