Clabrate — Privacy Policy

Last updated: 13 October 2026 · Contact: support@clabrate.com

Clabrate is a Mac app for dictation and for talking to an AI assistant. This policy says what stays on your Mac, what we hold, who else receives data, and how to delete it. “We” and “us” mean Clabrate, the business responsible for the account data described here. Spot, Clabrate’s desktop companion, is also an Android app; where this policy says “Spot on Android”, it means that app.

The short version

Dictation is transcribed on your Mac. Your audio and your words are not sent to us. If you choose a cloud AI provider to clean up your dictation, your Mac sends the text to that provider.
We hold your email address, a random account ID and short-lived sign-in records. If you use Cloud Voice, we also hold your credits and records of each session and its usage: times, amounts and identifiers, never what was said. The full list is below. We do not hold your audio, your words, your history or your settings. If you sign in to Spot on Android, we also hold your Spot Collection and your Spot purchases.
Spot on Android uses Google Play to sell Inkwells and Daily Boost, and Google’s ads SDK for optional rewarded ads.
AI runs on your Mac unless you turn on a cloud AI feature. If you do, your Mac sends what you say, type and attach directly to that feature’s provider, and that does not pass through us. Cloud Voice runs on your Clabrate account: the setup of each Cloud Voice session (the assistant’s instructions and its list of tools, not your conversation) reaches Google through our account service. The other cloud features use your own key or login.
The Mac app counts how it is used only if you turn that on. It is off unless you turn it on, and it never includes anything you dictate, type or say. The website, clabrate.com, uses Google Analytics. In the European Economic Area, the United Kingdom and Switzerland, and where we cannot tell which country you are in, it stays off until you accept. Elsewhere it is on unless you turn it off or your browser sends a privacy signal. When you watch a rewarded ad in Spot on Android, Google collects ad measurement data (see Analytics).
You can delete your account in Settings → About & updates, in Spot on Android, or by emailing support@clabrate.com.

What stays on your Mac

Dictation. Speech-to-text runs on your Mac. Clabrate does not keep recordings of your dictation.
Settings, your dictionary and vocabulary, knowledge notes, boards, and your Spot collection. These are stored on your Mac. The Mac app does not send its Spot collection to your account, even if you also sign in to Spot on Android.
History. History is off until you turn it on. When it is on, Clabrate stores on your Mac what you dictate (the words as you said them, the cleaned-up text, the dictation mode, how long it took and the name of the app you were in) and your assistant conversations. When you transform selected text, it also stores the original text, the transformed text, any instruction you spoke, how long it took and the name of the app. Screenshots and other attachments are not saved. You can delete single entries and conversations. Clear history removes all of it. Transformed text is not shown in the History list, but Clear history removes it too. Turning History off stops new entries; it does not delete what is already stored.
Custom voices. If you record or upload a sample to create a custom voice, Clabrate keeps the recording in that voice’s own folder on your Mac. Removing the voice deletes that folder and the recording in it. Recording the voice again replaces its old recording with the new one. While you are making a voice, Clabrate keeps a working copy of the recording. The working copy is deleted when you save the voice. If you do not save it, the working copy is replaced the next time you record a sample and deleted the next time Clabrate starts.
Keys and sign-in. The API keys you add and your Clabrate sign-in are stored in the macOS Keychain.
Downloaded models. Model files are stored on your Mac.
Browser panes. A browser pane works like a web browser: the sites you open receive your requests. The pane’s address is saved on your Mac. So are the cookies, sign-ins and other site data those sites store.

We have no copy of any of this. Removing the app does not remove this data. To remove it, delete Clabrate’s folder in ~/Library/Application Support. Browser-pane site data and the items in the macOS Keychain are stored separately from that folder. Email support@clabrate.com for help removing them.

