1. Who we are
Akova ("Akova", "the app", "we", "us") is a macOS dictation application developed and sold by Stavros Thalassinos, a sole proprietor established in Greece (VAT/ΑΦΜ EL160320426), registered address Thesi Alonaki 0, Prodromos, Paros, 84400, Greece.
For the purposes of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019, which implements and supplements the GDPR in Greece, Stavros Thalassinos is the data controller for the limited personal data described in this policy — that is, the party that determines the purposes and means of the processing (GDPR Art. 4(7)).
Contact for privacy matters: stavros.thalassinos@sthlabs.net
Because we are a small business established solely in Greece and process minimal personal data, we are not required to appoint a Data Protection Officer (DPO). You can reach us about any privacy question at the email above.
2. The one-sentence version
Akova transcribes your speech on your own Mac. Your audio and your transcripts are never sent to us, and by default they are never sent to anyone. The only personal data we ever handle is the minimum needed to sell you a licence, activate it on your Macs, and provide support.
3. How Akova processes your voice and text
This is the part that matters most, so we are explicit about it.
On-device by default. Akova records audio from your microphone only while you are actively dictating, transcribes it locally on your Mac using on-device speech models (WhisperKit / Apple speech frameworks), and pastes the resulting text into the app you are using. Optional text clean-up ("structuring") runs locally too — either through Apple Intelligence (on-device Foundation Models) or through a local Ollama model running on your own machine.
We never receive your audio or transcripts. Your recordings, partial transcripts, final transcripts, and any locally stored dictation history stay on your device. We have no server that receives them, no account that stores them, and no ability to read them.
Audio on your Mac. With history off (the default), audio is held in memory only while it is transcribed, then discarded. Nothing is written to disk. With history on, Akova also saves each recording as a file on your Mac, so a dictation is not lost if transcription fails. The file is deleted as soon as the text is delivered. If transcription fails, it is kept with that entry so you can retry. It is deleted when you delete the entry, use Clear All or Reset All Data, or when the entry passes the 500 entry limit. Audio files never leave your Mac.
Local history (optional, off by default). If you turn on "Save transcription history", up to 500 recent transcripts are stored locally on your Mac. They are not separately encrypted by Akova. They are protected by your macOS account and, if you use it, FileVault. You can search, export or delete them at any time. History is never uploaded to us.
Learned vocabulary (beta, off by default). In the version downloaded from this website, you can turn on Learned vocabulary in Settings, Vocabulary. Akova then reads your Claude Code session files from the last 30 days on your Mac to find the names and project words you use. It keeps only a list of up to 50 words, plus the words you removed, locally on your Mac. Session text is never stored, and nothing leaves your Mac: if you point Ollama at another computer, learned words are not sent to it. You can remove words, clear the list, or turn the feature off at any time. The Mac App Store version does not include this feature.
4. Optional cloud features (only if you turn them on)
Some features can, at your explicit choice, send data to a third party you select. These are off by default and none of them send data to Akova.
- Third-party cloud transcription / structuring (optional): If you choose to use a cloud transcription or language-model provider (for example an OpenAI, Groq, or OpenRouter API using your own API key), the relevant text and/or audio is sent directly from your Mac to that provider under their privacy policy and terms — not through us. You enter and store your own key; we never see it or the data you send. Review the chosen provider's privacy policy before enabling such a feature.
- Usage allowance metering (planned): Some future features may cost money to run for each use (for example cloud transcription or hosted larger models). Where such a feature is included in a paid plan with a monthly allowance, we would need to count how much of that specific feature you have used, in order to apply the allowance. That count is a number of units consumed and the date it was consumed — never the audio, the transcript, or anything you dictated. No such feature exists today; if one ships, its exact behaviour will be documented here first.
- Local network capture (planned): A future paired-device capture feature is designed to keep audio on your local network / devices and persist no audio. If and when shipped, its behaviour will be documented here.
If you never enable a cloud feature, Akova operates fully offline for its core dictation function.
