Privacy Policy

Coii Audio · Coii Ref · Coii Voice

Effective 2026-08-30

This policy covers the three Coii applications and the websites they are sold from. Where an application does something the others do not, the section says which one it is talking about.

Changes

• 2026-08-30 — first published. Replaces the separate policies each application carried before.

1. The short version

Nothing you record, index or dictate leaves your Mac, and we never receive anything from the apps. There is no account to create, no server of ours to connect to, no analytics, no crash reporting and no telemetry. We cannot see how often you use an application, whether you use it at all, or what is in any recording, picture or transcript — not because we promise not to look, but because nothing is sent.

Each application does make a small number of network connections. They are listed exhaustively in §3, and none of them carries your audio, your files, your transcripts, or anything computed from them.

The one place any information about you exists is your purchase, which is held by Lemon Squeezy, our merchant of record (§4).

2. What stays on your device

Every application keeps a copy of the licence key and the trial's start date in your macOS keychain, so that reinstalling does not cost you a device activation or reset your trial. It is readable only by you and by signed builds of that application. The keychain items are io.coii.audio.license, io.coii.ref.license and io.coii.voice.license.

Everything else is below. Deleting the files named for an application and its keychain item deletes everything that application holds. There is no other copy anywhere.

2.1 Coii Audio

Everything is written to ~/Library/Application Support/CoiiAudio:

• Audio is never written to disk. Samples are resampled, segmented, transcribed in memory and then dropped. There is no recording file, not even a temporary one. What remains of a meeting is its text.
• Voice prints are not identity. For speaker separation the app stores a small numeric vector per transcript segment. Those vectors are compared only against other segments in the same session; they are not matched against any database, not shared between sessions by default, and not sent anywhere. Speaker names you type are labels in your own database.

2.2 Coii Ref

Two locations, and nothing else.

Beside your own files. Everything the app knows about a folder you added is written into that folder, so that moving the folder moves the library with it:

Every name the app writes starts with coii-, and the whole prefix is reserved: anything in your folder with that prefix is ours and is skipped when indexing, so a folder can be handed back to you by deleting them.

Under your user library. ~/Library/Application Support/coii holds license.json — the trial's start date and activation state — and models/, where the semantic-search model goes if you install it.

• Reading a file locally is not sending it. To make a thumbnail the app hands a path to macOS's own tools (sips, qlmanage) and reads Spotlight metadata with mdls. Those are processes on your machine, they are given your file, and they hand back pixels or a string.
• Vectors are not identity. Semantic search stores a short numeric vector per item. It is compared only against other items in the same workspace; it is not matched against any database of ours, and it is not sent anywhere.

2.3 Coii Voice

Everything is written to ~/Library/Application Support/CoiiVoice/:

• The audio is not kept. It is transcribed and discarded; there is no recording file.
• Running a model locally is not sending anything. The recognition model is a file in models/. Transcribing hands your audio to a process on your own Mac and gets text back. No part of that touches the network, which is why it works with the network off.
• The transcript reaches other applications only where you put it. The point of the app is to type into the window you were in, and — when it cannot type — to leave the text on your clipboard. Both are macOS handing data to software you chose. Anything you paste into a cloud application goes wherever that application sends it, which is between you and them.

3. Every connection the apps make

This is the complete list. Nothing else in any of the applications opens a connection.

3.1 Checking the trial clock — during the trial only

HEAD https://cloudflare.com/, and if that fails, HEAD https://www.apple.com/

The trial is thirty days, and the only defence against a system clock being wound back is a clock from somewhere else. Any HTTP response carries a Date header, so the app reads that and nothing else. The request contains no identifier, no licence key and nothing about your install — it is indistinguishable from opening the website. Those two operators see an IP address making an ordinary request, as they would for any visit.

If the request fails, nothing happens: being offline is normal, and the trial then runs on your own clock rather than refusing to run.

3.2 Downloading a model — only when you ask for one

These are the hosts the model weights live on. They are not ours, and their own privacy policies apply to the request. Nothing about your recordings, your library, your history or your licence is included. Once a model is downloaded it is used from your disk and the host is not contacted again; removing a model deletes the files.

3.3 Licensing — only when you press Activate or Deactivate

POST https://api.lemonsqueezy.com/v1/licenses/validate POST https://api.lemonsqueezy.com/v1/licenses/activate POST https://api.lemonsqueezy.com/v1/licenses/deactivate

Sent to validate: your licence key, and nothing else. Pressing Activate makes this call first, because the three applications are sold from one Lemon Squeezy store and this is the only call that says which of them a key was issued for. A key belonging to another product is refused here rather than activated and then undone, which would have cost somebody a device slot.