Spot on Android without signing in. Your Spot Collection is stored on your phone, including the Inkwells you earn by watching ads. Android backups and device transfers do not include it. We have no copy of it unless you sign in. The first time an account is signed in to, the app adds this phone’s Collection to it, up to set limits (100 Inkwells, 1,000 Ink and a count of 50 duplicates in a row). The app adds it only once per account, and a phone’s Collection goes to only one account. Finds that are not out yet stay on the phone. So does any Signature you found while signed out: it is kept on that phone only and is never added to an account. It belongs to the phone, not to an account. To add a phone’s Collection, the app sends our service the list of what the phone has found, Signatures included, with what Spot is wearing and which idle moves are turned on there, so the service can add what it may. Signatures on that list are not added, and nothing about wearing them or their idle moves is kept. The result we keep in the log of the app’s requests lists which Signatures were left on the phone. Such a Signature stays on the phone when you sign in, sign out or delete an account. If another account signs in on the same phone, it is still shown there, marked “This device only”, and belongs to neither account. A phone’s Collection is not added to an account that already has a purchase or already took in a Collection. Whatever isn’t added stays on your phone, and the phone keeps its own copy either way. While you are signed in, the phone also keeps the last copy of your account’s Collection it received, any purchase or action not yet confirmed by our service, and your sign-in, which is encrypted with a key held by Android. It also keeps which of the phone’s own “This device only” Signatures you wear or have switched on there. The app does not send that choice to us or to anyone else, with one exception: if an Inkwell you open on that phone gives your account the same Signature, the app tells your account to wear it or switch it on, as you had it. Signing out or deleting your account removes these from the phone. What you found without an account, including a Signature kept on that phone only, stays on the phone. Uninstalling the app or clearing its data removes everything it stored on the phone. A new phone does not get any of it either.

What we hold: your account

You sign in with an email address. Our account service stores:

your email address;
a random account ID, and the dates the account was created or deleted;
sign-in codes and sign-in sessions, stored as one-way hashes, with the times they were created, used and expire;
when you change your email address, the old and new addresses. Both are kept until the hourly clean-up removes the finished or expired change;
your credit balance and a list of credits added and used. Cloud Voice on your Clabrate account uses credits. Each entry in the list has its amount, its time, its kind (for example the starting credits, or a charge for Cloud Voice), the version of the prices used, a random reference for the request that made it and, for a charge, the Cloud Voice session and usage report it was for. One charge covers one usage report from your Mac, which can include several answers; the entry names the session and the first answer in that report;
keyed one-way hashes that record that the free starting credits were given: one made from each email address your account has used since then, and one made from this installation’s random ID. Each is stored with its kind, the version of the key that made it and the time it was made. While your account exists we also keep which of these hashes belong to it. A hash can also carry a mark that Cloud Voice was blocked; “Delete account” below says when. We cannot turn the hashes back into your address;
a record of each Cloud Voice session, made when we reserve a session for a token request from your Mac, before any conversation starts (a request we refuse can leave no record): an identifier for the session; when it was requested, when it expires, and when and how it ended; this installation’s random ID; the earlier session it continued, if any, and whether your Mac signalled, when it continued the session, that a person was present; for each answer, the usage counts your Mac reported (token counts), when it reported them and the credits charged; an estimate of usage that was never reported; and technical details (which of our Google keys it used, price and settings version labels, and an estimate of the size of its setup). It holds none of the audio, the conversation or the setup itself;
records we keep to limit misuse of Cloud Voice: the times and kinds of usage signals and strikes (for example many sessions in an hour, or a session that reported no usage) and the session each relates to; any temporary pause of Cloud Voice on your account, with its reason and when it ends; and, if Cloud Voice on your account is being watched or is blocked, that state, its reason, when it began, when its last signal was and any slot assigned for a separate Google key;
short-lived counters that limit repeated attempts. They are keyed hashes made from your IP address, your email address or your account ID. We do not store your IP address in our database;
if you choose to register interest in Cloud Voice top-ups: that you agreed to be emailed about them, the dates you registered and last changed your answers, whether you did so in the app or on the website, and your optional answers (how you use Cloud Voice and which option you would want). We use these, with your account email address, only to contact you about top-ups and to decide what to offer. You can ask us to remove them at any time at support@clabrate.com, and they are deleted when you delete your account;
if you have turned usage counts on or off in the Mac app: your choice and when it last changed. While it is on, also the counts described in Analytics, “In the Mac app”.

