Privacy

Requests for other platforms

On the home page, the “On a different machine?” section has a “Request support” form. It collects the email address you enter and the platforms you select. This is a request for VerbaIDE to support other platforms.

What it's used for

We use your email to reply to the request and notify you when the requested platform becomes available. It is not added to a general newsletter or advertising list.

How long we keep it

We keep the email and note from a form only for as long as it takes to answer it and, after that, in case you follow up. Email us and we'll delete or send you a copy of what we have sooner.

Analytics

The banner offers “Allow” and “Don’t allow”. “Allow” enables site analytics and advertising measurement. Through “Settings” you can allow analytics without advertising measurement, or decline both. Nothing is selected in advance. Before you choose, and after a full refusal, Google Analytics and Microsoft Clarity are not loaded and no events are sent to them or to our own counter. We save the versioned choice in localStorage and an essential first-party preference cookie for up to one year; these remember your choice across pages and are not analytics identifiers. An old “Accept” does not permit advertising measurement: we ask for a new choice.

With analytics enabled, Google Analytics 4 (Google) receives page addresses, referrers, page/section views, button and download interactions, video viewing and browser/device information. Requests expose your IP address to the recipient; we do not describe this as fully anonymous. Google may set first-party identifiers such as _ga cookies to associate visits. Microsoft Clarity (Microsoft) receives page and device information, clicks, scrolling and mouse movements for session recordings and heatmaps that help us improve the site. Form inputs are masked by Clarity; masking is not a promise that every item on the page is anonymous. Clarity's analytics cookies include _clck and _clsk. Clarity advertising storage remains denied in every mode. See Google's privacy policy and Microsoft's privacy statement.

Our counter (WD Studio) sends page paths, language, referring site, campaign tags (UTM), sections reached, button/plan interactions and video viewing durations to api.verbaide.com/api/telemetry/web-events. With analytics consent it stores a random visitor identifier in localStorage and campaign tags in sessionStorage to associate steps. Requests also expose the IP address and request metadata to our server. It does not collect form input content.

Advertising measurement is a separate permission. With only site analytics enabled, Google's ad_storage, ad_user_data and ad_personalization remain denied; we omit ad-click identifiers from the page/referrer addresses supplied to GA4 and block download_click from all three event senders. With both purposes enabled, analytics_storage, ad_storage and ad_user_data are granted. Google can use advertising identifiers, including identifiers in an incoming ad link, and an eligible download click to measure campaign results and improve bidding through the GA4 conversion imported into Google Ads. download_click means clicking a .dmg link on a desktop Mac; other devices use download_click_other, which is not intended as an advertising conversion. Ad personalization and remarketing stay disabled (ad_personalization: denied); this choice does not enable them.

You can change or withdraw consent through “Cookie preferences” in the footer on any page. Withdrawal immediately blocks further disallowed events and clears pending events and the corresponding identifiers/cookies accessible to this site. Reducing consent reloads the page to unload the previously running tools. The site cannot delete cookies belonging to Google or Microsoft domains or erase data already received by those services. If browser storage is unavailable, the site handles that without granting consent automatically; if it cannot save your choice, it asks again on the next page.

Cloudflare Web Analytics is separate from these consent-based tools. Its beacon runs before a choice and after refusal to measure page views and page performance, including load times and Core Web Vitals. It sends page address, referrer, browser/OS/device and timing information to Cloudflare; country is derived from the network request. According to Cloudflare's documentation, it does not use cookies, localStorage or fingerprinting to identify visitors. Cloudflare still receives the network request, including its IP address. This is not the same as cookie-based advertising tracking, and these consent settings do not disable that beacon. See Cloudflare's privacy policy.

reCAPTCHA

Google reCAPTCHA protects our forms. Its script loads on your first interaction with a page that has a form (for example, scrolling, clicking or focusing the email field); submitting the form requests a risk score. See Google’s privacy policy and terms of service.

Website bug reports

The “Report a bug” button opens a report form. Only pressing Send submits your description, optional email and screenshot, the page address, browser information and viewport size to api.verbaide.com. Check the screenshot before sending: it can contain information visible on the page. The optional email is remembered in session storage for the current browser session. Reports are kept until manually deleted; screenshots are scheduled for deletion after 90 days. To request deletion, write to [email protected]. This website form is separate from the Mac app’s dictation-report feature.

With site-analytics consent, account and plans pages are measured too. If the app link or a successful web sign-in identifies your account, we use that account ID as Google Analytics User-ID, a Clarity custom user ID and an account_id on our own events. We remember it for the browser tab in sessionStorage and remove it on full withdrawal. Without a known account we use the existing anonymous visitor identifier. Email addresses, passwords and one-time tokens are removed from measured page addresses; the original parameters remain in memory and the current navigation entry for sign-in and payment, so refreshing the page does not lose them. Checkout events describe opening, loading, closing, completion or errors; a browser completion event does not independently verify a settled payment.

