What we collect, where it goes, and how long it stays.

1. Who we are

The controller of your personal data is Denys Kruhlov, a sole trader registered in the Polish business register (CEIDG), atul. Giżów 3/54, 01-249 Warszawa, Poland. NIP5273167799, REGON 541920925. The business trades as Understudio. In this policy, "we" means that business.

Write to privacy@understudio.app about anything here. It reaches the person responsible. We have no data protection officer.

2. The short version

• Your sessions live on your Mac. We keep no transcripts, screenshots, answers or context files on our servers.
• To work, the app sends audio to Soniox for transcription, and sends what you ask it to solve to OpenAI through our API. Both process it in the US. Neither may train models on it.
• Your account sits with Supabase in Frankfurt. Billing sits with Schematic and Stripe.
• No ads, no analytics, no tracking cookies. We do not sell or share your personal data.
• The app hears the other people on your calls too. Telling them, and getting their consent where the law requires it, is your job. See section 6.

3. The desktop app

What stays on your Mac

• Sessions — transcripts, answers, screenshot thumbnails and a title made from the first words said. The 50 newest are kept and older ones are dropped. Delete a session from the sessions list, or turn off "Keep session history" to stop saving them.
• Context files — for the 20 files you used last, the app keeps the file name, where it is on your Mac, and its text (for a large file, a summary and indexed chunks).
• Your sign-in, encrypted with the macOS Keychain.

All of it is in ~/Library/Application Support/interview-helper/. Deleting that folder deletes it. We have no copy to delete, because none of it is sent to us to keep. The files are not encrypted by the app, so turn on FileVault if other people use your Mac.

Raw audio and full-size screenshots are never written to disk. The app holds the last few seconds of audio in memory, so a dropped connection loses nothing, and drops it when you stop.

What leaves your Mac

• Audio. While a session runs, the app streams your microphone and your Mac's system audio to Soniox. System audio is everything your Mac plays — on a call, that is the other people's voices. The stream goes straight to Soniox, not through our servers. Soniox sends back text, does not store real-time audio or transcripts, and does not train on them. Our API gives the app a short-lived key for each stream and tells Soniox your account id, so the time can be billed.
• What you solve. When you press the solve hotkey (⌃⌥⌘R by default), use auto-solve, or ask for a session summary, the app sends a request to our API, which passes it to OpenAI. The request holds the transcript around the question, the earlier questions and answers of the same session, any screenshots you queued, and the relevant parts of your context files — the whole file, if it is small. A screenshot is a full picture of your main display, including any other window on it.
• Context files. When you attach a large file, its text goes to OpenAI once, through our API, to be summarised and indexed. Finding the right passage later sends a short piece of recent transcript the same way.

Our API keeps none of the content it passes on. It logs your account id, the model and the number of tokens used, and nothing that was said or shown. It asks OpenAI not to store the request, and gives OpenAI a one-way hash of your account id instead of the id itself. OpenAI keeps API requests for up to 30 days to detect abuse, then deletes them, and does not train on them.

The app has no analytics, no crash reporting and no automatic updates. Its fonts are built in, and it loads nothing from any other site. It contacts nothing else.

If you turn on the Hyper key

The Hyper key is off until you switch it on in Settings. While it is on, a small helper inside the app sees every key you press, in any app, so it can add the hotkey modifiers to a key you press while the Hyper key is held. That is why macOS asks you for Accessibility permission first. The helper passes each key press on as it happens. It does not record, store or send any of them, and nothing you type reaches us or anyone else. macOS keeps what you type in password fields away from it. To warn you about a clash, the app also checks, on your Mac only, whether Raycast's Hyper Key is on and which keyboard tools are running; none of that leaves your Mac either. If you pick "Set up in another app" to use the Hyper key from Raycast, Hyperkey or Karabiner-Elements instead, there is no helper, and the app sees only its own hotkeys, as it does with the Hyper key off.

4. Your account and billing

• Account. Your email address, your name, your password (stored hashed by Supabase, never in plain text), and how you sign in. If you sign in with Google or GitHub, they share your name, email address, profile picture and account id with that provider — plus, on GitHub, your username. GitHub's email permission covers every address on the account: we check them only to pick your primary one and to find an Understudio account you already have, and keep only the primary. Supabase also keeps a record of sign-ins, with the IP address and browser.
• Billing. Schematic holds your plan, your token balance and how many tokens each answer and each stretch of transcription cost — amounts only, never content. It knows you by your account id and email. Stripe takes the payment and holds your card, billing name, country or address, and the device signals it uses to stop fraud. Card numbers never reach us.
• Email. Account email — confirming your address, sign-in codes, password resets — is sent through Resend. We send no marketing email. Mail you send us is kept in our mailbox at Zoho Mail, in Zoho's EU data centres.

5. This website and the account site

understudio.app sets no cookies of its own and runs no analytics or third-party tags. Its fonts are served from our own server. It stores at most two things in your browser, both in local storage and never sent anywhere: a note that you closed the cookie notice, and your choice of light or dark theme if you pick one instead of following your system setting. It reads one cookie the account site sets, ih_signed_in, to show "Your account" instead of "Log in".

account.understudio.app sets cookies only for signing in: Supabase session cookies (sb-…-auth-token) that keep you signed in; ih_signed_in, which holds only the fact that you are and is shared with understudio.app, until you sign out and for at most 400 days; and, during a Google or GitHub sign-in, a short-lived one that proves the sign-in started here. On the billing page, Stripe's payment form sets its own fraud-prevention cookies (__stripe_mid for a year,__stripe_sid for 30 minutes), and the billing portal talks to Schematic from your browser. All of these are strictly necessary for something you asked for, so we do not ask for consent.