If you sign in to Spot on Android, the account service also stores your Spot data:

your Spot Collection: your Inkwells and what each one gave you when you opened it, the finds you own, what Spot is wearing and which idle moves you turned on, your Ink balance, any Ink you owe after a refund, and a ledger of where each amount of Ink came from;
for the current day only: whether you claimed the day’s Inkwells, how much time Spot was visible on your screen that day (counted up to six minutes), and your progress towards an Inkwell from ads. It is replaced the next time you use Spot on a later day (days start at midnight UTC). While Spot is visible, the app reports the time about every 10 seconds; we keep only the time of the last report, not a record of each one. The Ink ledger keeps one entry for each visible-time Ink reward, with its date;
a log of the app’s requests, so that one sent twice is applied once: each request’s ID, a hash of it and the result;
if your phone’s Collection was added to your account: an ID for that import, a hash of the request and when it happened;
your Google Play purchases: what you bought, how many, whether it is pending, purchased or cancelled, how much of it was refunded, when we checked it with Google, and the purchase token Google issued. We store the token encrypted, and a one-way hash of it as the purchase’s ID. We also keep the times you started a purchase in the app, the state of our requests to Google about each purchase, and the refunds and cancellations Google reports to us;
rewarded ads you watch while signed in: for each ad, a one-time code, the keyed ID we give Google in place of your account ID (see below), when the ad session was issued and when it expires, the ad unit and the reward; and for each ad Google confirms, Google’s transaction ID and a hash of Google’s confirmation.

That is everything. We do not store your settings, history, dictation, conversations or API keys, or the Spot collection on your Mac, and your account does not sync them.

Who else handles account data

Cloudflare hosts the account service (Cloudflare Workers) and its database (Cloudflare D1), which holds the account data listed above. As the host, Cloudflare also processes your IP address and request details when your Mac, or Spot on Android, contacts the service.
Resend delivers our sign-in emails. For each email it receives your email address and the message, which contains your sign-in code.
Google provides Cloud Voice. When a Cloud Voice session starts or is renewed, our account service receives that session’s setup from your Mac and sends it to Google to get an access token. “Cloud AI features you can turn on” below says what the setup contains and what Google receives from your Mac.
Google Play sells Inkwells and Daily Boost in Spot on Android and takes your payment under your Google account and Google’s terms. We do not receive your payment details. With each purchase the app gives Google a keyed hash of your account ID, never the ID itself. Our service sends Google the purchase token to check, confirm and complete each purchase, and asks Google every few minutes for purchases that were refunded or cancelled.
Google AdMob provides the rewarded ads in Spot on Android, through Google’s ads SDK and Google’s consent tool, which run on your phone. Google’s consent check runs when you first press Watch ads or Privacy options after opening the app, and the ads SDK starts when you ask to watch an ad. If you are signed in, the app gives Google a keyed ID made from your account ID (not the ID itself) and a one-time code for that ad. Google sends both back to our service to confirm you watched the ad. If you are not signed in, the app gives Google nothing about you or your Collection, and your phone adds the Inkwell itself. Either way, Google’s ads SDK collects information from your phone (see Analytics).

We do not sell your personal data for money. Google’s ads SDK may use data from your phone for personalised ads where you allow it (see Analytics).

The website also uses Google Analytics, which is separate from your account (see Analytics, “On the website”).

AI on your Mac

The built-in AI models run on your Mac and send nothing anywhere. A new installation uses on-device AI only. Ollama and LM Studio are model servers you run yourself; Clabrate sends them your content only on your own Mac.

Cloud AI features you can turn on

Cloud AI is optional and off until you set it up. Each provider below receives data only if you set up and turn on a feature that uses it. For a feature that uses your own key or login, data goes directly from your Mac to the provider and is handled under your agreement with that provider and its privacy policy, not ours. Cloud Voice is different in two ways, described next.

Google — Cloud Voice (Gemini Live). Uses your Clabrate account, not your own Gemini API key, and you must be signed in. Clabrate holds the account with Google that Cloud Voice runs on, so Google processes a Cloud Voice conversation under Clabrate’s agreement with Google, not under an agreement of your own. While Cloud Voice is on, Google receives: the audio of what you say to the assistant, and your microphone for the whole of a hands-free conversation; the assistant’s instructions and your recent conversation with it; anything you attach (screenshots, copied or selected text); the list of tools the assistant may use and the results of the tools it uses; and screenshots the assistant takes itself, if you turn that setting on. Cloud Voice sends your conversation to Google even if you chose an on-device model for typed chat.

