Privacy Policy

Introduction

Audior ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we handle information when you use the Audior desktop application, the Audior mobile app for Android and iOS, and this website (audior.app).

The short version: Your book pages, recordings, transcripts and API keys stay on your device, and we never receive them. A few things do leave the desktop app, and each is described on this page together with what is sent, who receives it and how long it is kept: the free trial's allowance check, licence activation, update checks, the downloads the Chatterbox setup makes, feedback you choose to send, and analytics and crash reports if you turn them on.

Data Controller

Creatiwi AI
Republic of Poland
Contact: privacy@creatiwi.ai

What Data We Don't Collect

Audior is a privacy-first application. We do not collect, process, store, or transmit:

• Your book pages, images, or documents
• Transcribed text or generated audio
• Voice samples used for cloning
• Your API keys for third-party services
• Usage analytics or crash reports, unless you turn them on
• Account data: Audior has no accounts, so there is no profile, login or password to hold. A Yoto account you connect belongs to Yoto, and its sign-in token stays on your device

How Your Data is Handled

Local Processing

All OCR (text extraction) and text-to-speech processing can be performed entirely on your device using local AI models (Ollama, Chatterbox, Fish Speech). When you choose local processing, your data never leaves your computer.

Cloud API Services

If you choose to use cloud-based AI services (Google Gemini, OpenAI, Anthropic, OpenRouter, ElevenLabs, Gemini TTS), your data is transmitted directly from your device to those third-party services. We do not proxy or store this data. Your use of these services is governed by their respective privacy policies:

• Google Privacy Policy (Gemini)
• OpenAI
• Anthropic
• ElevenLabs Privacy Policy
• OpenRouter Privacy Policy

API Key Storage

Your API keys are encrypted on your device using Electron's safeStorage, which takes its encryption key from your operating system's own keystore, and the encrypted values are written to the application's configuration file. The underlying keystore is:

• macOS: Keychain
• Windows: DPAPI (the Data Protection API, tied to your Windows user account)
• Linux: libsecret (GNOME Keyring) or kwallet

The keys are not stored as entries in the Windows Credential Manager. We never have access to them. If no OS keystore is available (typically Linux without a keyring daemon running), the app falls back to storing the key unencrypted, and tells you so in Settings when it does.

Project Data

Your projects and transcripts are stored locally in a SQLite database on your device, and the generated audio files are written to disk alongside it, with the database holding references to them. This data is never transmitted to us or any third party, except to the cloud services you choose to use (above), in feedback you choose to send (below), to a media server you control if you upload to it, or to Yoto if you send audio to a Yoto account you have connected (next section).

Yoto Uploads

The desktop app and the mobile app can both send finished audio to the Make Your Own library of a Yoto account. This is optional: nothing is sent until you connect the account and start a send yourself. You sign in on Yoto's own website (login.yotoplay.com) in your browser (on iOS, in the system sign-in sheet, which the app cannot read), so the app never sees your Yoto password. Yoto then hands the app a token limited to your Make Your Own content (viewing, creating, editing and deleting it, and viewing, uploading and editing your custom icons; Audior creates playlists, and edits only a playlist you choose to add a recording to) and to staying connected. The app cannot read your family, your players or your account details. So that you can add to a playlist you already have, it does read the list of your Make Your Own playlists, with their titles and cover images, when you open the Yoto send sheet.

When you send, the app first passes each file's checksum to Yoto's API (api.yotoplay.com), so a file Yoto already holds is not uploaded twice, then uploads the audio over an encrypted (HTTPS) connection through the short-lived upload link that API hands back, and finally asks the API to create the playlist. On desktop, WAV chapters are converted to MP3 first, each chapter becomes a track titled after its chapter file, and the playlist gets the title you enter; the mobile app cuts the exported M4A into one track per chapter mark, titled after the chapter, and names the playlist and the file after the recording. A chapter longer than an hour is sent in parts, a book longer than five hours as several playlists, and a cover image you choose is uploaded with them. Each file's size and duration go with it, and, like any web request, so do your IP address and what your device's networking stack adds by default, such as the operating-system version or device model. Nothing passes through us. Yoto keeps the resulting playlist in your library under Yoto's own privacy policy; assigning it to a physical card happens in the Yoto app. Audio already uploaded before a send failed or was cancelled is not removed by Audior; how long Yoto keeps it is Yoto's decision.

The token is stored only on your device: on desktop, encrypted with the same safeStoragemechanism as your API keys (if no OS keystore is available, the app does not keep the token and asks you to sign in again next time); on Android, encrypted with a key held in the Android Keystore; on iOS, in the Keychain. Disconnecting deletes the token from your device and nothing more: it does not ask Yoto to revoke the authorisation, and playlists you have already uploaded stay in your Yoto library until you delete them there.

Legal basis: performing the upload you asked for (Article 6(1)(b) GDPR).

