legal

Last updated: 26 October 2026

Shepit is a dictation app for macOS. This policy explains what data we collect, why, where it is stored, and how to have it removed. It covers the Shepit app, the shepit.app website and paid plans.

Who we are

Shepit is operated by Rebbix LTD (Cyprus). For any privacy question or data request, contact hello@shepit.app.

What we collect

  • Account identity. When you sign in with Google, we receive your email address, display name, and profile picture from Google.
  • Audio you dictate. The audio you record is sent to our API, which forwards it to OpenAI for transcription and returns the text to your Mac. Every dictation takes this path. The terms in your dictionary are sent with each dictation to the transcription model so it spells them as you wrote them.
  • Dictionary. The terms in your dictionary, which of them the app learned from your corrections, and the learned terms you removed, stored with your account so each device you sign in on uses the same list.
  • Text for AI clean-up. When you turn on AI clean-up, the transcribed text is sent through our API to OpenAI to be cleaned up and returned to your Mac.
  • Usage records. For each dictation: the audio length, word count, language, your plan, the processing cost and the time. We also keep per-day totals, your first and last sign-in times, and operational logs needed to run and secure the service.
  • Billing records. If you buy a paid plan, the billing records listed under Where your data is stored. Your card details go to Stripe and Link, never to us.
  • Feedback. If you send feedback from the app: your text and the app version, linked to your account.
  • Error reports. When something goes wrong in the app or on our servers, an error report is sent to Sentry. It carries your account ID only: no email address, no audio and no dictated text.
  • Setting up the Mac app. Until setup is complete, the app sends us its progress through setup: each step and its outcome, including the permissions you give, with a random ID the app creates on your Mac. When you sign in, we link this to your account. Our legal basis is our legitimate interest in finding and fixing where setup fails.
  • Contact messages. If you write to us through the contact form: your name, email address, topic and message, and a link to your Shepit account if you are signed in. We use them only to answer you. We do not keep your IP address with your message.
  • How you found us. If you arrive through a link that carries campaign tags (for example from an ad), we keep those tags, any ad click ID (such as Meta’s fbclid or Google’s gclid) and the address of the page the link opened in your browser for up to 30 days. When you create an account, we save the first and the last such visit before sign-up with your account. We use this to learn which campaigns bring people who use Shepit.

We do not collect the contents of your transcriptions on our servers beyond what is needed to perform the transcription and AI clean-up, and we do not sell any of your data. We do share some data with Meta to measure and improve our ads, as described under Advertising and attribution. Under some US state laws this counts as “sharing”, and you can opt out.

How transcription works

Your audio is forwarded to OpenAI’s transcription models (gpt-transcribe, or gpt-4o-mini-transcribe when the first one is unavailable), which return the transcribed text. Our API passes the audio through to produce that text and returns it to your device; we do not store the audio file on our servers after the request completes.

When you turn on AI clean-up, the transcribed text is sent to OpenAI’s gpt-4o-mini model, which returns the cleaned-up text.

We have not allowed OpenAI to use your audio or text to train its models. OpenAI processes them under its own API terms, which allow it to keep them for up to 30 days to monitor for abuse. See OpenAI’s business data privacy page.

Trying Shepit on the website

You can try Shepit on our website without an account. Your audio goes from your browser to our API, which forwards it to OpenAI for transcription, as described above. We do not store the audio or the text. The text is returned only to your browser. Nothing is linked to an account.

We do not keep your IP address with the audio or the text. We use it in memory to limit how often the demo can be used. Like any request to our servers, it appears in our hosting provider’s (Google Cloud) request logs for up to 30 days.

Data on your Mac

By default, the app keeps a copy of your audio on your Mac for up to 7 days or 200 recordings. You can switch this off entirely, and then no copy is kept.

The app also keeps your transcript history, with the name of the app each text went into. It stays until you delete it.

None of this leaves your Mac.

Where your data is stored

  • Account, dictionary, usage, feedback and setup records: Google Cloud Firestore in the us-east1 region (United States).
  • Billing records: your plan, subscription and payment history, as received from Stripe, in the same Firestore database.
  • Contact messages: in the same Firestore database.
  • Attribution and privacy choices: the campaign tags, click IDs and landing page saved with your account, and your advertising choice, saved once you sign in, in the same Firestore database.
  • Connection details: the IP address and browser details from your latest signed-in visit to shepit.app, and Meta’s browser and click IDs if your browser has them, in the same Firestore database.
  • Authentication: Firebase Authentication (Google Cloud).
  • Audio for Cloud transcription: processed transiently by our API and by OpenAI; not retained by us after the response is returned.

Third parties

  • Google / Firebase - sign-in and data storage. See Google’s Privacy Policy.
  • OpenAI - transcription and AI clean-up. See OpenAI’s Privacy Policy.
  • Stripe and Link - payments for paid plans. Paid plans are sold under Stripe Managed Payments, with Link, Stripe’s payment service, as the merchant of record: they collect your payment details and what is needed to calculate tax on Stripe’s checkout page, charge you, and send your receipts and invoices. Shepit never receives your card details. Shepit gives Stripe your email address and Shepit account ID to connect the payment to your account. See Stripe’s Privacy Policy.
  • Sentry - error reports from the app and our servers. See Sentry’s Privacy Policy.
  • Cloudflare - delivers our website and app updates, and protects them. Cloudflare Turnstile checks that website demo requests come from a person. See Cloudflare’s Privacy Policy.
  • Microsoft - website analytics through Microsoft Clarity, as described under Cookies and analytics. See Microsoft’s Privacy Statement.
  • Meta (Meta Platforms Ireland Limited in the EEA, UK and Switzerland; Meta Platforms, Inc. elsewhere) - advertising measurement, as described under Advertising and attribution. See Meta’s Privacy Policy.