Your live audio, your conversation, what you attach and the results of tools go directly from your Mac to Google. They do not pass through our account service, and we do not receive or store them.

The session’s setup does pass through our account service. To start a session, and every few minutes while it runs, your Mac asks our account service for a short-lived access token and sends the setup with that request: the Gemini model, the voice you chose, the language if you set one, technical session settings, the assistant’s instructions, and the name, description and parameter definitions of each tool declared for that session. The instructions are fixed text written by Clabrate. The declared tools reflect how you have set Clabrate up: they include the tools of enabled extensions that you have allowed Cloud Voice to use, as their authors wrote them, and, when the overlay tool is among them, the identifiers of your enabled overlay apps. Some tools you have allowed are not declared in the setup: they are described to Google later, in a tool result, which goes directly from your Mac to Google. Your recent conversation and your attachments are not part of the setup; they go to Google separately. Our account service passes the setup to Google to get the token. It does not store or log the setup; what it does store is listed under “What we hold”.

Google may keep the state of a conversation, including its text and audio, for up to 24 hours so that a dropped connection can resume. Google may also keep logs for abuse monitoring under its own policy. We do not control either.
Google — Gemini (your own API key), Anthropic — Claude (your own API key) and OpenAI (your own API key). The provider you select for a feature receives:
- for dictation clean-up: the transcript, your vocabulary terms, and any context your dictation mode includes (the app name, the browser page address, or text you recently copied);
- for transforming selected text: the selected text, your instruction and your vocabulary terms;
- for the assistant: its instructions, your vocabulary terms, your recent conversation, the names of your open board and panes, anything you attach (including screenshots), the list of tools it may use, and the results of the tools it uses. If you set the assistant to take a screenshot with every message, each message you send includes one. Depending on the tools you have enabled, tool results can include text from your knowledge notes, sticky notes and terminal panes, the output of coding agents, folder paths and your settings. When a coding agent finishes, Clabrate tells the assistant, and that short note goes to the provider too.
Command-line AI tools — Claude Code (Anthropic), Codex (OpenAI), Grok (xAI) and Antigravity (Google). If you have one of these installed on your Mac and connect it to Clabrate, Clabrate passes it the assistant’s instructions, your conversation and, for Claude Code, attached images, and lets it use the Clabrate tools you have allowed. If you let the assistant start coding agents in terminal panes, it passes them the task you asked for. Each tool uses its own login and sends data to its maker. Clabrate does not control what the tool sends.
A provider you add yourself. You can install a provider definition that names another service. That service receives the same data as the providers above.

A screenshot sent to Google or Anthropic comes with a list of the buttons, links and other controls in the app at the front of your screen: their names, types, positions and nearby text.

Before sending text to a cloud provider (other than Cloud Voice), Clabrate tries to mask anything that looks like a password, key or token. This is a best-effort safeguard and does not cover images.

Other connections the app makes

Model downloads. Clabrate downloads its model files from Hugging Face. The speech-to-text model starts downloading as soon as you first open the app. Hugging Face receives an ordinary download request, including your IP address.
Updates. Clabrate checks updates.clabrate.com, hosted on Cloudflare, for new versions each time it starts and then about once a day, and downloads updates from there. These automatic checks begin once setup is finished and stop if you turn them off. Check for updates always checks. Cloudflare receives an ordinary request, including your IP address.

Neither connection sends your audio, text or email address.