What the Desktop App Sends, and How Long It Is Kept

Free Trial Allowance Check

Every copy of the desktop app, including one with a licence installed, checks the free trial's allowance against a server we operate. It registers the first time it starts after setup, and checks the allowance each time it starts and as you use it. These requests send an identifier computed from your computer's network adapter addresses (or, if it has none, from a random value stored on it), how many projects and pages you have used, your operating system and the app version. They never send your content, filenames or API keys. This is how the trial limit survives a reinstall, so the check is requiredrather than optional.

The server keeps one record per identifier, holding those counts, the operating system, the app version, and when the identifier was first and last seen. The record is deleted automatically two years after it was last updated. It is updated when the app registers and whenever it reports the projects and pages you have used. An ordinary launch only reads it and does not extend it, but a launch after the app's local trial file was deleted or became unreadable registers again, and that does. If your computer's network adapters change, the identifier changes and a new record is started.

Legal basis: providing the trial you asked for (Article 6(1)(b) GDPR), and our legitimate interest in preventing one computer from restarting the trial indefinitely (Article 6(1)(f) GDPR).

Licence Activation

Licences are sold through Polar(Polar Software Inc., USA), which acts as the merchant of record and handles your email address and payment under its own privacy policy. When you activate a licence in the app, the app sends Polar your licence key, the same hardware-derived identifier described above, your operating system and the app version, so that the licence is tied to the computers you activated it on. When you open Settings, and at least seven days have passed since the last successful check, the app re-checks the licence with Polar, sending the key and the identifier again.

Legal basis: performing the licence agreement (Article 6(1)(b) GDPR).

Feedback You Send

The feedback form in the desktop app sends what you type to a server we operate. It always adds the app version, your operating system and its version, which OCR and text-to-speech providers you have selected, the app's language, and whether a licence is installed. A bug report also includes up to the last 50 lines of the app's log file, cut to 2,000 characters; that option is ticked by default and you can untick it before sending.

Before anything is sent, the app tries to remove file paths, email addresses and long strings that look like API keys. This is best-effort: paths containing spaces or in less common formats, keys containing dashes, and the book titles, chapter titles and filenames the app writes to its log can still get through. Check what you include, and untick the logs if they might hold something you would rather not send. Feedback carries no identifier linking it to your computer or to your trial, although our server's short-lived request logs (below) record the IP address it came from.

The server keeps a copy for 90 days and then deletes it automatically. It also posts the same text to a private channel in Slack (Slack Technologies, USA), the messaging service our team uses to read it, where it stays until we delete it.

Legal basis: our legitimate interest in answering feedback and fixing the problems it reports (Article 6(1)(f) GDPR).

Prices and Updates

After you accept the terms, the app downloads current provider prices from our server, so that its cost estimates stay accurate. That request carries no identifier.

About ten seconds after launch, the app asks GitHub, where our releases are published, whether a newer version exists, and downloads it automatically if there is one. Each check sends a random identifier that the update component creates once and stores on your computer; it is not derived from your hardware and is not linked to your trial or licence. Like any request, the check also shows GitHub your IP address. It runs even before you accept the terms, so that security fixes reach every installed copy.

Voice Cleanup Model

When you run the Chatterbox setup, the app also downloads the model it cleans captured voices with (DPDFNet, about 11 MB). It comes from models.audior.app, our own file host on Cloudflare R2 (Cloudflare, Inc., USA), or, if our host cannot be reached, from GitHub, where the sherpa-onnx project releases it. The same setup installs its Python packages from the Python Package Index (PyPI) and the Chatterbox speech model from Hugging Face. None of these requests carries audio or personal data, but like any request each shows the host your IP address. Cleaning runs on your computer and sends nothing anywhere.

Where Our Server Runs

The server behind the trial check, prices and feedback runs on Cloudflare Workers, and Cloudflare, Inc. (USA) processes this data on our behalf. Records are stored in Cloudflare's key-value storage, which replicates across its global network and is not limited to the European Union. To limit abuse, the server holds your IP address as a rate-limit counter until 60 seconds after your last request. Cloudflare also keeps technical logs of each request, which can include your IP address and the trial identifier, for up to 7 days. Errors on this server are reported to Sentry without IP addresses or the trial identifier.

Cloudflare, Slack, GitHub and Polar may process this data outside the European Economic Area, under the data-protection terms each of them offers.

Mobile App — Audior (Android and iOS)

Audior is a microphone-based audiobook narration recorder. The same privacy-first principle applies: your recordings stay on your device.

Recordings & Microphone

Audio you record is written to your device's private app storage and is never uploaded to us. It leaves your device only when you send it somewhere yourself, in one of three ways: exporting to a media server (Audiobookshelf) that you configure and control, sent directly to that server over an encrypted (HTTPS) connection; sending it to the Make Your Own library of a Yoto account you have connected, as described under Yoto Uploads above; or handing the file to another app through your phone's system share sheet, in which case that app's own privacy policy applies.

