Privacy Policy

Coii AudioNotes · Coii Ref · Coii VoiceInput

Effective 2026-10-10

This policy covers the three Coii applications and the websites they are sold from. Where an application does something the others do not, the section says which one it is talking about.

Changes

• 2026-10-10 — applications built with optional usage statistics. §1 and §3.5: each app can send a small, explicit set of usage events to PostHog US Cloud only after you opt in. The first-run checkbox is unchecked; Settings lets you change the choice at any time. Existing installations start with this off. Recordings, transcripts, notes, pictures, files, paths and search text still stay on your device. Earlier app versions retain their embedded policy.

• 2026-09-19 — all three applications. §3.5 said none of them has an in-app updater and none contacts a release server. That is no longer true of any of them: once a day each fetches a small file from the download server to learn whether a newer version exists. Nothing is downloaded or installed unless you press it, the request carries nothing about you or your machine beyond what serving any public file reveals, and a switch turns the whole thing off — off, the application makes no such connection at all. Where the answer is shown and where the switch is differ by application: Coii VoiceInput and Coii AudioNotes put both in Settings, and Coii Ref puts both in its menu bar, under its own name. §3.5 now says all of this, including the sentence about being licensed that used to promise no connection at all.

• 2026-09-10 — the websites, not the applications. §5: Google Analytics now also records which buttons and links you click on the four sites the applications are sold from — the download buttons, the Buy link, the navigation and the footer — and whether the pricing section came into view. It is the same script and the same cookies as before; what is new is that each of those clicks is sent as its own event, so that we can see how many readers who arrive actually reach a download. §1 still said the websites set no cookie and kept no identifier outliving a day, which stopped being true of those four sites on 2026-09-07; it is corrected there and not only in §5. Nothing an application sends has changed.

• 2026-09-07 — the websites, not the applications. §5 is rewritten. The four sites the applications are sold from now load Google Analytics, Microsoft Clarity and Lemon Squeezy's affiliate script, and the section says what each one records, which cookies it sets and who holds the result. The affiliate script runs only for a reader who arrived through an affiliate's link, and it is what lets a purchase made inside the application a month later be credited to that affiliate. The promise that these pages set no cookie and keep no identifier is withdrawn for those four sites; legal.coii.io still sets none. Nothing an application sends has changed.

• 2026-09-04 — the websites, not the applications. §5: the pages now count their own visits with Vercel Web Analytics and time their own rendering with Vercel Speed Insights. Neither sets a cookie or keeps an identifier that outlives the day it was computed. The section also names coii.io, which it had left out, and §1 now points at it. Nothing an application sends has changed.

• 2026-09-03 — all three applications. §4 names the merchant of record by the name it trades under rather than by a legal entity that has changed hands; its privacy policy, already linked there, is what governs the payment data and says who holds it. §9 is the support mailbox. What leaves your Mac is unchanged.

• 2026-09-02 — all three applications. The merchant of record is Lemon Squeezy. §3.3 lists its three License API endpoints in place of the previous ones and says what each application now receives back from validate; §4 describes what Lemon Squeezy holds and where you reach it. No new data leaves your Mac. §2 renames Coii VoiceInput's keychain item to io.coii.voiceinput.license and names the one it used before, which that application still reads.

• 2026-08-30 — first published. Replaces the separate policies each application carried before.

1. The short version

Your recordings, files, transcripts and notes stay on your device. There is no account to create. Optional usage statistics are off by default in each application, including after an upgrade. If you opt in, PostHog receives the limited usage events described in §3.5, which we can view to improve the apps. We never receive your audio, images, transcripts, notes, questions or searches. There is no automatic crash reporting or screen recording.

Each application does make a small number of network connections. They are listed exhaustively in §3, and none of them carries your audio, your files, your transcripts or their content. Optional usage events and coarse processing-time ranges are described in §3.5.