Videos

Demo videos are hosted on YouTube. Until you press play, the page shows a preview image from our own site and makes no requests to YouTube. Pressing play loads the YouTube player in privacy-enhanced mode (youtube-nocookie.com); from then on YouTube receives the usual request data, such as your IP address, under Google's privacy policy. The "Watch on YouTube" link simply opens the video on youtube.com.

Sign in with Google

When you choose Continue with Google or Connect Google in the app, your browser opens Google authentication. Google sends our server your account identifier, email address and profile name so we can create your VerbaIDE account, sign you in, or connect Google to your existing account. This is separate from consent to usage counters. No recordings, transcripts or translations are sent to Google. You can also sign in with email and password. Google processes the authentication under its own privacy policy. Google Privacy Policy.

What the app sends over the network

VerbaIDE processes recognition, translation and text processing locally, without uploading audio or text for processing. Speech recognition, translation and text processing all run on your Mac, on models stored there. There is no history of your dictations on our servers, because none is ever sent. The only exceptions are two reports you send yourself — a dictation report and a Smart Keyboard bug report — see below.

The app reaches the network only for the following, and none of these requests carries audio or language content (only the dictation report and the Smart Keyboard bug report below do):

Signing in, and creating an account during first-run setup — your email, your password, and a signature made with your installation key.
Your newsletter preference — only if you tick or untick “Receive news and updates emails from VerbaIDE” (off by default, shown only when you are signed in). It is sent with your account session and stored as an opt-in for news emails; every such email has an unsubscribe link. No record means you are not subscribed.
Your answers on the optional “about you” screen of first-run setup — what you use VerbaIDE for, your occupation and where you heard about us. They are chosen from fixed options (no free text), sent once and only when you press Done, with your account session, and kept with your account until you delete it. Skip sends nothing. This contains no voice and no dictated text.
Fetching the licence token that says which features you paid for. When you are signed in, the sign-in, each licence-token refresh (once a day, or after four hours of use) and the start of a trial also carry your macOS language, the app version and how long the app was in use since its previous refresh; the trial start also carries a one-way fingerprint of the Mac's hardware (a hash of its hardware ID; the ID itself is not sent). The server records the IP address, country and city the request came from. This keeps it to one trial per Mac and at most five devices per account, and shows when one account is used by several people. IP address and city are kept for 90 days, the rest for as long as the account exists.
Usage counters, and only if you agreed to them. These are numbers and fixed labels: how long a dictation took, how many characters came out, which mode, language, preset and speech model were used. Never the text itself, and never the name of the app you dictated into.
Checking for a new version — once a day and when you press the button in About. The app reads the version list at cdn.verbaide.com/downloads/appcast.xml and sends nothing about you; the daily check can be turned off with a checkbox in About. A new version is installed only after you press Install.
Translation dictionaries from cdn.verbaide.com: the catalogue when you open Settings or pick your languages, the dictionary files when you download them. Both without cookies or authorization headers.
The main speech model: during the trial and on paid plans our fine-tuned build from cdn.verbaide.com; on the free tier NVIDIA's original Parakeet from huggingface.co, without asking our registry. If the registry has never answered, a paid user may get the original model from huggingface.co first. The additional term model comes from huggingface.co. Dictation needs the main model, including on the free tier. When your plan changes, the model you no longer need is removed and the other one is downloaded.
The speech-model registry at cdn.verbaide.com/recognition: at launch and at most once a day, only during the trial, on a paid plan, while first-run setup is open (the trial starts on its first step), or while our model is still installed and the app has not yet confirmed that your plan has ended. It checks available versions; replacing an installed model requires your approval.
The optional speaker-identification model from huggingface.co, only when you press its download button. Speaker identification is experimental and may merge or split speakers incorrectly.
The local language model — its catalogue and manifest from cdn.verbaide.com, its weights from huggingface.co — and only once you have asked for the download.
The term judge model from cdn.verbaide.com/intelligence/term-judge — only on a paid plan or trial, with dictation improvement turned on and at least one term in your term lists. It downloads by itself in the background, without cookies or authorization headers. Free users never download it. Smart Keyboard downloads the same model, from the same address, once — when Smart Keyboard starts listening to the keyboard.