5. Personal data we actually collect
We deliberately keep this list short.
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name and email address | To sell you a licence, deliver your licence key, send purchase receipts and important product/security notices | Performance of a contract (Art. 6(1)(b)) |
| Licence key and activation records (your licence ID and, for each activated Mac, a one-way hash of its hardware identifier, the Mac's name and the activation date; the record of each deactivation; and, for subscription licences once those launch, whether the subscription is active and the date the current period ends) | To validate your licence, enforce the device limit and, for a subscription, confirm it is still active | Performance of a contract (Art. 6(1)(b)); legitimate interest in preventing licence abuse (Art. 6(1)(f)) |
| Payment metadata (amount, currency, VAT charged, the billing address or country Stripe collects to calculate VAT, last-4/card brand, transaction ID, but not full card numbers) | To process your purchase, and because we are the seller: to meet our own VAT, invoicing and accounting obligations | Legal obligation (Art. 6(1)(c)); performance of a contract (Art. 6(1)(b)) |
| Support correspondence (emails you send us) | To answer your questions | Legitimate interest (Art. 6(1)(f)) |
| Website, download and update statistics (pages viewed on akova.app, time on each page and how fast it loaded, one event per download of the app, and one event each time the direct version of the app checks for updates; see §7 for exactly what each contains) | To understand which pages and links bring people to Akova, how many copies are in use, and to keep the site fast | Legitimate interest (Art. 6(1)(f)) |
| Optional, opt-in diagnostics/analytics (crash reports, anonymised usage events) — only if you consent | To find bugs and improve the app | Consent (Art. 6(1)(a)) |
We do not collect your microphone audio, your transcripts, your dictation history, or the contents of the apps you dictate into. We do not build advertising profiles, and we do not sell personal data.
6. How you buy Akova, and who processes payment
Akova is sold through two channels. The payment processor is the party that actually handles your card details:
- Direct purchase (from akova.app): we, Stavros Thalassinos, are the seller. Checkout is a secure payment page hosted by Stripe (our contracting entity is Stripe Payments Europe, Limited, Ireland). Stripe is our payment processor, not a reseller: we set the price, VAT is calculated at checkout and shown before you pay, and we are responsible for accounting for that VAT to the tax authorities. Stripe processes your card or wallet details to take the payment on our behalf. For its own purposes, such as preventing fraud and financial loss, choosing the banks and payment networks involved, and meeting its legal obligations (for example anti-money-laundering checks), Stripe acts as an independent controller under its own privacy policy: stripe.com/privacy . From Stripe we receive your email address, your name if you give it, your billing address or country, and the payment metadata listed in §5. We never receive your full card number. After payment, our own server on akova.app creates your licence key and emails it to you through Resend (see §7).
- Mac App Store purchase: payment, billing, tax, and refunds are handled entirely by Apple, acting as an independent controller, under Apple's Privacy Policy . For App Store sales we typically do not receive your name or email at all unless you separately contact us.
Subscription plans (planned). Monthly and annual plans are not yet available. When they launch they will be billed through the same two parties described above: Stripe for direct subscriptions, Apple for Mac App Store subscriptions. No new payment provider is introduced, and the only additional data involved is the subscription status and renewal date described in §5. Cancellation, renewal and refund terms for those plans will be set out in the Terms before they can be purchased.
We never store your full payment card number.
7. Third parties we share data with
We use a small number of service providers strictly to run the business, and we share only what is necessary. Every provider listed here is contractually or by policy required to give your data the same or equal level of protection as this policy.
The split below follows the GDPR's own definitions. A provider is our processor where it processes personal data solely on our behalf and on our instructions (Art. 4(8)), and we hold or rely on a data-processing agreement with it. A provider is an independent controller where it decides for itself the purposes and means of its processing (Art. 4(7)). Apple does this for App Store sales, where it is the seller. Stripe does it for the part of its processing that serves its own purposes, such as fraud prevention and its own legal obligations. For that data we cannot instruct them, and their own privacy policies govern it.
