nowbie Privacy Policy
This is an English translation of the French « Politique de confidentialité ». If the two versions differ, the French version prevails.
This page explains what data nowbie processes, why, for how long, with whom, and how to exercise your rights. It replaces the version of 9 October 2026.
Contents
The essentials
- nowbie keeps no dictation on its servers: no audio, no text, no persona instructions. Our servers only keep the number of dictations, to apply the quota.
- For rewriting, your dictation goes through our servers and then to Google’s Gemini AI. Google does not use it to train or improve its models. It keeps it for 55 days, solely to fight abuse and meet its legal obligations.
- Your dictation history stays on your Mac.
- The wake phrase (“Hey Nowbie”, or « Dis Nowbie » in French) is detected entirely on your Mac.
- No advertising, no sale of data, no analytics cookies.
1. Who is responsible for your data
Facts SAS, a French simplified joint-stock company with a share capital of €500, RCS Paris 953 062 445, 26 rue Bosquet, 75007 Paris, France, is the controller of the processing described here.
Contact for any question about your data: hello@nowbie.app, by phone at +33 6 13 26 96 54, or by post at the address above.
We have not appointed a data protection officer: our activity does not require one (Article 37 GDPR). Your requests are handled directly by Facts SAS.
2. The data we process, why, and for how long
| Data | Why | Legal basis (GDPR, Art. 6) | Retention |
|---|---|---|---|
| Account: email address, creation date, language chosen for our emails, account and subscription status (trial, Pro, plan, start, end and renewal dates) | Create and manage your account, sign you in, manage the trial and the subscription | Performance of the contract | As long as your account exists. An inactive account, with no sign-in and no use for 2 years, is deleted: we let you know by email about 30 days before, and signing in is enough to keep it. An account whose subscription is running is never considered inactive. |
| Sign-in codes: 6-digit code sent by email, single-use code that connects the app (stored hashed) | Sign you in without a password | Performance of the contract | Email code valid 10 minutes, app code valid 5 minutes, each usable once. Deleted one day after they are created. |
| Sessions: session tokens (stored hashed). Your Mac’s name is neither collected nor stored. | Keep the app and the website signed in | Performance of the contract | Until sign-out or the end of the session: 30 days on the website; 365 days in the app, extended as long as you use it. An ended session is erased 30 days later. |
| Hashed identifier of your Mac | Grant only one free trial per Mac | Legitimate interest: prevent the free trial from being used several times on the same Mac | As long as the account that recorded it exists, then 1 year after that account is deleted, so that the one-trial-per-Mac rule still applies. It is then erased. |
| Usage: number of dictations, with the date, the type of request and the number of tokens billed by Google, never the content | Apply the 1,000-dictation quota; track our costs | Performance of the contract (quota); legitimate interest (controlling our costs) | 13 months. After that, we only keep anonymous monthly totals (number of requests and tokens), not linked to any account. |
| Content of your dictations: the audio, the active persona’s instructions and the words in your personal dictionary; to create or try a persona, the text you enter | Rewrite your dictation; create or try a persona | Performance of the contract | Never stored on our servers: sent to Gemini, then erased from our servers' memory as soon as the answer arrives. At Google: 55 days (see section 5). |
| Payment and invoicing: name, email, billing country and address, payment method, payment history, invoices, credit notes and refunds | Collect the subscription, issue invoices, handle refunds | Performance of the contract; legal obligation (accounting) | Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code). Your card number is kept by Stripe, never by us. |
| Evidence of the contract: version of the terms accepted, date and time of acceptance; your cancellations and withdrawals (first and last name, confirmation email address, subscription concerned, date and time) and our acknowledgements | Prove the content of the contract and your requests | Legal obligation; legitimate interest (evidence) | Duration of the contract, that is as long as your account exists, then 5 years after it is deleted (limitation period under article 2224 of the French Civil Code), including if you close your account. |
| Your exchanges with us (emails to hello@nowbie.app) | Answer you, handle your complaints and requests | Performance of the contract; legitimate interest | 3 years after our last exchange. |
| Technical logs of our servers: date, request type and the address called (without its parameters), response code and duration; never your IP address nor the content of dictations | Security, troubleshooting | Legitimate interest: securing the service | 30 days at most, at our host Railway. |
| Fingerprint of your IP address (computed with a secret key, without keeping the address itself) | Limit abuse, for example how many codes are sent | Legitimate interest: securing the service | 2 days at most. |
| Website visits: IP address, browser, pages requested (our host’s logs); the country derived from the IP address is used to choose the language | Display and secure the website | Legitimate interest | Host logs: 30 days at most, at Vercel. We do not keep the country. |
What is mandatory. Your email address is needed to create an account; your payment details are needed to subscribe. Without them, we cannot provide the service.
