Privacy Policy

1. Controller and contact

The controller for the processing described here is Bent Eisheuer, Freisinger Landstraße 47a, 85748 Garching, Germany. Email: legetdev@gmail.com.

No data-protection officer has been appointed. Privacy requests can be sent directly to the email address above.

2. Website delivery and downloads

The website and downloadable files are hosted by Vercel Inc.When you request a page, font, app update feed, or DMG, Vercel processes request data such as IP address, date and time, requested path, response status, referrer, and browser or client information. This is necessary to deliver and protect the service. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in secure, reliable website and update delivery.

We do not add analytics to these requests or export a separate visitor-log database. Provider-side security and delivery logs follow the retention controls of our Vercel account and are not retained by us for advertising or profiling. Vercel acts as our hosting provider; its privacy notice contains provider details.

3. Browser storage, cookies, and external content

This website does not set analytics, advertising, preference, or tracking cookies and does not use localStorage, sessionStorage, tracking pixels, social widgets, or third-party embeds. Fonts are delivered from the same website. We therefore do not display a consent banner. External providers receive data only when you deliberately follow an external link.

4. Email and support

If you email us, we process your sender details, message, attachments, and technical email metadata to answer your request, administer a contract, or protect legal interests. The legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual requests and Art. 6(1)(f) GDPR for other support and legal correspondence. Email is provided through Google, which receives the message data needed to provide that service.

Routine correspondence is deleted when the matter is resolved and no legal retention or claim-related reason remains. Messages that form part of a business or tax record are kept for the applicable statutory period.

5. Processing that stays on your Mac

The following data is processed locally and is not sent to us:

• wake-word audio and on-device speech-to-text processing;
• API keys, licence data, and related secrets stored in the macOS Keychain;
• app settings and permission state stored through macOS preferences;
• conversation history and on-device summaries, enabled by default and switchable or erasable in Settings; and
• a local action audit log containing commands, tool actions, guardrail decisions, outcomes, and timestamps. It remains in ~/Library/Application Support/Voika/audit.jsonl until you delete that local file or the associated app data.

Local data may still contain personal or confidential information. You control the Mac account and should protect it with macOS access controls and disk encryption appropriate to your use.

6. AI providers you configure

Voika is BYOK: you choose and contract with an AI provider such as Google, Anthropic, OpenAI, or xAI. Your API key is retrieved from the Keychain and sent to that provider only as needed to authenticate your requests. The request goes directly from your Mac to the selected provider; we do not proxy, receive, or store it.

Depending on the task, the request can contain your transcribed command, conversation context, accessibility-tree text, tool results, fetched web content, and a cropped screenshot when visual context is needed. Raw wake-word audio and continuous screen video are not sent. The selected provider processes this data under your agreement and its privacy terms. You can change or remove the provider and key in Settings.

7. macOS permissions

Voika requests Microphone, Speech Recognition, Accessibility, Screen Recording, and Automation permissions so it can hear commands, inspect interface state, and control apps at your request. Permission grants are managed by macOS. They do not themselves transmit data to us. Content leaves the device only through the provider or service flows described in this policy.

8. Free-trial verification

The 7-day trial uses a stable, app-specific, pseudonymous device fingerprint to prevent repeated resets. The app hashes the Mac hardware UUID with a Voika-specific salt and sends only the resulting fingerprint to our Cloudflare Worker. The raw hardware UUID stays on your Mac. Because a stable fingerprint can single out a device, we treat it as personal data rather than calling it anonymous.

The Worker stores the fingerprint and first-trial date. It also uses the request IP address to rate-limit new fingerprint registrations; the rate-limit entry expires after one hour. The fingerprint record currently has no automatic expiry and is retained while needed to enforce the one-trial-per-device rule. The legal basis is Art. 6(1)(f) GDPR: preventing repeated trial resets. You may object on grounds relating to your situation; without this check, we may be unable to provide the free trial, while paid licence rights remain unaffected.

Cloudflare, Inc.provides the Worker and storage infrastructure as our processor and may process standard network metadata to provide and secure the service. See Cloudflare's privacy policy.

9. Licence activation and validation

When you activate a paid licence, the app sends the licence key and a device instance name to Lemon Squeezy. Periodic validation sends the licence key and instance identifier; standard request metadata such as IP address is also processed. Lemon Squeezy returns licence status and may return the buyer name or email, which the app stores locally in the Keychain for the licence display. The legal basis is Art. 6(1)(b) GDPR, performance of the licence arrangement and enforcement of its activation limit.

10. Purchases

Paid checkout is not currently open, so this website does not send visitors into a purchase flow. Lemon Squeezy will process checkout data as Merchant of Record if and when paid sales are enabled.

11. App updates

Voika checks the signed update feed on this website, by default once per day. That request produces the same Vercel delivery data described in section 2. Automatic checks can be disabled in the app. Installing an update is handled by the bundled Sparkle updater and macOS.

12. International transfers

Vercel, Cloudflare, Google, and Lemon Squeezy are US-based providers or use infrastructure outside the EEA. Transfers are made under the provider's applicable EU transfer mechanism, such as an adequacy decision including the EU–US Data Privacy Framework where valid for the relevant entity, or Standard Contractual Clauses with supplementary safeguards where required. You may ask us for information about the mechanism applicable to a particular processing activity.

13. Your rights

Subject to the statutory conditions, you have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection to legitimate-interest processing (Art. 21). You may withdraw consent at any time for the future where processing relies on consent. Contact legetdev@gmail.com to exercise a right.

You may also complain to a data-protection authority. The authority responsible for our establishment is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

14. Automated access decisions

Trial dates and licence validity are checked automatically. These checks control access to the trial or licensed app but are not used for profiling and do not produce legal or similarly significant effects within Art. 22 GDPR. If a check is wrong, contact us for review and correction.

15. Children and policy changes

Voika is a professional desktop-control tool and is not directed to children. We update this policy when material data flows or legal requirements change and publish the current date at the top of the page. The next scheduled review is 15 July 2027.