Privacy policy
what we collect and why.

1. Who we are

Talha Emirhan Boyraz, Aydos Cad. No: 45-47, Sancaktepe, İstanbul, Türkiye ("we", "us") makes the Cosso app for Mac and Windows and runs the server behind its AI editing. This policy covers the app, that server and this website.

For anything about your data, write to [email protected].

The notice required by Türkiye's data protection law (KVKK aydınlatma metni) is on the KVKK page, in Turkish.

2. What stays on your computer

These are kept only on your computer. We can't see them.

Your voice

Recorded while you hold or tap the shortcut, recognized by the speech model on your computer and then discarded. Audio is never uploaded.

History

Your last 100 dictations. You can delete one entry or clear all of them in the app.

Personal dictionary

The words you add yourself. They are sent along with an AI edit (see below) but stored only on your computer.

Settings and sign-in

Your preferences. The sign-in and device tokens are kept in the macOS Keychain or Windows Credential Manager.

3. What we receive and store

Text for AI editing

When AI editing is on, each dictation is sent to our server with the settings that shape the edit: language, country, writing style, field and the words in your personal dictionary. If you're in a team, the server adds the team's dictionary and instructions. The server passes this to the language model, returns the edit and keeps none of it: the text isn't written to our database or our logs.

Device record

The first time a computer uses AI editing, the app registers it with a hashed machine identifier (the raw identifier never leaves the computer), the platform, the app version and a salted hash of the network part of your IP address. We use it for the free trial, which is counted per computer, and to spot trial abuse. We don't store your IP address in the database.

Usage records

For each AI edit: the time, the number of characters and tokens, the model, how long it took, whether it worked and which plan covered it. No text. We use these for limits, billing and keeping the service reliable.

Account

If you sign in: your name and email address, and the profile picture link if you sign in with Google. Each sign-in session stores the IP address and the browser or app it came from.

Teams

The team's name, members and their roles, pending invitations with the invited email address, the team's field and instructions, and its dictionary entries with who added them.

Plans

Which plan an account or team has, the number of seats and until when it's valid.

Update checks

Every few hours the app asks our server whether there's a newer version, sending only its version, platform and processor type. This also happens when AI editing is off.

Server logs

Each request to our server is logged with the IP address, the address requested, the response status and how long it took. Request contents, including dictated text, are not logged.

Contact form

Your name, email, company, team size, topic and message. They are sent to our inbox as an email and not stored in a database.

Waitlist

If you join: your email address, Mac or Windows, and when you joined and confirmed. We use them only to send your invitation, not for marketing.

This website is static. It sets no cookies and loads no analytics or tracking scripts. Signing in, which happens on our server, uses a session cookie that is needed for it to work.

4. Why we use it

• To provide the service you asked for: AI editing, your account, your team and its dictionary, and your plan.
• To run the free trial fairly and stop abuse, using the device record and the hashed IP prefix.
• To keep the service secure and working, using server logs and usage records.
• To answer you when you write to us.
• To send your invitation if you joined the waitlist.

Under the GDPR and Türkiye's KVKK, the first is necessary to perform our agreement with you; the waitlist relies on the consent you confirm by clicking the link we email you, which you can withdraw at any time; the others are our legitimate interest in running a reliable service that isn't abused. We don't use your data for advertising and we don't train models on it.

5. Who else processes it

We use these service providers, each only for the purpose listed:

OpenRouter

Routes AI-edit text to the language model. We restrict routing to providers whose policy is not to store the data or train on it. The main model is Google's Gemini; if it fails, the same request goes to a DeepSeek model run by such a provider.

Resend

Sends sign-in links, team invitations, waitlist emails and contact form messages by email.

Google

Only if you choose Sign in with Google.

Hugging Face

The app downloads the speech model from Hugging Face once. As with any download, Hugging Face sees your IP address.

Hetzner

Hosts our server and its database.

Paid plans can't be bought online yet. When they can, we'll name the payment provider here before it receives any data.

We don't sell personal data or share it with anyone for advertising. We would disclose it to authorities only when the law requires us to.

6. International transfers

Some of these providers process data outside your country, including in the United States. Where the law requires it, transfers rely on the safeguards it provides, such as standard contractual clauses.

7. How long we keep it

Text for AI editing

Not kept. It exists on our server only while the edit is being made.

Account and team data

Until you delete it in the app (Account & plan), the team owner deletes the team, or you ask us to delete your account.

Device and usage records

While the device or account exists, because limits and billing depend on them. When you delete your account, its usage records are deleted too. One thing stays: how much of the free trial each computer has used, with no link to you or your account, so that a new account doesn't mean a new trial.

Server logs

Up to 30 days.

Contact form messages

In our inbox for as long as we need them to answer and follow up.

Waitlist

Unconfirmed addresses for up to 30 days. Confirmed ones until we've sent your invitation and closed the list, or until you ask us to remove you.

8. Your choices and rights

• Turn AI editing off in the app, and no dictated text leaves your computer.
• Delete entries from your History or clear it, and remove words from your personal dictionary, in the app.
• Leave the waitlist by writing to [email protected].
• Delete your account yourself in the app, under Account & plan. Or ask us for a copy of your data, to correct it, to delete your account and its records, or to stop a use you object to: write to [email protected] from the email address on your account.

We answer within 30 days. If you think we've handled your data wrongly, you can also complain to your data protection authority: the KVKK Board in Türkiye, or the supervisory authority where you live in the EU or UK.

9. How we protect it

Connections to our server use HTTPS. Sign-in links are single use and expire after 15 minutes. Team dictionaries can be read only by members of that team, and changed only by its owners and admins. More detail is on the security page.

10. Children

Cosso isn't meant for children under 16, and we don't knowingly collect their data. If you think a child has created an account, write to us and we'll delete it.

11. Changes to this policy

When this policy changes, we update the date at the top. If a change affects how we use data we already have, we'll email account holders before it takes effect.