Our web server keeps no access logs. It keeps error logs, which can contain an IP address or an account id. Each service keeps only its newest 50 MB, and older lines are overwritten.

The app is downloaded from GitHub, so GitHub sees your IP address when you download it.

6. Other people on your calls

The app hears everyone on your call. The other people's voices go to Soniox, and their words end up in your transcript and in what you send to OpenAI. A screenshot can show their names, faces or messages.

• We use it only to give you the transcript and the answers you asked for.
• We keep none of it on our servers and use it for nothing else.
• The app does not recognise voices or identify anyone. It labels speech "You" or "Interviewer" only by which input it came from — microphone or system audio.

You decide when the app listens and on whom. Recording and transcription laws differ by place, and some require everyone's consent. You must tell the people on the call and get their consent where the law requires it. Before your first session, the app says this and asks you to confirm it. The acceptable use policy says what we expect.

If you were on a call with someone who used Understudio, we hold nothing about you on our servers. The transcript, if they kept one, is on their Mac. You can still write to us.

7. Why we use it, and the legal basis

Where the GDPR applies, each use has one of these bases:

• To run your account, transcribe, answer and bill you — performing our contract with you (Art. 6(1)(b)).
• To keep invoices and tax records — a legal obligation under Polish tax and accounting law (Art. 6(1)(c)).
• To keep the service secure, prevent fraud and abuse, and keep logs — our legitimate interests (Art. 6(1)(f)).
• To answer your messages and handle complaints — the contract, or our legitimate interests if you are not a customer.
• To establish or defend legal claims — our legitimate interests.
• The voices and content of other people in your sessions — our legitimate interest, and yours, in the service doing what you asked, limited as section 6 describes.

None of it relies on consent. We make no automated decisions about you that have legal or similar effects, and we do no profiling for advertising. An account needs an email address; we cannot provide the service without one.

8. Who receives it

These providers process data for us, under contracts that limit them to doing so on our instructions.

Some receive data as separate controllers, under their own privacy policies:

• Stripe, for its own fraud prevention and legal duties as a payment provider.
• Google and GitHub, only if you sign in with them, and GitHub when you download the app.
• Our accountant, for invoices and tax records.
• Authorities, only when the law requires it.

9. Data outside the EU

Several providers are US companies, and OpenAI and Soniox process your content in the US. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the Standard Contractual Clauses in the provider's data processing agreement. Write to privacy@understudio.app for a copy.

10. How long we keep it

• Account and sign-in records — while your account exists. Deleted within 30 days of closing it; backup copies go when the backup expires.
• Plan, balance and token use — while your account exists, then deleted with it.
• Invoices and payment records — 5 years from the end of the year of the payment, as Polish tax law requires. Stripe keeps its own records for as long as its own legal duties require.
• API logs (account id, model, tokens) — 7 days.
• Requests at OpenAI — up to 30 days.
• Audio and transcripts at Soniox — not kept. Soniox keeps a usage record (account id, length, cost) for billing.
• Server error logs — overwritten as new ones arrive, as section 5 describes.
• Email we send — Resend keeps a short delivery log of each message.
• Mail you send us — up to 3 years after the conversation ends, unless we need it longer for a claim.
• What is on your Mac — until you delete it.

11. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to receive the data you gave us in a machine-readable file. You can object to any use based on our legitimate interests. It is free.

Write to privacy@understudio.app from the address on your account, so we know it is you. We answer within one month. If a request is complex, we may take two more months, and we will tell you why within the first.

You can change your name and email yourself on the account site. To close your account, use "Delete your account" on its Account page. It cancels any subscription at once and deletes your account from Supabase and your records from Schematic, and we email you when it is done. Stripe keeps your payment records and invoices for as long as the law requires. Unused tokens are lost. Most of what you may want erased is on your own Mac; delete the sessions or the folder named in section 3.

You can complain to a data protection authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You can also go to the authority where you live or work.

12. If you live in the US

US state privacy laws, including California's (CCPA, as amended by the CPRA), may not apply to a business our size. We follow them anyway.

• What we collected in the last 12 months: identifiers (name, email, account id, IP address); commercial information (plan, purchases, token use); internet activity (sign-in records); and, in transit only, audio and screenshots, plus whatever professional details you put in context files. It comes from you, your device, and Google or GitHub if you sign in with them.
• Why: the purposes in section 7. We disclose it only to the providers in section 8, for those purposes.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the last 12 months. We do not use sensitive personal information to infer anything about you.
• Your rights: to know what we hold, to get a copy, to correct it, to delete it, and not to be treated differently for asking. There is nothing to opt out of, since we do not sell or share. An authorised agent may ask for you, with your signed permission.
• How: write to privacy@understudio.app. We confirm within 10 business days and answer within 45 days.

13. Children

Understudio is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18, or from children under 13. If we learn that we have, we delete it.

14. Security

Every connection is encrypted with TLS. The keys to OpenAI, Soniox and Schematic are held only by our servers, never by the app. Your sign-in on your Mac is encrypted with the Keychain. Report a vulnerability to security@understudio.app.

15. Changes

The date at the top changes with every edit. If a change matters, we email account holders before it takes effect. Earlier versions are available on request.