Privacy by Design

Local transcription is not a privacy feature — it's the architecture. Audio is processed on your device and never transmitted to any server.

Core privacy principles

On-device processing

Whisper runs entirely on your CPU or GPU. Audio files are read locally, processed locally, and the resulting transcript is stored locally. Your audio and transcript content never ride a network path — first-run model downloads and optional license checks are separate from inference.

Minimal data collection

The backend stores only what is needed to verify your license: a hashed install ID, license key, and activation timestamp. Product analytics (PostHog) are opt-in. Crash reports (Sentry) are opt-out — on by default when a DSN is configured, until you opt out in Settings → Privacy.

No cloud AI path

Summaries, translation, and chat all run on a local model on your device. There is no cloud AI feature to enable and no cloud subprocessor that receives your content — the backend only ever sees license metadata.

Encrypted at rest and in transit

All backend communication uses TLS 1.3. License JWTs are signed with EdDSA. Library transcripts, chat history, and embeddings live in an encrypted on-device database (`kajo.db`, libsql / SQLite3MultipleCiphers) with the key wrapped by the OS keychain via `safeStorage`. Source audio files stay on your disk under standard OS permissions and are never uploaded.

Encryption details

Data type	Where it lives	Protection
Audio files	Your device only	OS file permissions. Never transmitted.
Transcripts, library, chat history, embeddings	Your device only (`kajo.db`)	Encrypted at rest (libsql / SQLite3MultipleCiphers); key wrapped by OS keychain. Never transmitted.
License key	AWS DynamoDB + local keychain	Stored hashed server-side. JWT signed with EdDSA.
Payment details	Paddle only	PCI DSS Level 1. Kajo never sees raw card data.

Sub-processor list

Summary of third-party services that process data on behalf of Kajo. Full roster with DPAs: /legal/subprocessors.

Paddle

One-time lifetime purchase checkout and payment processing (no subscriptions)

Data transferred: Billing address, payment method token, purchase history, email

Location: United States / EU

Cloudflare

Authoritative DNS and inbound email routing for kajovoice.com (the site and releases are served from CloudFront)

Data transferred: DNS query metadata; inbound email metadata and content for @kajovoice.com addresses — no audio, no transcripts

Location: Global edge network (EU and US nodes)

Hugging Face

Fallback source for on-device model weights — models download from Kajo's asset CDN first, from Hugging Face when the CDN is unavailable

Data transferred: Download request metadata — no audio, transcript, or personal content

Location: Global CDN

PostHog

Opt-in product analytics for the desktop app and backend (event counts only — never audio or transcripts)

Data transferred: Hashed install id, event names/counts, plan tier, platform — no audio, no transcripts

Location: EU — Frankfurt (eu.posthog.com)

Privacy posture

Kajo is designed around a zero-upload guarantee: your audio and transcripts are processed on your device and never sent to our servers.

On-device processing: Whisper large-v3 turbo runs locally — audio never leaves your machine.
DPA available: executed Data Processing Addendum on request after Lifetime purchase (template at /legal/dpa; privacy@kajovoice.com).
Zero-upload guarantee: transcription of real recorded audio does not transmit audio data to any cloud service.

Security disclosure

Found a vulnerability? Please disclose responsibly to:

security@kajovoice.com

PGP key available on request.

Lifetime customers can request a security questionnaire response at security@kajovoice.com.