The app download counter contains no personal data.
The emails we send you are service emails only: sign-in codes, subscription, cancellation or withdrawal confirmations, links to your invoices, renewal reminders, notices of a declined payment or a card about to expire (sent by Stripe), a warning before an inactive account is deleted, information about changes to the service or to these documents. We will not send you marketing emails without your prior consent.
3. What stays on your Mac
This data is stored only on your Mac. We have no access to it.
- Your history: the transcript and the rewritten text of each dictation are kept for 90 days, the audio for 7 days, then deleted automatically. You can delete a dictation or the whole history at any time from the app.
- Your personas, your personal dictionary and your settings.
- The wake phrase (“Hey Nowbie” or « Dis Nowbie ») uses Apple’s speech recognition in on-device mode: nothing leaves your Mac until you start dictating.
- To paste in the right place, nowbie checks on your Mac the active window and field (so it never pastes into a password field or another window) and briefly uses the macOS clipboard, which it then restores. None of this is sent anywhere.
4. What we do not do
- We do not keep the content of your dictations and do not write it to our logs.
- Neither we nor Google use your dictations to train AI models.
- No advertising, no sale or rental of your data, no marketing profiling, no analytics or advertising cookies.
- No decision producing legal effects concerning you is taken in a fully automated way. Only the "one trial per Mac" rule is applied automatically; if you think it was applied to you by mistake, write to us and a person will review your situation.
5. Who receives your data
We use the following providers. They process your data on our behalf, on our instructions, under a contract that complies with Article 28 GDPR, except Stripe for part of its processing (see below).
| Provider | What it does for nowbie | Data involved | Where | Safeguards |
|---|---|---|---|---|
| Google (Gemini API: Google Cloud France, with Google LLC and its affiliates as sub-processors) | Rewrite your dictations; create and try personas | Dictation audio, active persona’s instructions, dictionary words; text entered for a persona | May be stored transiently or cached in any country where Google or its agents maintain facilities | Google data processing addendum (Google as processor); Google LLC is certified under the EU and US Data Privacy Framework |
| Railway (Railway Corporation, United States) | Host our server and database | Account, sessions, hashed Mac identifier, usage counters, evidence of the contract; dictations in transit, never stored | Servers in the European Union (Amsterdam, Netherlands); US company | Railway Corporation is certified under the EU and US Data Privacy Framework; Railway data processing addendum, with the European Commission’s standard contractual clauses |
| Vercel (Vercel Inc., United States) | Host the nowbie.app website, including the sign-in, cancellation and withdrawal pages | IP address, session cookie, email address and name entered (in transit) | Website functions in Paris (France); requests first reach the point of presence of Vercel’s global network closest to you; US company | Vercel data processing addendum, with the European Commission’s standard contractual clauses |
| Stripe (Stripe Payments Europe, Limited and Stripe Technology Company, Limited, Ireland; Stripe, Inc., United States) | Payment page, charges, refunds, subscription management portal, invoices, emails about a declined payment or a card about to expire | Name, email, billing address, payment method, payment history | European Union and United States | Stripe data processing addendum; Stripe, Inc. is certified under the EU and US framework and uses standard contractual clauses |
| Brevo (Sendinblue SAS, Paris) | Send our service emails (sign-in codes, confirmations, reminders, invoice links) | Email address, name given for a cancellation or a withdrawal, email content and attachments, sending logs | Mainly in the European Union | Brevo data processing addendum; any transfers by its sub-processors covered by standard contractual clauses or the EU and US framework |
| Zoho | Host the hello@nowbie.app mailbox | Your messages and attachments | Zoho’s European data centre (zoho.eu) | Zoho data processing addendum, with standard contractual clauses |
| Cloudflare (Cloudflare, Inc., United States) | Manage the nowbie.app domain name (DNS) | Technical DNS queries only: neither your account data nor your dictations | Global network | Cloudflare data processing addendum; Cloudflare, Inc. is certified under the EU and US framework and uses standard contractual clauses |
Google and abuse monitoring. For nowbie, Google processes your dictations as a processor, without using them to improve its products. It keeps requests and responses for 55 days, solely to detect and prevent violations of its usage policy and to meet its legal obligations. If content is flagged by its safety systems, authorised Google employees may review it. We have no access to these logs. We call Gemini with the store: false option, which prevents Google from storing the exchanges beyond this monitoring.