Our processors (act on our behalf, under a data-processing agreement):
- Stripe (Stripe Payments Europe, Limited, Ireland): taking payment on our behalf for direct purchases, calculating VAT at checkout (Stripe Tax), and emailing your payment receipt. Stripe also acts as an independent controller for some of this data; see below and §6.
- Resend (Plus Five Five, Inc., trading as "Resend"): sending your licence key and our support replies by email. Privacy policy: resend.com/legal/privacy-policy
- Vercel (Vercel Inc.): hosting akova.app, including the server function that receives Stripe's payment notification and signs your licence key, and Vercel Web Analytics for page views on akova.app. Web Analytics sets no cookies. It recognises a visit by a hash of the incoming request that is discarded after 24 hours, and records the page, the referring page, your approximate location, and your browser, operating system and device type, for aggregated statistics only. Privacy policy: vercel.com/legal/privacy-policy
- Railway (Railway Corporation): hosting our activation server at activation.akova.app. When you activate or deactivate a Mac, it receives your licence key, a one-way hash of the Mac's hardware identifier (never the identifier itself) and the Mac's name, and stores the activation records listed in §5. Privacy policy: railway.com/legal/privacy
- Cloudflare (Cloudflare, Inc.): the network and security layer in front of activation.akova.app and dl.akova.app. Requests to those addresses pass through it, including your IP address and, for activation, the data described under Railway. A small program we run on Cloudflare counts the app's update checks to dl.akova.app and passes that count to PostHog, described next. Privacy policy: cloudflare.com/privacypolicy
- PostHog (PostHog, Inc.): counting visits, downloads and purchases, stored
in PostHog's EU cloud (servers in Frankfurt, Germany). Events come from two
places. Pages on akova.app run PostHog's JavaScript library, which sends one event when you
open a page, one when you click a Download, Send to my Mac or Buy button, one the first time you play the demo video, one when you leave the page, and
one with page speed measurements when the page is hidden (you leave it or switch to another
tab or app); it sends them to akova.app,
which forwards them to PostHog, so your browser never contacts PostHog directly. Our server
sends one event when a download starts, when a Buy link sends you to checkout, when a
purchase completes, and each time the direct version of the app checks for updates (at
first launch, then about once a day while it runs). Requests that look automated, such as
link previews, prefetches and crawlers, still get the download or checkout but are not
counted. Each event contains only: which of those it was, the page path, the
website that linked you here (the host name only, never the full address), the
utm_source,utm_mediumandutm_campaigntags of the link if it had any, whether the visit was marked as our own testing, your country as reported by Vercel's or Cloudflare's network (server events), for an update check the app version, whether you were on a Mac or another platform, which button you used, whether the early-bird price was on offer when you clicked Buy, which discount code a Buy link from the app filled in (if any), for the page leave event how many seconds you spent on the page, for the page speed event up to four numbers measured by your browser (how long the first content and the largest content took to appear, in milliseconds; how long the page took to respond to your input, in milliseconds and only if you clicked, tapped or typed; and how much the layout shifted unexpectedly, as a score without units), and for a purchase the amount, currency, edition, whether a discount code was applied and how much it took off, and an order reference (a one-way hash of the checkout ID, so each order is counted once). Events from one visit share a random visit ID, so we can see that a visit which opened a page also downloaded or bought. The page creates this ID fresh when you arrive and passes it along in the links you click; it is never stored on your device, and a new tab or a later visit gets a new one. On a phone or tablet, Send to my Mac shares a link to akova.app that keeps the website and campaign tags you arrived with, but not the visit ID. It contains no IP address, no cookie, no browser identification string, no name or email, and no identifier that lasts beyond the visit, so separate visits cannot be linked to each other or to you, and PostHog builds no profile of you. Each update-check event gets its own new random ID, so update checks cannot be linked to each other, to a visit, or to you. Privacy policy: posthog.com/privacy - Sentry (Functional Software, Inc., trading as "Sentry") — automatic crash
and error reports, only if you turn them on (see §5; the app asks once, on