Sent to activate: your licence key, plus a device label so that a stuck slot can be identified in a support request. The device label includes your Mac's computer name — the name from Sharing settings, often a person's name, for example "Jane's MacBook Pro" — plus six characters of a random per-install identifier. If you would rather Lemon Squeezy not hold that, rename your Mac before activating.

Received: which product the key was sold for, and an activation identifier, which is stored locally so the slot can be released later.

Nothing else is sent, and this happens at most three times per device — one check and one activation when you activate, one more if you ever deactivate. After a successful activation the application does not contact the licensing service again; it does not phone home, re-validate or check in. An activated app works indefinitely with the network off.

3.4 Loopback — processes on your own Mac

Some of the work is done by a separate process on your machine that the application talks to over 127.0.0.1. That traffic never leaves your Mac; it does not reach a network interface that can carry it off the machine.

• Coii Audio runs a bundled language-model engine this way. Summaries and questions are sent to it.
• Coii Voice runs its default recognition engine this way. Your audio is sent to it and text comes back.
• Coii Ref is a window around a local web service. Opening the app starts a backend on 127.0.0.1 and points a macOS WebKit view at it; the interface you see is that page, and the same page is reachable from a browser on the same Mac. The view loads nothing from anywhere else. One thing about it is yours to get right rather than ours: the service has no authentication, because a loopback address is the boundary. Starting it on a different address — --host 0.0.0.0, or the COII_HOST environment variable — publishes your library, its thumbnails and the original files to everyone who can reach that address. It is not a deployment mode, and it is not the default.

3.5 What the apps do not do

No analytics. No crash or error reporting. No usage statistics. No advertising or tracking identifiers. No update check — none of the applications has an in-app updater, so none contacts a release server. No connection at launch beyond the trial clock in §3.1, and none at all once you are licensed: opening an application with the network off does everything it does with the network on, apart from downloading a model you have not downloaded yet.

4. Your purchase, which Lemon Squeezy holds

We do not run an account system. If you buy a licence, the record of that purchase is held by Lemon Squeezy LLC, our merchant of record, which handles checkout, payment, invoicing and tax.

Lemon Squeezy holds your email address, the licence key it issued you, your activations and their labels, and the billing and tax details it needs — including whatever your payment method required. Lemon Squeezy is the controller for the payment transaction; its privacy policy governs that data.

As the seller, we can see in its dashboard: the purchase email address, purchase date and amount, the licence key, and the device labels of its activations. We use that only to answer support requests, adjust an activation limit, and handle refunds. We never receive full card details.

To reach your own purchase data, use My Orders at https://app.lemonsqueezy.com/my-orders, which authenticates you by mailing a sign-in link to the address that bought. It is where you recover a lost key and find your receipt, without going through us. It is not where a device slot is released — that is a button in the application, on the machine holding the slot; see §7 of the Terms.

5. The websites

audio.coii.io, ref.coii.io, voice.coii.io and legal.coii.io are static pages hosted on Vercel. They run no analytics, no session recording and no advertising scripts, and set no cookies of ours. Fonts are served from the same host as the page, not from a third party. Vercel, as the host, sees the ordinary request log of any web server — IP address, user agent, page requested — and its privacy policy governs that.

The Buy button on a product page is a link to Lemon Squeezy's checkout. From the moment you follow it, Lemon Squeezy's privacy policy applies (§4).

6. Children

The Software is not directed at children under 16, and we knowingly collect nothing from anyone.

7. Your rights

Because we hold no data collected from the apps, there is normally nothing for us to access, correct, export or delete. Rights over your purchase data are exercised through Lemon Squeezy, which holds it; write to support@coii.io if you would rather we start that for you.

If you are in the EEA, the UK, Switzerland or a US state with a comprehensive privacy law, you have rights of access, correction, deletion, portability and objection over data held about you. For purchase data those are exercised against Lemon Squeezy as controller. Data held about you locally is deleted by deleting the files and keychain item named in §2 — no one else has a copy to delete.

If your Coii Ref library contains pictures of identifiable people, or your Coii Audio or Coii Voice transcripts contain other people's words, you are the one holding that, not us. §9 of the Terms says whose responsibility that is; this section only says that we have no part in it.

8. Changes

If this policy changes, the current version is at https://legal.coii.io/privacy with a new effective date and the change listed at the top. A change that materially expands what an application sends will also be called out in the release notes of the version that introduces it, not buried here — and the version of this policy that describes the build you are running is embedded in that build.

9. Contact

Riff Tech, Inc. seller address support@coii.io