Privacy Policy — versions

2026-10-10current

applications built with optional usage statistics. §1 and §3.5: each app can send a small, explicit set of usage events to PostHog US Cloud only after you opt in. The first-run checkbox is unchecked; Settings lets you change the choice at any time. Existing installations start with this off. Recordings, transcripts, notes, pictures, files, paths and search text still stay on your device. Earlier app versions retain their embedded policy.

2026-09-19in force until 2026-10-10

all three applications. §3.5 said none of them has an in-app updater and none contacts a release server. That is no longer true of any of them: once a day each fetches a small file from the download server to learn whether a newer version exists. **Nothing is downloaded or installed unless you press it**, the request carries nothing about you or your machine beyond what serving any public file reveals, and a switch turns the whole thing off — off, the application makes no such connection at all. Where the answer is shown and where the switch is differ by application: Coii VoiceInput and Coii AudioNotes put both in Settings, and Coii Ref puts both in its menu bar, under its own name. §3.5 now says all of this, including the sentence about being licensed that used to promise no connection at all.

2026-09-10in force until 2026-09-19

the websites, not the applications. §5: Google Analytics now also records **which buttons and links you click** on the four sites the applications are sold from — the download buttons, the Buy link, the navigation and the footer — and whether the pricing section came into view. It is the same script and the same cookies as before; what is new is that each of those clicks is sent as its own event, so that we can see how many readers who arrive actually reach a download. §1 still said the websites set no cookie and kept no identifier outliving a day, which stopped being true of those four sites on 2026-09-07; it is corrected there and not only in §5. Nothing an application sends has changed.

2026-09-07in force until 2026-09-10

the websites, not the applications. §5 is rewritten. The four sites the applications are sold from now load Google Analytics, Microsoft Clarity and Lemon Squeezy's affiliate script, and the section says what each one records, which cookies it sets and who holds the result. The affiliate script runs only for a reader who arrived through an affiliate's link, and it is what lets a purchase made inside the application a month later be credited to that affiliate. The promise that these pages set no cookie and keep no identifier is withdrawn for those four sites; `legal.coii.io` still sets none. Nothing an application sends has changed.

2026-09-04in force until 2026-09-07

the websites, not the applications. §5: the pages now count their own visits with Vercel Web Analytics and time their own rendering with Vercel Speed Insights. Neither sets a cookie or keeps an identifier that outlives the day it was computed. The section also names `coii.io`, which it had left out, and §1 now points at it. Nothing an application sends has changed.

2026-09-03in force until 2026-09-04

all three applications. §4 names the merchant of record by the name it trades under rather than by a legal entity that has changed hands; its privacy policy, already linked there, is what governs the payment data and says who holds it. §9 is the support mailbox. What leaves your Mac is unchanged.

2026-09-02in force until 2026-09-03

all three applications. The merchant of record is Lemon Squeezy. §3.3 lists its three License API endpoints in place of the previous ones and says what each application now receives back from `validate`; §4 describes what Lemon Squeezy holds and where you reach it. No new data leaves your Mac. §2 renames Coii VoiceInput's keychain item to `io.coii.voiceinput.license` and names the one it used before, which that application still reads.

2026-08-30in force until 2026-09-02

first published. Replaces the separate policies each application carried before.