The websites also collect statistics separately. legal.coii.io, where you are reading this, counts page views and how quickly the page rendered without a cookie and without an identifier that outlives a day. The four sites the applications are sold from do more than that: they also load Google Analytics and Microsoft Clarity, which set cookies, record the pages you view and the buttons you click, and are held by those two companies rather than by us. §5 names every script, what each records and which cookie each sets. All of it is separate from the applications, which remain as this section describes them.

Purchase information is held by Lemon Squeezy, our merchant of record (§4). Optional usage statistics use an independent random identifier, never your email or license key.

2. What stays on your device

Every application keeps a copy of the licence key and the trial's start date in your macOS keychain, so that reinstalling does not cost you a device activation or reset your trial. It is readable only by you and by signed builds of that application. The keychain items are io.coii.audio.license, io.coii.ref.license and io.coii.voiceinput.license. Coii VoiceInput wrote to io.coii.wisper.license before 2026-09-02 and still reads that item if it is there, so a machine that activated under an earlier build keeps its activation; deleting everything that application holds means deleting both.

Everything else is below. Deleting the files named for an application and its keychain item deletes everything that application holds. There is no other copy anywhere.

2.1 Coii AudioNotes

Everything is written to ~/Library/Application Support/CoiiAudio:

• Audio is never written to disk. Samples are resampled, segmented, transcribed in memory and then dropped. There is no recording file, not even a temporary one. What remains of a meeting is its text.
• Voice prints are not identity. For speaker separation the app stores a small numeric vector per transcript segment. Those vectors are compared only against other segments in the same session; they are not matched against any database, not shared between sessions by default, and not sent anywhere. Speaker names you type are labels in your own database.

2.2 Coii Ref

Two locations, and nothing else.

Beside your own files. Everything the app knows about a folder you added is written into that folder, so that moving the folder moves the library with it:

Every name the app writes starts with coii-, and the whole prefix is reserved: anything in your folder with that prefix is ours and is skipped when indexing, so a folder can be handed back to you by deleting them.

Under your user library. ~/Library/Application Support/coii holds license.json — the trial's start date and activation state — and models/, where the semantic-search model goes if you install it.

• Reading a file locally is not sending it. To make a thumbnail the app hands a path to macOS's own tools (sips, qlmanage) and reads Spotlight metadata with mdls. Those are processes on your machine, they are given your file, and they hand back pixels or a string.
• Vectors are not identity. Semantic search stores a short numeric vector per item. It is compared only against other items in the same workspace; it is not matched against any database of ours, and it is not sent anywhere.

2.3 Coii VoiceInput

Everything is written to ~/Library/Application Support/CoiiVoice/:

• The audio is not kept. It is transcribed and discarded; there is no recording file.
• Running a model locally is not sending anything. The recognition model is a file in models/. Transcribing hands your audio to a process on your own Mac and gets text back. No part of that touches the network, which is why it works with the network off.
• The transcript reaches other applications only where you put it. The point of the app is to type into the window you were in, and — when it cannot type — to leave the text on your clipboard. Both are macOS handing data to software you chose. Anything you paste into a cloud application goes wherever that application sends it, which is between you and them.

3. Every connection the apps make

This is the complete list. Nothing else in any of the applications opens a connection.

3.1 Checking the trial clock — during the trial only

HEAD https://cloudflare.com/, and if that fails, HEAD https://www.apple.com/

The trial is thirty days, and the only defence against a system clock being wound back is a clock from somewhere else. Any HTTP response carries a Date header, so the app reads that and nothing else. The request contains no identifier, no licence key and nothing about your install — it is indistinguishable from opening the website. Those two operators see an IP address making an ordinary request, as they would for any visit.

If the request fails, nothing happens: being offline is normal, and the trial then runs on your own clock rather than refusing to run.

