Last updated: September 23, 2026
TL;DR
- Audio is never written to disk. It's processed in memory and discarded.
- In Offline mode, nothing leaves your device — ever.
- In BYOK cloud mode, audio goes to the STT provider you configure (Groq or OpenAI).
- On Max, audio you choose to transcribe with Kalam Cloud is processed by our infrastructure to produce your transcript, then discarded. Never used for training.
- Context awareness (Pro) reads your screen locally — data only goes to the AI provider handling your request, never anywhere else.
- Dictation history is stored locally on your device.
- Telemetry is opt-in on stable builds. Beta builds send telemetry and sanitized diagnostic logs automatically — see the Beta Policy. No audio or text is ever included.
1. Who we are
Kalam is developed by Ali Farahat / Balacode.
Ali Farahat
Email: hello@balacode.io
Website: balacode.io
Data controller note: Kalam is a desktop application that processes and stores data locally on your device. For all locally-stored data (audio, transcription history, API keys, workspace data), you are the data controller. We act as data controller only for data we actually receive — account and billing data, synced data and statistics (paid plans), hosted AI requests (Max), website analytics, and any email address you voluntarily provide.
2. What data we collect
Audio & transcription
| Mode | Audio processing | Data destination |
|---|---|---|
| Offline | Processed locally via Whisper model | Stays on your device |
| BYOK cloud | Sent to your configured STT provider | Groq or OpenAI (per their privacy policies) |
| Kalam Cloud (Max) | Sent to Kalam's hosted STT (Cloudflare Workers AI) | Processed to produce your transcript, then discarded; never used for model training |
| Auto | Cloud by default; local for sensitive apps | Depends on active app |
In all modes, audio is processed in memory and never written to disk by Kalam.
Hosted AI (Max plan)
When you use Kalam Cloud on the Max plan, audio snippets and prompt text are transmitted to our Cloudflare-based infrastructure over HTTPS, processed to produce your transcript or polished text, and returned to your device. We record usage metering only (seconds of audio, token counts, timestamps) to enforce fair-use limits — never the audio or text content itself.
Context awareness (Pro feature)
When context awareness is enabled (opt-in, per profile), Kalam may read:
- App context — text from the active application window.
- Selected text — any text you have highlighted at the time of dictation.
- Clipboard — the last item you copied (within a few seconds of pressing the hotkey).
This data is read locally on your device and sent only to the AI provider handling your request (your BYOK provider, or Kalam Cloud on Max) as part of a single prompt. It is never stored by us.
Sensitive app protection: When a sensitive app is detected (banking, password managers, etc.), context awareness is forced OFF regardless of settings. No screen content, clipboard, or selected text is read or sent anywhere.
API keys
API keys for Groq or OpenAI are stored locally on your device and sent only to the respective provider during transcription. If you enable multi-device sync, keys are end-to-end encrypted on your device before upload — we cannot read them.
Cross-device statistics (paid plans)
If sync is enabled, the app uploads daily aggregate statistics per device — word counts, session counts, speaking duration, average latency, and top destination app names. These power the analytics page in your dashboard. No transcript content is ever included.
Telemetry
On stable builds, Kalam includes optional, anonymous usage telemetry. It is disabled by default and must be explicitly enabled in Settings. Telemetry never includes audio, transcription text, API keys, or personally identifiable information.
On pre-release (beta) builds, anonymous usage events and sanitized diagnostic log bundles are sent automatically and cannot be turned off. Agreeing to the Beta Policy is required to use a beta build.
Website analytics
This website (kalamvoice.com) uses HeyCatch, Google Tag Manager, and Google Analytics. These services may collect your IP address and anonymous usage data per their privacy policies. Fonts are self-hosted. HeyCatch records pageviews and campaign attribution. It does not receive dictation audio or transcripts.