Stripe as a controller for part of its processing. For payments, Stripe acts on our behalf. For fraud prevention and its own legal obligations (for example anti-money-laundering), Stripe acts as a separate controller, under its privacy policy.
Authorities. We only disclose your data to an authority when the law requires us to.
6. Transfers outside the European Union
Some providers are US companies or may process data outside the European Union (Google, Railway, Vercel, Stripe, Cloudflare, and some sub-processors of Brevo or Zoho). These transfers are covered:
- for companies certified under the EU and US Data Privacy Framework, by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795 of 10 July 2023);
- in other cases, or in addition, by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021), included in our providers' contracts.
You can obtain a copy of these safeguards by writing to hello@nowbie.app.
7. Security
- All communications are encrypted (HTTPS).
- Sign-in codes and session tokens are stored hashed.
- The Gemini access key stays on our server; it is never sent to your Mac.
- Our servers never write the content of your dictations to their logs.
- The number of sign-in codes sent is limited, to block automated attempts.
If a data breach is likely to put you at risk, we report it to the CNIL and, if the risk is high, we let you know.
8. Your rights
At any time, you can:
- access your data and obtain a copy;
- have it rectified if it is inaccurate;
- have it erased;
- request restriction of its processing;
- receive the data you provided to us in a machine-readable format (portability);
- object to processing based on our legitimate interest (Mac identifier, cost tracking, logs), on grounds relating to your particular situation;
- set instructions on what happens to your data after your death (article 85 of the French Data Protection Act).
How. Write to hello@nowbie.app from your account’s email address. If we have doubts about your identity, we may ask you to confirm it, for example with a code sent to your account’s email address. We answer within one month, which may be extended by two months for a complex request; we will tell you if so. It is free.
Your dictations. Since we do not keep them, we can neither send them back to you nor erase them: they are in your Mac’s history, where you can delete them yourself.
Complaint. If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr/fr/plaintes) or with the data protection authority of your country of residence in the European Union.
9. Cookies and trackers
On the nowbie.app website, we only use essential cookies:
| Cookie | What it is for | Duration |
|---|---|---|
__Host-nowbie_session (httpOnly, secure) | Keep you signed in on nowbie.app after you create your account, and connect the app without a new code | 30 days |
nowbie_locale | Remember the language you chose with the language switcher | 1 year |
These cookies are used for authentication or to remember a choice you made: the law exempts them from consent (article 82 of the French Data Protection Act, CNIL guidelines). That is why the website shows no cookie banner. We use no analytics, advertising or social media cookies. You can delete these cookies in your browser; you will then be signed out of the website.
In the app, to apply the one-trial-per-Mac rule, nowbie reads a hardware identifier of your Mac, turns it on your Mac into an irreversible fingerprint (hash) and sends only that fingerprint to our servers.
10. Minors
nowbie is for people aged 18 and over. If we learn that an account was created by a minor, we delete it.
11. Changes
If we change this policy significantly, we will tell you by email before the new version applies. The date of the last update is shown at the top of this page.
12. Contact us
Facts SAS, 26 rue Bosquet, 75007 Paris, France; hello@nowbie.app; +33 6 13 26 96 54.