Sign-out, changing your email, deleting your account

Sign out ends the sign-in session on this Mac and on our service. This Mac remembers your email address and that you verified it, so the on-device features keep working.
Change email needs a code from both your current and your new address. Your account ID stays the same. All sign-in sessions end, unused sign-in codes for either address are cancelled, and you sign in again with the new address.
Delete account removes your email address from our service, deletes any email-change records, cancels unused sign-in codes and ends every session. It deletes your credit balance and credit list, your Cloud Voice session records, the misuse records, any usage counts from the Mac app and the record of which hashes belonged to your account. We keep the hashes themselves, so deleting an account and signing up again does not give the free starting credits a second time. If Cloud Voice was blocked on your account when you delete it, the hashes that belonged to it are marked as blocked. Any other Clabrate account, existing or new, that matches one of those hashes is then blocked from Cloud Voice the next time it checks its credits or asks to start a Cloud Voice session. An account matches if it uses the same email address (ignoring anything after a ”+”, and the dots in a Gmail address) or the same installation, which can be another person’s account on the same computer. We also keep a record that an account existed: its random ID and the dates it was created and deleted, with no email address. On this Mac the app removes your saved sign-in, and you must verify an email address again to keep using Clabrate. If your Mac cannot remove the saved sign-in, the app tells you and lets you retry.
Delete account in Spot on Android deletes the same account. It also signs the Mac app out of the account. On a Mac where you have already verified your email, the on-device features keep working.
Your Spot data. Deleting your account, on the Mac or in Spot on Android, also deletes all your Spot data on our service at once: your Collection, Ink, request log, import record, purchase records and ad records. This cannot be undone. Inkwells and finds you paid for are lost. Daily Boost goes with the account too. Deleting your account deletes our record of what you bought, so we can’t give those items back or move them to a new account, even one with the same email address. Google Play keeps its own record of your order, which is why a refund request needs your Google Play order number. Google also keeps the keyed hash of your deleted account ID with the order, and its own ad records, under Google’s policies. Deleting does not refund a purchase by itself. You can ask us to refund Inkwells you paid for and have not opened, within 30 days of buying them, as a share of what you paid. Inkwells are sold in packs, and we can do this only while the pack’s Rare Inkwell (the one that always opens to a Rare) is still unopened. If you have unopened Inkwells you bought in the last 30 days, ask for the refund before you delete. After you delete, we no longer know how many were unopened, so we cannot work out a refund for them. Older unopened Inkwells are lost when you delete. If your Daily Boost was still active, you can ask us to refund it, before or after you delete: email support@clabrate.com with the Google Play order number. We can do this for as long as Google Play lets us refund the order. The Refund Policy has the details.
Delete by email. You can also ask us to delete your account by emailing support@clabrate.com. We act only once the request is confirmed from the account’s own email address. If you have unopened Inkwells you bought in the last 30 days, say so in the same email and give the Google Play order number. We refund the ones that can be refunded (only while their pack’s Rare Inkwell is still unopened) through Google Play, and then delete the account.

Deleting your account does not erase the data on your Mac (settings, history, models, Spot collection) or your phone’s own Spot Collection. Removing either app does not delete your account.

How long we keep things

Your email address: until you delete your account.
Your random account ID: kept after deletion, in the record that the account existed.
Sign-in codes: they expire after 10 minutes and work once.
Sign-in sessions: they last 30 days and are renewed while you keep using the app.
Expired or ended codes, sessions, email-change records and attempt counters: removed by a clean-up that runs every hour.
Your credit balance and credit list, Cloud Voice session records and misuse records: until you delete your account. We do not remove them after a set time. Some go sooner: a token request that was never completed is removed after it expires; a strike for a session that reported no usage is removed if a final report for that session is accepted while we still accept late reports, and no other strike is removed early; and an account that was being watched goes back to normal when a later Cloud Voice token request is processed after a period with no new signals.
The hashes that record the free starting credits: kept.
The record that a deleted account existed: kept.
Your Spot data (Collection, Ink ledger, request log, import record, purchase records and confirmed ads): until you delete your account.
The current day’s claim, visible time and ad progress: replaced the next time you use Spot on a later day (days start at midnight UTC).
Ad sessions Google never confirmed: removed a day after they expire, the next time you start an ad; otherwise when you delete your account.
Usage counts from the Mac app, if you turned them on: 30 days. The note that your first completed dictation and your first Cloud Voice conversation have been counted stays for as long as counting is on. Turning usage counts off, or deleting your account, deletes both.
Your usage counts choice (on or off): until you delete your account, so that an “off” stays off.
Website analytics: Google Analytics is set to delete data about individual visits after 2 months. Google does this once a month, and keeps totals that are not tied to a visitor. The _ga cookies stay in your browser for up to 13 months after your latest visit, or until you turn analytics off.
Data on your Mac: until you delete it.
Spot’s data on your phone: until you delete it or uninstall the app. Your account’s copy and sign-in go when you sign out. So does your choice of which “This device only” Signatures to wear or switch on. What you found without an account stays.