On-Device Speech Recognition

Optional transcription runs entirely on your device using a local speech model (sherpa-onnx) — your audio is never sent anywhere for transcription. The first time you enable it, the model file is downloaded from one of the hosts named below. The model is about 640 MB, so it is worth starting the download on Wi-Fi. The app repeats the size on the download button before you begin.

Noise reduction also runs on your device, using a small model of about 10 MB. While noise reduction is on, the app may start downloading this model in advance while it is open (on iOS the system may finish that download later, in the background), but only over a connection your phone reports as unmetered, such as Wi-Fi (this can also be a mobile connection on an unlimited plan), and never while Low Data Mode (iOS) is on or Data Saver (Android) restricts the app. Otherwise the model is downloaded the first time you use noise reduction. If you delete the downloaded models in Settings, the app stops downloading it automatically until you use noise reduction again or switch it on in Settings.

Both models come from models.audior.app, our own file host on Cloudflare R2 (Cloudflare, Inc., USA). If it cannot be reached, the app falls back to the publishers of the models: Hugging Face for the speech model, GitHub for the noise-reduction model. A download request carries no audio and no personal data, but like any request it shows the host your IP address. Cloudflare, Hugging Face and GitHub may process it outside the European Economic Area.

Voice Samples

Voice-cloning samples you record are stored locally on your device and are gated behind an explicit consent step. We never receive or store them.

Analytics & Crash Reporting (opt-in, off by default)

The mobile app can use Firebase Analytics and Firebase Crashlytics for anonymous usage statistics and crash diagnostics. These are disabled by default. The app asks you once, in a prompt inside the app, and you can also change the answer in Settings at any time. When enabled, they collect app-interaction events, crash logs, and a device identifier — never your recordings, transcripts, or voice samples. Advertising-ID collection is disabled.

The same consent also governs Firebase Remote Config, which we use to switch small pieces of the app on and off remotely. Until you consent, the app does not contact it at all, because that request would send a Firebase installation identifier.

Permissions

The app requests the microphone permission (to record) and, on Android 13 and later and on iOS, the notification permission (on Android, to show the ongoing "recording" indicator and progress while the app works in the background; on both, to tell you when an export, clean-up or import has finished). No location, contacts, or other sensitive permissions are used.

Website Analytics

This website (audior.app) uses Plausible Analytics, a privacy-focused analytics service that:

• Does not use cookies
• Does not collect personal data
• Does not track you across websites
• Is fully GDPR compliant

Besides page views, we record when a download or call-to-action button is pressed (for example, a "Download for Windows" button, or the Google Play button). Each event carries which button it was and where on the page it sits, alongside the same aggregate information Plausible already records for an ordinary page view — never a cookie or an identifier tied to you — and exists so we can see which parts of the site lead to a download, not who downloaded.

Error Monitoring

This website and the desktop app both use Sentryto report technical errors, so that a page or a feature failing for you is something we can see and fix. Sentry reports carry the error and the technical context around it. We configure it not to send personal information, IP addresses, or your machine's hostname. In the desktop app this is opt-in crash reporting, off by default until you enable it in Settings.

The desktop app asks once whether you want to share usage statistics and crash reports, and one answer covers both; you can change it in Settings at any time. Until you agree, neither is sent. With your agreement, usage statistics go to Aptabaseand record which screens you open and which features you use (for example that a project was created or an export started, with project identifiers removed), and crash reports go to Sentry. Usage statistics also carry a session identifier that changes over time, your operating system and its version, the app version and the app's language. Crash reports carry a random installation identifier stored on your computer, so that a report you tell us about can be found. We use the European Union hosting of both services.

Your Rights Under GDPR

As a data subject in the European Union, you have the following rights:

• Right of Access: You can request information about any data we hold about you.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your data.
• Right to Data Portability: You can request your data in a portable format.
• Right to Object: You can object to processing of your data.
• Right to Withdraw Consent: You can withdraw consent at any time.
• Right to Lodge a Complaint: You can complain to a data protection authority. In Poland, that is the President of the Personal Data Protection Office (UODO).

Most of what Audior handles never reaches us. The exceptions are the records described above: the trial record, feedback, crash reports if you turned them on, and short-lived request logs. None of them holds your name or email address, so we can find a trial record only by its identifier, feedback by when you sent it and what it said, and a crash report by its installation identifier. If you bought a licence, Polar holds the same hardware-derived identifier together with the email address used for the purchase. Write to us at privacy@creatiwi.ai and we will help you locate and delete any of them.

Children's Privacy

Audior is designed for use by adults. While the application helps create content for children (audiobooks), it is operated by parents or guardians. We do not knowingly collect data from children under 16.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date at the top of this page.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@creatiwi.ai