Privacy Policy

Last updated: March 9, 2026

This policy covers the Kalam desktop application and the Kalam website at afaraha8403.github.io/kalam. It is maintained by Ali Farahat / Balacode ("we", "us", "our").

Short version: Kalam is a privacy-first app. Your audio is never written to disk. In local mode, nothing leaves your machine. In cloud mode, audio goes directly to your chosen provider (Groq/OpenAI) over TLS — we never see it. Your transcription history is stored only on your device. Any telemetry is opt-in and contains no audio or text.

1. Who We Are

The data controller for this application is:

As a small, independent, open-source project we do not have a Data Protection Officer, but we take our obligations seriously and will respond to all privacy enquiries promptly.

2. What Data We Collect and How

2.1 Audio and Transcriptions (App)

Your audio and transcription data is handled entirely according to the mode you select:

Mode What happens to your audio What reaches us
Local Processed on your device by a local model. Never leaves your machine. Nothing
Cloud Sent over TLS directly to your chosen provider (Groq or OpenAI) using your API key. Not written to disk. Nothing — we never see or store it
Hybrid Cloud when online, local fallback when offline. Same rules as above apply per path. Nothing

Transcriptions are saved locally on your device in a SQLite database for your personal history. You control the retention period in Settings > Privacy and can delete your history at any time.

2.2 Email Address (Optional — App Onboarding)

You may optionally provide an email address during onboarding to receive product updates and important notifications. This is stored locally on your device and may be sent to us if you explicitly opt in to product communications. We will never sell, rent, or share your email with third parties. You can delete it or opt out at any time.

2.3 API Keys (App)

Your API keys are stored locally on your device and transmitted only to the third-party provider you select (Groq, OpenAI, etc.) to authenticate your requests. We never receive or store your API keys on our servers.

2.4 Anonymous Telemetry (App, Opt-in)

If you opt in via Settings > Privacy, the app may collect anonymous, aggregated usage metrics such as session duration and feature usage counts. This data:

  • Never contains audio, transcribed text, API keys, or personally identifiable information.
  • Is used solely to improve the application.
  • Can be disabled at any time in Settings.
  • Is off by default.

2.5 Website Analytics

The Kalam website uses Google Analytics (gtag.js) to understand how visitors find and use the site. Google Analytics may collect your IP address (which Google anonymises), browser type, pages visited, and referring URL. This data is processed by Google under their own Privacy Policy.

You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on.

2.6 Website Fonts

The website loads fonts from Google Fonts. This may cause your browser to send your IP address to Google. See Google's Privacy Policy. The app itself does not use Google Fonts.

3. How We Use Your Data

Data Purpose Legal basis (GDPR)
Email address (opt-in) Product updates, release announcements, support Consent (Art. 6(1)(a))
Telemetry (opt-in) Product improvement, understanding feature usage Consent (Art. 6(1)(a))
Website analytics Understanding how users discover the project; improving the site Legitimate interests (Art. 6(1)(f))

4. Who We Share Data With

We do not sell your data. The only sharing that occurs is:

  • Your chosen STT provider (Groq, OpenAI, etc.) — receives your audio directly from the app when you use cloud mode. Governed by their own privacy policies.
  • Google Analytics — receives anonymised website usage data as described above.
  • GitHub — hosts the source code, issues, and releases. GitHub's Privacy Statement applies.

5. Data Retention and Deletion

  • Audio — never stored to disk; lives in memory only for the duration of a single dictation session.
  • Transcription history — stored on your device; retention period set in Settings (default: 30 days). Deleted at your discretion.
  • Email address — retained until you delete it in the app or contact us to request deletion.
  • Telemetry — retained in aggregate form for analytical purposes; cannot be individually identified or deleted.
  • Website analytics — retained by Google per their data retention settings (typically 14 months).

To permanently delete all local app data (history, settings, API keys), use Settings > Advanced > Reset entire application.

6. Your Rights

6.1 GDPR Rights (EEA/UK residents)

If you are in the European Economic Area or United Kingdom, you have the right to:

  • Access — request a copy of any personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure — ask us to delete your data ("right to be forgotten").
  • Restriction — ask us to limit how we use your data.
  • Portability — receive your data in a machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — withdraw consent at any time (e.g., by disabling telemetry in Settings).

To exercise these rights, email hello@balacode.io. Note: because most data is stored locally on your device and we hold very little server-side data, the practical exercise of many rights happens directly through the app (e.g., deleting history, resetting the application).

You also have the right to lodge a complaint with a data protection supervisory authority in your country.

6.2 CCPA Rights (California residents)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

  • Know what categories of personal information we collect and how it is used.
  • Delete personal information we have collected (subject to certain exceptions).
  • Opt out of the sale of personal information — we do not sell personal information.
  • Non-discrimination — we will not discriminate against you for exercising CCPA rights.

To make a request, email hello@balacode.io.

7. Security

We take reasonable technical measures to protect any data we handle. The application stores your transcription history in a local SQLite database. Your API keys are stored in your device's local application data directory.

Because most sensitive data (audio, transcriptions, API keys) never reaches our servers, the primary security responsibility for that data lies with you and your device. We recommend keeping your operating system and the application up to date.

8. Children's Privacy

Kalam is not directed at children under the age of 13 (or 16 in some jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided personal information, please contact us at hello@balacode.io and we will delete it promptly.

9. Third-Party Links

The website and application may contain links to third-party websites (GitHub, Groq, OpenAI, etc.). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies.

10. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will provide notice via the GitHub repository or release notes.

Your continued use of the application after any changes take effect constitutes acceptance of the updated policy.

11. Contact Us

For privacy enquiries, data subject requests, or any questions about this policy:

We aim to respond to all enquiries within 30 days.