The hourly clean-up works in batches, so removal can take longer than an hour. Cloudflare, Resend and Google keep their own logs and backups under their policies. We do not control those and cannot promise exact deletion dates for them. Cloudflare also keeps recovery copies of our database for a limited time. If we ever restore the database from one after a failure, data deleted during that time could come back until the clean-up removes it again.

Analytics

The Mac app counts how it is used only if you turn that on (see In the Mac app below). The website, clabrate.com, uses Google Analytics (see On the website below). Spot on Android has no analytics of its own.

Rewarded ads are the exception. When Spot on Android shows Google’s consent tool or an ad, Google’s ads SDK collects information from your phone to show and measure ads and to prevent fraud: for example device and app information, your IP address, how you interact with the ad and, where Android allows it, the phone’s advertising ID. Where the law and your choices in Google’s consent tool allow, Google may use it to personalise ads. Google handles this information under its own policies, not ours; see How Google uses information from sites or apps that use our services. If Google asks for your consent, Privacy options, shown with the ink pump in the Collection and the Shop, lets you change your choices. You can also reset or delete the advertising ID in Android’s settings. Ads are optional: you never have to watch one.

In the Mac app

Usage counts in the Mac app are off unless you turn them on. Clabrate asks once, after you sign in, whether you want to help improve it. You can change your answer at any time in Settings → Privacy & permissions, with the switch Share usage counts to help improve Clabrate. If you never turn it on, the app sends us no usage counts at all. Before asking, the app checks whether usage counts are available with a request that carries no account or device identifier.

If you turn it on, Clabrate counts how the app is used: which features, dictation modes and assistant tools that come with Clabrate you use, which kind of AI provider, whether setup steps and downloads worked, what kind of error happened, and rough timings (for example “under 1 second”). Each count is one entry from a fixed list built into the app. Each count also carries when it happened, a broad app version label (such as “0.8”) and a random reference, so that a count sent twice is not counted twice. We add the counts up by day. Dictation modes you made yourself are counted only as “custom mode”. Tools from extensions you install or from MCP servers are counted only as “extension tool” or “external tool”.

It never collects audio, transcripts, anything you dictate or type, conversations, prompts, what a tool was asked or answered, screenshots, terminal contents, file paths, window titles, the apps you work in, or your email.

The counts go only to our own account service. They are stored against your account’s random ID, not your email address, and are not shared with or sold to anyone. Counts are kept against your account for 30 days. They are removed by a clean-up that runs every hour in batches, so a count can stay a little longer than 30 days before it is removed. One small record stays for as long as counting is on: a note that your first completed dictation and your first Cloud Voice conversation have already been counted, so that they are not counted as “first” again.

Turning this off deletes the counts and the first-use note. We keep the record of your choice so that “off” stays off. Deleting your account deletes the counts, the first-use note and the choice record. If the app cannot confirm the deletion, for example because you are offline, it tells you and lets you try again. Your Mac keeps a small queue of counts waiting to be sent; counts more than seven days old are not sent.

In Settings → Privacy & permissions, See what is sent shows the most recent counts recorded since you opened the app (up to 50) and the full list of events and values that can be sent.

Policy reference: analytics-policy: analytics-v1

On the website

clabrate.com uses Google Analytics, a service of Google, to count visits and to see which pages and campaigns bring people to Clabrate. Whether it runs depends on where you are and what you choose:

In the European Economic Area, the United Kingdom (with Gibraltar, Jersey, Guernsey and the Isle of Man) and Switzerland, and wherever we cannot tell which country you are in, Google Analytics stays off until you choose Accept in the banner. If you choose Reject, or make no choice, nothing is loaded from Google.
Elsewhere it is on when you arrive, with a notice on your first visit. Cookie settings in the footer of any page turns it off.
If your browser sends a Global Privacy Control or Do Not Track signal, it stays off.
It never runs on the account and sign-in pages (clabrate.com/account/).