first run, and defaults to off). Reports are sent to Sentry's EU data region
(ingestion and storage at
de.sentry.io). A report contains the error, where it happened in Akova's code, the app version, and your macOS version. It does not contain your microphone audio, your transcripts, your dictation history, or anything you type; home-folder paths, email addresses and IP addresses are stripped on your Mac before the report is sent. You can withdraw consent at any time in Akova ▸ Settings ▸ Diagnostics, which stops any further reports immediately. Privacy policy: sentry.io/privacy
Independent controllers (their own privacy policy applies to the data they handle):
- Stripe: fraud and loss prevention, choice of banks and payment networks, and its own legal obligations, for direct purchases. Privacy policy: stripe.com/privacy
- Apple — payments and distribution (App Store sales). Privacy policy: apple.com/legal/privacy
The app sends usage analytics only if you allow it. Akova asks once, the first time you run it, and you can change your answer at any time with "Share anonymous usage statistics" in Akova ▸ Settings ▸ General (off by default). It then sends PostHog two one-time events, one for the install and one after your first dictation, each containing only the app edition, the app version and whether Pro is active, under a random ID made on your Mac that is not linked to your visit to akova.app. Otherwise, Vercel Web Analytics and PostHog, described above, only measure visits to akova.app (including time on each page and how fast it loaded), downloads of the app, update checks, and completed purchases. Crash and error reporting through Sentry is the only diagnostics processor for the app, and it stays off until you turn it on.
Licence keys are issued and validated by our own self-hosted, cryptographically signed system (Ed25519), and activations are counted by our own activation server. No third-party licensing provider is involved.
We do not sell your personal data and do not share it for third-party advertising.
8. International transfers
Some providers above may process data outside the European Economic Area (for example in the United States). Where that happens, transfers are protected by an appropriate GDPR safeguard — typically the European Commission's Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework. You can ask us which mechanism applies to a given provider.
9. How long we keep data
- Purchase, licence, and tax records: retained for as long as your licence is active and thereafter for the period required by Greek tax and accounting law (generally up to 5–10 years for invoices/tax documents), then deleted or anonymised.
- Activation records: each Mac's record is kept while that Mac is activated and deleted when you deactivate it. The record of a deactivation is kept for 30 days, to enforce the deactivation limit, then deleted.
- Support correspondence: typically up to 24 months after the issue is resolved.
- Visit, download, update-check and purchase statistics (PostHog): individual events are kept no longer than 12 months, then deleted; totals derived from them may be kept.
- Opt-in diagnostics: retained no longer than 12 months, then deleted or aggregated.
- On-device data (audio, transcripts, history): controlled entirely by you on your Mac; deleted when you delete it or uninstall the app.
10. Your rights under the GDPR
Because we are established in the EU, you have the right to: access your data, rectify inaccurate data, request erasure ("right to be forgotten"), restrict or object to processing, request data portability, and withdraw consent at any time (for anything based on consent, such as opt-in analytics) without affecting prior processing.
To exercise any right, email stavros.thalassinos@sthlabs.net. We will respond within one month as required by the GDPR. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with the Greek Data Protection Authority ( Hellenic Data Protection Authority / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, dpa.gr) or your local EU supervisory authority.
11. Children
Akova is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.
12. Security
We use appropriate technical and organisational measures to protect the limited personal data we hold, including transport encryption (TLS), access controls, and reliance on reputable processors. No system is perfectly secure, but because your voice and transcripts never reach us, the most sensitive data Akova touches is never exposed to us in the first place.
13. Changes to this policy
We may update this policy as the app evolves (for example when a new optional cloud feature ships). We will post the new version here with an updated "Last updated" date and, for material changes, notify you by email or in-app where reasonable. Related documents: Terms of Sale & EULA and Refund Policy.
14. Contact
Stavros Thalassinos
Thesi Alonaki 0, Prodromos, Paros, 84400, Greece
Email: stavros.thalassinos@sthlabs.net