On Windows, this list is the same, with a few differences. The licence-token request carries your Windows display language instead of macOS language, and the one-way hardware fingerprint sent only with the start of a trial is a hash of the PC's MachineGuid rather than a Mac hardware ID — same salt, same format, same rule: never with an ordinary sign-in or token refresh. Checking for a new version reads a separate, Windows-only list at cdn.verbaide.com/downloads/windows/appcast.json, unrelated to the Mac list in any way; a copy installed from the Microsoft Store does not check for updates at all, because the Store updates it. The main speech model comes from github.com/k2-fsa/sherpa-onnx on the free tier, and from our own registry at cdn.verbaide.com/recognition/parakeet-onnx.json during the trial and on paid plans — a separate pointer and separate files from the Mac app's, built for a different engine. Signing in with Google, the newsletter preference, the “about you” answers and the dictation report (opened with Ctrl+Alt+Shift+B instead of ⌃⌥⌘B) work exactly as described above. See What leaves your PC for the complete Windows list in one place.

The first exception: a dictation report you send yourself. First enable the independent “I want to help improve speech recognition and Smart Keyboard” checkbox beside statistics consent in the app. It is off by default and sends nothing automatically. With it enabled, pressing ⌃⌥⌘B opens a window where you can browse your last three dictations. These are kept only in memory until you quit the app. Send submits only the selected dictation. With it off, the report menu item is hidden, the shortcut does not open the window, and sending is blocked. Nothing leaves your Mac until you press Send in that window. Then the app sends: the recording of that one dictation, the recognized text, the translation (for a dictation with translation), your corrections, your email if you typed one, the versions of the app, macOS and the installed models and dictionaries (recognition, translation, local AI) — names and versions only, and an anonymous installation identifier — a fingerprint of the installation key, not your account, used only to limit how many reports one installation can send.

The report goes to our server at api.verbaide.com. The recording is stored in our file storage under an unlisted link, and the texts become a task in the developers' internal tracker that points to that link; your email stays on our server and is not copied into the task. We keep the report until we delete it by hand — there is no automatic deletion yet. To have a report deleted sooner, email [email protected].

Suggest a Feature. The “Suggest a Feature…” menu item opens a window with one text box. Nothing is sent until you press Send. Then the app sends only the text you typed, the versions of the app and macOS, and the same anonymous installation identifier. No audio and nothing from your dictations. The idea becomes a task in the developers' internal tracker and is kept until we delete it by hand.

Smart Keyboard bug report. With the same checkbox enabled, pressing ⌃⌥⌘K opens the same kind of window with a draft: the sentence you were typing (from the start of the line or sentence up to the cursor), what Smart Keyboard changed last (what you typed → what it became), and a “Should be” line for you to finish. While the checkbox is on, Smart Keyboard keeps that last change in memory only, for ten minutes, and forgets it when you quit the app or turn the checkbox off. It does not read password fields, search boxes, address bars or apps you excluded. The draft is yours to edit or delete. Nothing is sent until you press Send. Then the app sends the text exactly as shown in the window, the versions of the app and macOS, and the same anonymous installation identifier. With the checkbox off, the shortcut does nothing and sending is blocked. The report becomes a task in the developers' internal tracker and is kept until we delete it by hand.

That is the complete list. If you need it in writing for a security review, email [email protected].

Accessibility permission (the Mac app)

VerbaIDE asks for the Accessibility permission on macOS to insert the text it recognized into the field you're already typing in, wherever that is. Dictation does not watch what you type. When Smart Keyboard is on, VerbaIDE uses the same Accessibility permission to listen to key presses and type corrections for text entered in the wrong layout. Smart Keyboard is a paid feature. Keys are processed on your Mac; typed text is not logged or sent; the list of words you told Smart Keyboard to leave alone is stored only on this Mac. To correct keyboard layouts, Smart Keyboard uses Accessibility to read the field text before the cursor back to the start of the sentence or the number of previous words set in settings. Reads are limited to 16,384 UTF-16 units; if the required start is unavailable, no correction is made. The text stays in memory and is forgotten after the decision; the last correction is kept for undo. To correct an individual letter, it may also read up to 64 characters on each side of the cursor. Search boxes, address bars and password fields are never read. VerbaIDE does not ask for a separate Input Monitoring permission.

Payments

Buying a plan hands your billing details — name, email, card or bank details, country — to Paddle, our reseller and Merchant of Record, so it can run the charge, calculate tax and issue receipts. Paddle processes that data as an independent controller under its own privacy policy. From Paddle we receive the order details needed to give you access — your email, country, plan and order status — never your card or bank details.

Your requests

Email [email protected] to see, correct or delete the data we hold about you, or to ask a question about this page. For an order made through Paddle, Paddle is the one holding the billing record — see its buyer help for account and data requests about a specific order.

Contact

Questions about this page or your data: [email protected].

Updated: October 24, 2026