3.2 Downloading a model — only when you ask for one

These are the hosts the model weights live on. They are not ours, and their own privacy policies apply to the request. Nothing about your recordings, your library, your history or your licence is included. Once a model is downloaded it is used from your disk and the host is not contacted again; removing a model deletes the files.

3.3 Licensing — only when you press Activate or Deactivate

POST https://api.lemonsqueezy.com/v1/licenses/validate POST https://api.lemonsqueezy.com/v1/licenses/activate POST https://api.lemonsqueezy.com/v1/licenses/deactivate

Sent to validate: your licence key, and nothing else. Pressing Activate makes this call first, because the three applications are sold from one Lemon Squeezy store and this is the only call whose answer says which of them a key was issued for. A key belonging to another product is refused here rather than activated and then undone, which would have cost somebody a device slot.

Sent to activate: your licence key, plus a device label so that a stuck slot can be identified in a support request. The device label includes your Mac's computer name — the name from Sharing settings, often a person's name, for example "Jane's MacBook Pro" — plus six characters of a random per-install identifier. If you would rather Lemon Squeezy not hold that, rename your Mac before activating.

Received: which product and store the key was sold for, how many devices it covers, whether it is a test key, an activation identifier, and the name and email address on the order. Only the activation identifier is stored locally, so the slot can be released later; the rest is read to decide whether the key is for this application and then discarded with the response.

Nothing else is sent, and this happens at most three times per device — one check and one activation when you activate, one more if you ever deactivate. After a successful activation the application does not contact the licensing service again; it does not phone home, re-validate or check in. An activated app works indefinitely with the network off.

3.4 Loopback — processes on your own Mac

Some of the work is done by a separate process on your machine that the application talks to over 127.0.0.1. That traffic never leaves your Mac; it does not reach a network interface that can carry it off the machine.

• Coii AudioNotes runs a bundled language-model engine this way. Summaries and questions are sent to it.
• Coii VoiceInput runs its default recognition engine this way. Your audio is sent to it and text comes back.
• Coii Ref is a window around a local web service. Opening the app starts a backend on 127.0.0.1 and points a macOS WebKit view at it; the interface you see is that page, and the same page is reachable from a browser on the same Mac. The view loads nothing from anywhere else. One thing about it is yours to get right rather than ours: the service has no authentication, because a loopback address is the boundary. Starting it on a different address — --host 0.0.0.0, or the COII_HOST environment variable — publishes your library, its thumbnails and the original files to everyone who can reach that address. It is not a deployment mode, and it is not the default.

3.5 Optional usage statistics and update checks

Optional usage statistics (PostHog). This is off by default. The first-run screen offers an unchecked, optional checkbox separate from the Terms of Service notice. You may use the app without selecting it. Settings ▸ Privacy lets you turn it on or off later. Your choice is stored locally and is independent in each app; consenting in one never opts you into another.

When enabled in a release build, the app sends explicitly defined events to https://us.i.posthog.com/i/v0/e/, operated by PostHog in its US Cloud region. Events record app launch and selected feature use: recording start/stop, summary generation, answering a question and Markdown export in AudioNotes; dictation completion in VoiceInput; workspace opening, adding a folder, search execution and canvas creation in Ref. The event payload contains only:

• app name and version, operating system family, and production environment;
• the event name and success/failure outcome;
• where applicable, a coarse processing-time range (under 1 second, 1–5 seconds, 5–30 seconds, 30–120 seconds, or over 120 seconds);
• a random identifier created separately for each app installation when you opt in.

This identifier lets us count active installations and repeat use. It is not an account identity and we do not link it to your email, license key, another app, or your visits to our websites. It does not make each event fully anonymous: events from the same opted-in installation can be linked within that app.

No recordings, transcripts, generated text, notes, questions, search terms, images, files, paths, window titles, target application names, hardware serial numbers or raw error logs are sent. We do not use PostHog's automatic capture, session replay, person profiles or location enrichment in the apps. Our project is configured to discard client IP data from events. PostHog still receives a network connection from your IP address to deliver the service; this is not a promise that your IP is invisible to the network provider. See PostHog's Privacy Policy.

