Privacy Policy

Who is responsible

Textwhisk is operated by [TO BE PROVIDED: legal operator name], at [TO BE PROVIDED: full business address and country]. Privacy and rights contact: [TO BE PROVIDED: privacy email]. Website: https://Textwhisk.app/ · DNS/domain configuration to be completed by the operator. These placeholders are not working contact channels.

Effective date: [TO BE PROVIDED: approved publication date]. This draft is not a statement of worldwide compliance. Applicable laws and any EU/UK representative or data protection officer requirement must be assessed; no appointment is asserted.

Current website data

The browser demo changes text locally. Its text is not submitted by this page. The current website has no account, contact form, newsletter, payment collection or Google Analytics. ShareThis loads immediately as a third-party script. Fonts and images are served locally; no Google font service is contacted.

After you explicitly save a cookie preference, this browser stores the decision, schema version and timestamp in local storage. The choice is honored for 180 days; the record may remain until overwritten or cleared. No identifier or demo text is stored with it. This is used only to remember your privacy choice; it is not sent to the operator. See the Cookie Policy.

Serving the website exposes ordinary request information to the server, such as IP address, requested path and browser headers. Production hosting/CDN provider, logged fields, purposes, access controls and retention: [TO BE PROVIDED: hosting and log-processing details]. Do not put secrets in website URLs.

Planned analytics—disabled

Google Analytics 4 is planned but is not installed or active. The local preference choice does not control ShareThis, which loads immediately. Before activation, the operator must complete the policy, provider/processor terms, transfer assessment and actual property configuration, and seek a fresh opt-in for the new processing.

If enabled later, analytics would measure website use only after opt-in; optional tracking must remain blocked before consent, after refusal and after withdrawal. Intended event fields, cookies and retention: [TO BE PROVIDED: verified GA4 configuration]. Demo text, selections, clipboard data, prompts, keys and license details must not be collected. Advertising, Google Signals, User-ID and enhanced measurement are not part of this draft setup.

Mac app: local processing

The app reads selected text after macOS Accessibility permission is granted. It briefly uses and restores the clipboard while reading selections. Local operations include case changes, clipboard append, favorites, offline spelling, counts, plain-text paste and saved Rule-based actions. Favorites (up to 50), custom actions, preferences and cached exchange rates are stored in the app’s local data folder. Your OpenRouter key is stored locally through Electron safeStorage using macOS Keychain.

Create action → Paste code needs no AI request. Describe sends your description to OpenRouter only when Create is invoked to generate rule code; the saved rule then runs locally in a restricted sandbox. Prompt-based creation stores your prompt locally without calling AI. Optional Try sample and each action run send the sample or selected text and prompt to OpenRouter when invoked.

Create action in v0.12.0 was confirmed on Mac by the maker, not every feature individually. The replacement regression reported on v0.7.1 remains unresolved. This notice does not imply a release-ready download or a guaranteed secure sandbox.

AI and external services

Summarize and Translate send selected text to OpenRouter using your own key when invoked. Summarize link fetches the linked page from your Mac without your browser logins and sends extracted text to OpenRouter. The requested site and services receive ordinary network metadata.

OpenRouter forwards inputs to a selected or automatically routed model provider. Provider retention and use for model training or improvement vary. Review OpenRouter’s privacy policy, routing settings and the actual model provider’s terms before sending sensitive, confidential or third-party information; Textwhisk does not promise zero retention or no training. Only submit information you have an appropriate basis and permission to share.

Currency tools fetch exchange-rate data from ExchangeRate-API and cache it locally; selected prices are converted locally rather than sent to that service. Dodo Payments is proposed for future sales only; no payment or license collection is active on this website. Exact contracting entities, roles and payment disclosures: [TO BE PROVIDED: approved sales setup].

Purposes and legal bases

Potential operator processing purposes are website delivery/security, responding to support or rights requests, honoring privacy choices and, if later activated, consent-based analytics or fulfilling purchases. This is not consent to all processing. For each actual data flow the operator must confirm whether contract necessity, legal obligation, legitimate interests or consent applies, including any legitimate-interest assessment.

[TO BE PROVIDED: purpose-by-purpose data categories, lawful bases and recipient roles]. Browser-local app processing is distinct from data received by the operator or an external provider. A generic website consent control does not authorize uploading other people’s personal data to AI.

Retention, transfers and security

The website preference stops being honored after 180 days. Cookie preferences changes or withdraws the choice; browser storage controls remove the record. App favorites and actions can be deleted through the app; complete app-data removal and uninstall guidance must be verified before release. Server/support/purchase records and retention periods: [TO BE PROVIDED: retention schedule]. External providers have their own retention practices.

Hosting, AI routing and future payment providers may process information outside your country. Relevant countries, recipient entities and applicable transfer safeguards: [TO BE PROVIDED: provider and transfer assessment]. No adequacy or contractual safeguard is assumed merely because a vendor is used.

Security measures must be proportionate to actual processing. No system is completely secure. [TO BE PROVIDED: verified operator security controls and incident-response process]. No sale/sharing for targeted advertising is implemented in the current website source.

Choices, rights and complaints

You can reject optional preferences, change your choice or withdraw it using Cookie preferences on every page. Withdrawal does not affect the lawfulness of earlier processing based on valid consent. These controls do not stop ShareThis or withdraw data already sent to it. App users can control Accessibility permission, whether to supply a key, which AI actions to invoke, and local favorites/actions.

Depending on applicable law, you may have rights to access, correct, erase or receive your personal data, restrict or object to processing, withdraw consent and complain to a competent privacy authority. These rights can have exceptions; response periods and verification depend on the law and request. We should request only proportionate identity information, not passwords or API keys.

Rights/complaints route and handling procedure: [TO BE PROVIDED: working privacy contact, applicable authority information and response process]. No live request form is offered yet.

Audience and changes

The intended age range and handling of children’s information are not finalized: [TO BE PROVIDED: audience/minimum-age assessment]. The preview does not ask for ages or create child accounts. If children will be targeted, obtain appropriate review before launch.

Material changes, including enabling analytics or payments, require updated notices and any required fresh consent before processing starts. This draft must be replaced with reviewed, dated information before public launch.