3. How we use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide voice dictation functionality | Performance of contract / legitimate interest |
| Hosted AI transcription and polish (Max) | Performance of contract |
| Store dictation history locally | Legitimate interest (user productivity) |
| Sync settings and statistics across devices (paid, opt-in) | Performance of contract |
| Context awareness — read screen/clipboard for AI processing (Pro, opt-in) | Consent / legitimate interest |
| Anonymous telemetry (if opted in on stable) | Consent |
| Beta diagnostic logs and telemetry (pre-release builds) | Consent (Beta Policy) |
| Website analytics | Legitimate interest |
| Accounts and subscription billing | Performance of contract / legitimate interest |
4. Who we share data with
- STT providers — Groq or OpenAI, only in BYOK cloud mode, only audio data for transcription.
- Cloudflare — Our hosting and hosted-AI infrastructure (Workers, D1, R2, Workers AI). Max-tier audio and prompts are processed by Cloudflare Workers AI on our behalf.
- AI providers (BYOK) — When Polish, profiles, or context awareness use your own key, your transcription and context data go to the provider you configure.
- HeyCatch — Website pageviews and campaign attribution for short links. No dictation audio or transcripts.
- Google Tag Manager / Google Analytics — Anonymous website usage data loaded via Google’s tag container.
- Stripe — When you subscribe on kalamvoice.com, payment processing is handled by Stripe. We receive subscription status and limited billing metadata, not your full card number.
- Authentication — If you sign in, our auth service processes login credentials; we store identifiers and email needed to link your account and subscription.
We do not sell, rent, or trade your personal data.
Third-party disclaimer: In BYOK mode, audio is transmitted directly from your device to the provider you configure. We have no control over and accept no responsibility for how those providers handle your data. Review their policies before using BYOK cloud mode:
5. Data retention and deletion
- Audio — Ephemeral. Processed in memory, never persisted — locally or on our servers.
- Dictation history — Stored locally. Retention period configurable in Settings. You can clear history at any time.
- App data — To fully reset, delete the Kalam data directory on your system.
- Sync data (paid plans) — If you enable multi-device sync, notes, dictionary, profiles, settings, encrypted API keys, and daily statistics are stored in our database (Cloudflare D1). Dictation history does NOT sync — it stays on the machine where it was spoken. You can disable sync and wipe server data at any time.
- Hosted AI metering — Usage counters (seconds, tokens) are retained for billing and abuse prevention.
- Beta diagnostic logs — Sanitized log bundles from pre-release builds are retained up to 90 days, then deleted. See the Beta Policy.
- Account and billing records — Retained as required for tax, fraud prevention, and contract administration; you may request deletion where applicable (§6).
6. Your rights
EEA / UK (GDPR)
You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. Contact hello@balacode.io.
California (CCPA)
California residents have the right to know what personal information is collected, request deletion, and opt out of sale. We do not sell personal information.
7. Security
We implement reasonable technical measures to protect your data. API keys are stored using your operating system's secure storage where available and end-to-end encrypted before any sync. All network requests use HTTPS.
However, no method of electronic storage or internet transmission is 100% secure. We cannot and do not guarantee the absolute security of your data.
8. Children's privacy
Kalam is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
9. Third-party links
Kalam and this website may link to third-party services. We are not responsible for their privacy practices.
10. International data transfers
Cloud transcription (BYOK or Kalam Cloud) may involve processing in the United States or other countries via globally distributed infrastructure. By choosing cloud modes, you acknowledge this transfer. Website analytics data may also be processed in the United States by Google LLC or HeyCatch.
11. Cookies and tracking
The Kalam desktop application does not use cookies.
This website uses cookies set by Google Tag Manager / Google Analytics to distinguish unique
visitors and measure site usage. The website also stores a theme preference in localStorage (not a cookie) which never leaves your browser. When you sign in,
session cookies keep you logged in. Stripe may set cookies required for fraud prevention
during checkout.
12. Limitation of liability
To the maximum extent permitted by applicable law, we are not liable for any loss arising from: processing of your data by any third-party provider; unauthorized access to data stored on your device; any inaccuracy in transcription output; your failure to secure your API keys; or any action taken in reliance on transcription output. This section supplements the Terms & License.
13. Changes to this policy
We may update this policy from time to time. Material changes will be noted on this page with an updated "Last updated" date.
14. Contact
Email: hello@balacode.io
We aim
to respond within 30 days.