Before opt-in, no usage events are collected or queued and no analytics request is made. Turning this off invalidates pending events, cancels any in-flight request on a best-effort basis, and removes the local identifier. A request already delivered cannot be recalled. Re-enabling creates a new identifier and never backfills activity from the time it was off. Previously sent statistics remain subject to PostHog's retention; our free project retains event data for up to one year. Events are held only in a bounded memory queue, never stored on disk, and are dropped if the app is offline or the analytics service is unavailable. Analytics never blocks the app's core work. Development builds do not upload usage events, even if the preference is enabled.

There is no automatic crash or raw error reporting, advertising identifier, or cross-app tracking.

The update check, which all three applications make. Once a day, and again if you ask for it, each fetches one small file from the same download server the application came from, to learn whether a newer version exists. That request is an ordinary download of a public file: there is no request body, no identifier, no account, and nothing about your machine, your licence, or anything you have dictated, recorded or written. The server learns what serving any file reveals — that some address asked for it, and when. Nothing is downloaded and nothing is installed unless you press the button that says so. The switch that turns it off is in Settings ▸ Updates in Coii VoiceInput and Coii AudioNotes, and in the Coii Ref menu, under the application's own name; switched off, the application makes no such connection at all.

Beyond that: no connection at launch except the trial clock in §3.1, and none at all once you are licensed. Opening an application with the network off does everything it does with the network on, apart from downloading a model you have not downloaded yet and — where the check is left on — noticing that a new version exists.

4. Your purchase, which Lemon Squeezy holds

We do not run an account system. If you buy a licence, the record of that purchase is held by Lemon Squeezy, our merchant of record, which handles checkout, payment, invoicing and tax.

Lemon Squeezy holds your email address, the licence key it issued you, your activations and their labels, and the billing and tax details it needs — including whatever your payment method required. Lemon Squeezy is the controller for the payment transaction; its privacy policy, at https://www.lemonsqueezy.com/privacy, governs that data.

As the seller, we can see in its dashboard: the purchase email address, purchase date and amount, the licence key, and the device labels of its activations. We use that only to answer support requests, adjust an activation limit, and handle refunds. We never receive full card details.

To reach your own purchase data, use Lemon Squeezy's order lookup at https://app.lemonsqueezy.com/my-orders, which authenticates you by mailing a link to the address that bought. It is where you recover a lost key and find your receipt, without going through us. Releasing a device slot is a separate thing — a button in the application, on the machine holding the slot; see §7 of the Terms.

5. The websites

coii.io, audio.coii.io, ref.coii.io, voice.coii.io and legal.coii.io are static pages hosted on Vercel. Fonts are served from the same host as the page, not from a third party. Vercel, as the host, sees the ordinary request log of any web server — IP address, user agent, page requested — and its privacy policy governs that.

All five pages count their own visits with Vercel Web Analytics and time their own rendering with Vercel Speed Insights. Both are served from the page's own host, set no cookie and store nothing in your browser: to tell one visit from another within a day they hash the request with a salt that is thrown away daily, so the same browser is not recognisable tomorrow. What reaches us is a count per page and a set of timings per route, not a person.

The four sites the applications are sold from — not legal.coii.io — also load three third-party scripts. Each is listed here with what it does, because the alternative is that you find out from a cookie inspector.

• Google Analytics 4 (googletagmanager.com). Records the pages you view, the address you arrived from, your approximate location as Google derives it from the request, and the browser, operating system and device type the request already carried. It also records which buttons and links you click: the download buttons, the Buy link, and the links in the navigation and the footer, along with whether the pricing section came into view. Each arrives as an event carrying the name we gave that button, the site and page it was on, and for a download the platform and the file name — which is there so that we can tell how many readers who arrive reach an installer, and which of the two Mac builds they take. None of it records what you typed or anything about you beyond the identifier in the cookie below. It sets the _ga and _ga_* cookies, which give this browser an identifier for up to two years so that a return visit is counted as the same visitor. Google holds the data under its own privacy policy, at https://policies.google.com/privacy. What we see is aggregate reports.