We also use internal team notification tools to see sign-ups, feedback, contact messages and payments quickly.

We share data with Meta for advertising, only as described under Advertising and attribution. We share data with every other provider above only to the extent needed to operate the service.

Cookies and analytics

Our website uses Google Analytics 4 (GA4) to understand how visitors find and use Shepit and how the site performs. In the EEA, the UK, Switzerland, the Channel Islands, the Isle of Man and Gibraltar, and whenever we cannot tell where you are (“the consent region” below), GA4 runs only if you allow Analytics. Elsewhere it is on unless you turn it off. If Analytics is on when you sign in, we link your GA4 ID to your account and let GA4 know when you sign up, first dictate, become a regular user and first pay, with no email, name or amount. We do not use GA4 for advertising and do not send Google any ad data. See Google’s Privacy Policy. We also use Microsoft Clarity, which records how visitors move around the pages as heatmaps and session recordings, on the same Analytics choice.

What we keep in your browser:

  • Necessary: your sign-in session, your privacy choices and, after you try dictation on the website, a 30-minute pass so you are not asked to verify again. Always on.
  • Analytics: GA4 cookies _ga and _ga_*, and Clarity cookies _clck and _clsk, to count visits and recognise a returning visit.
  • Advertising: Meta cookies _fbp and _fbc, to connect your visit to a Meta ad. We delete them when you turn Advertising off.
  • Campaign tags: the tags and click IDs from the link you arrived by, and the page it opened, for up to 30 days. We delete them when you turn Analytics off or choose Necessary only.

Advertising and attribution

We advertise Shepit on Meta (Facebook and Instagram). To learn which ads work and to help Meta show them to people likely to use Shepit, we send Meta information in two ways:

  • Conversions API, from our servers, when you create an account, make your first dictation, use Shepit regularly in your first week, or make your first payment (with its amount and currency). Each event carries your email address and Shepit account ID in hashed form, the IP address and browser details from your latest signed-in visit, and Meta’s click and browser IDs when we have them.
  • Meta Pixel on our website, except your account and sign-in pages. It tells Meta which page you viewed and when you click to get the Mac app, with your IP address, browser details and Meta’s cookies.

Meta uses them to measure and deliver ads under its own terms and privacy policy.

Where you are decides the default.

  • Consent region: nothing is sent to Meta and the Pixel does not load unless you allow Advertising. Our legal basis is your consent.
  • United States: on by default. If you opt out, or your browser sends a Global Privacy Control signal, the Pixel does not load, and the events our servers still send carry Meta’s Limited Data Use flag.
  • Everywhere else: on by default. If you opt out, or your browser sends a Global Privacy Control signal, nothing is sent to Meta.

Your privacy choices

In the consent region, a panel asks you on your first visit: Accept all, Necessary only, or Customize to switch Analytics and Advertising separately. Elsewhere, Analytics and Advertising are on and you can change that at any time. We remember your choice in this browser for 12 months, then ask again in the consent region.

We also save your advertising choice with your account, so it follows you to other browsers where you sign in.

To change your choice, including opting out of sharing with Meta, use cookie settings at the bottom of every page. We also honour a Global Privacy Control signal from your browser as an opt-out of sharing with Meta, everywhere.

Turning Advertising off then also applies to what our servers send Meta, including events from the Mac app: in the United States they are sent only under Limited Data Use; everywhere else we stop sending. Data already sent to Meta before that stays with Meta; see Meta’s privacy policy for your rights there.

Retention and deletion

We keep your account, dictionary, usage, billing, attribution and setup records, and the IP address and browser details from your latest visit, for as long as your account is active. Setup records never linked to an account are deleted after 90 days. To delete your account and your personal data, email hello@shepit.app. If you pay for a plan, we first turn off its renewal. The paid period is not refunded: we delete your account when it ends, or right away if you ask.

After deletion, we keep only:

  • a one-way keyed fingerprint of your email address, so we can recognise a returning sign-up and prevent abuse. We do not keep your email address, name or any other data with it;
  • usage and billing figures, with no link to you;
  • feedback text, with no link to you.

Stripe and Link keep the payment and tax records the law requires them to keep. If you sign up again, you get a fresh, empty account. Audio sent for Cloud transcription is not retained on our servers, so there is nothing to delete there. Data on your Mac is under your control on your own device. We cannot delete events already sent to Meta; Meta keeps them under its own policy.

We keep contact messages until you ask us to delete them. If you ask through the contact form to delete your data, we first ask you to confirm by replying from the email address your data is linked to.

Your rights

You can request access to, correction of, or deletion of your personal data at any time by contacting hello@shepit.app. You can turn off analytics and sharing with Meta at any time under cookie settings (see Your privacy choices). You can also stop all data collection by signing out of the app, or by no longer using it. If you pay for a plan, cancel it as well: until it ends, Stripe keeps billing you and we keep its billing record up to date.

Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by the “last updated” date above.