When it is on, Google receives: the address and title of each page you view, without anything after the ”?” in the address except campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term, campaign); the site that sent you to us; clicks on the download, pricing and sign-in buttons and links and where on the page they were; that you opened the pricing page, and whether its top-up section was shown on your screen; how long you kept a page open; your browser, operating system and device type, screen size and language; your country and region (such as your state), which Google works out from your IP address; and identifiers kept in first-party cookies (_ga and _ga_<ID>) for up to 13 months after your latest visit, which let Google tell a returning browser from a new one and group the pages of one visit. Google says Google Analytics does not log or store IP addresses.

We do not send Google anything you type into a form, your email address, your account ID, or sign-in links and codes. The website can see that a download button was clicked, not whether the app was installed.

We do not use this for advertising. Advertising features, Google signals and ad personalisation are off, and the website is not linked to an advertising account. Google processes this data for us and may do so in the United States and other countries; see How Google uses information from sites or apps that use our services. Google Analytics is set to delete data about individual visits after 2 months; “How long we keep things” has the details.

Your choice is kept in your browser’s storage (clabrate.consent), not in a cookie, so it applies to that browser only. To change it, use Cookie settings in the footer. Turning it off also deletes the Google Analytics cookies.

The website

clabrate.com is hosted on Cloudflare, which processes ordinary request data such as your IP address. Apart from the Google Analytics cookies described in Analytics, the site sets no cookies unless you ask for a sign-in link or sign in on its account page. Asking for a link sets one cookie that lets the link sign you in without an extra step in the browser you asked from. It is strictly necessary, lasts about 10 minutes, cannot be read by page scripts, and is removed when you sign in or it expires. Signing in sets one cookie that keeps you signed in. It is strictly necessary, lasts up to 30 days, cannot be read by page scripts, and is removed when you sign out. When the account page finds you are signed in, the site also saves a marker in your browser’s local storage so the top bar can show “Account” instead of “Sign in”. The marker is the value “1” and holds nothing about you or your account. It is not a cookie and is not sent to any server. It is removed the next time the account page finds you are not signed in, including when you sign out there. If you choose “Sign out” in the top bar and it opens in the same tab, the site notes the time of that click in that tab’s session storage so the account page can sign you out. The note is acted on only for about a minute. It is not a cookie and is not sent to any server. It is removed when the account page or a sign-in link page next loads, or when you close the tab. The site’s footer loads two badge images from daniellaunches.com and seoreceipts.com, so those sites receive an ordinary request from your browser. The free tools on the site run in your browser and keep what you make in your browser’s storage. The tools that transcribe speech load a code library from jsDelivr and download their speech model from Hugging Face, so those two services also receive an ordinary request from your browser.

Permissions

macOS asks before Clabrate can use each of these:

Microphone — to hear you dictate and talk to the assistant.
Accessibility — to type your words into other apps, see which app you are in, read the text you have selected, read the names of the buttons and controls on screen, and move windows when you ask.
Input Monitoring — to notice your dictation shortcut.
Screen Recording (optional) — for screenshots sent to the assistant.
Automation (optional) — to read the page address from your browser: for the dictation modes and transforms that use it, and when you add a rule for a website.
Focus (optional) — to see whether a Focus mode is on, so Spot, the desktop companion, stays out of your way. Clabrate reads only whether Focus is on or off.

Granting a permission does not send what it lets Clabrate read anywhere. That is sent to a cloud provider only as described above. If you have turned on usage counts, they can include whether the Microphone, Accessibility and Screen Recording permissions are allowed.

Support

Clabrate keeps diagnostic logs on your Mac. They are not sent to us. If you export a support file and email it to us, read it first: it contains your settings and the app’s logs. Hidden developer options can save extra diagnostic files on your Mac, including audio and the images and screenshots you attach; they are off unless you turn them on. We may keep support emails so we can help you and meet legal duties.

Children

Clabrate is not directed to children under 16. We do not knowingly collect their personal information. This includes Spot on Android, whose ads are not aimed at children. You must be 16 or older to use Spot on Android, with or without an account.

Your rights

Depending on the law where you live, you may have rights to access, correct, delete or otherwise control your personal data. Contact support@clabrate.com. For website analytics, send us the value of the _ga cookie from your browser, if you still have it, so we can ask Google to delete the data linked to that browser. For data held by an AI provider, ask that provider.

Cloudflare, Resend, Google and the AI providers you use may process data in other countries.

Changes

We will publish material changes here with a new date and, where appropriate, tell you in the app.