• Microsoft Clarity (clarity.ms). Records how a page is used — where the pointer moves, what is scrolled, clicked and tapped — as session replays and heatmaps. Text you type into a field is masked by its default setting. It sets the _clck and _clsk cookies, which identify this browser to Clarity for up to a year and this session for a day. Microsoft holds the recordings under its privacy statement, at https://privacy.microsoft.com/privacystatement.

• Lemon Squeezy's affiliate script (lmsqueezy.com/affiliate.js). This one runs only if you arrived through an affiliate's link — an address carrying ?aff= and an affiliate's code — or if this browser already holds the ls_aff_ref cookie from an earlier such visit. For anyone else it loads, sees neither, and stops. When it does run, it computes a fingerprint of this browser from its properties (canvas and audio rendering, fonts, screen, time zone, hardware) and sends that fingerprint, the page address, the address you came from and the affiliate's code to Lemon Squeezy, our merchant of record. Lemon Squeezy records the click and answers with a click id, which the script stores in the ls_aff_ref cookie for a period Lemon Squeezy sets. Its purpose is one thing: if you buy a licence within 60 days, from any of these pages or from the checkout the application opens after the trial, Lemon Squeezy recognises the browser — by the cookie, or by computing the fingerprint again on its own checkout page — and credits the affiliate whose link you followed. We receive the referral count and nothing else. Lemon Squeezy's privacy policy, at https://www.lemonsqueezy.com/privacy, governs what it holds.

None of these scripts waits for your consent, and no banner asks for it. If you do not want them, a content blocker that stops any of the three hosts named above stops that script, and every page works without it. The pages carry no advertising and no advertising script.

This section is about the websites only. The applications send us nothing at all, and that is unchanged — §3.5.

The Buy button on a product page is a link to Lemon Squeezy's checkout. From the moment you follow it, Lemon Squeezy's privacy policy applies (§4). If you arrived through an affiliate's link, the address carried that affiliate's code — ?aff= and a short identifier for them, not for you. The page writes it, or the click id described above, into the Buy button and into the links between these four sites, so that a purchase you make on this visit is credited to the affiliate. The Affiliate Terms, at https://legal.coii.io/affiliates, say the same thing from the affiliate's side.

6. Children

The Software is not directed at children under 16, and we knowingly collect nothing from anyone.

7. Your rights

We do not hold your recordings, transcripts, notes or files. If you opted into usage statistics, we can access the limited events described in §3.5. Contact support@coii.io for questions or requests about those events. We cannot locate an installation’s events from your email alone because we do not associate the random installation identifier with your email. Turning off statistics withdraws consent for future collection; it does not delete already delivered events. Purchase-data requests are handled through Lemon Squeezy; contact us if you would rather we help start that request.

If you are in the EEA, the UK, Switzerland or a US state with a comprehensive privacy law, you have rights of access, correction, deletion, portability and objection over data held about you. For purchase data those are exercised against Lemon Squeezy as controller. Data held about you locally is deleted by deleting the files and keychain item named in §2 — no one else has a copy to delete.

If your Coii Ref library contains pictures of identifiable people, or your Coii Audio or Coii VoiceInput transcripts contain other people's words, you are the one holding that, not us. §9 of the Terms says whose responsibility that is; this section only says that we have no part in it.

8. Changes

If this policy changes, the current version is at https://legal.coii.io/privacy with a new effective date and the change listed at the top. A change that materially expands what an application sends will also be called out in the release notes of the version that introduces it, not buried here — and the version of this policy that describes the build you are running is embedded in that build.

9. Contact

Riff Tech, Inc. support@coii.io