Privacy Policy

1. Who this covers

This policy applies to the Lozenge macOS application, to Lozenge for iPhone (section 3.8), and to lozenge.ai. All three are operated by Michael Lynn (“we”, “us”). Contact us at privacy@lozenge.ai.

2. The website

This site is a set of static pages. It sets no cookies unless you sign in (section 3.5), counts page views without identifying you, and runs no advertising or tracking scripts. We do not build a profile of you and we have no data about you to sell, because we do not collect any.

The site is hosted by Vercel Inc., which processes standard request logs (IP address, user agent, requested path, timestamp) to serve pages and protect against abuse. We do not use those logs for analytics and we do not join them to anything else. See the cookie notice for the full account.

Fonts are served from our own domain rather than a font CDN, so rendering this page contacts no third party.

The prompter at lozenge.ai/prompt runs in your browser. A script you open or paste there is read in the page and held in its memory. It is never sent to us or to anyone else, and never saved, so closing the tab removes it.

Page views. We use Vercel Web Analytics, served from this domain, to count which pages are read. Each view records the page, the referring site, your country, and your browser and operating system. It sets no cookie and stores nothing in your browser. Vercel tells visits apart by a hash of the request that it discards after a day, so what we see are totals, never a person, and nothing links one day’s visit to the next. See the cookie notice.

If you ask to join a beta. The form at lozenge.ai/beta keeps the email address you give it, which beta you asked for, anything you write in the note, and the day you asked, until that beta ends. We use it only to decide who to let in, to send the invite, and to write to you about that beta. Nothing is sent when you ask; an invite goes only if we say yes. For the iPhone companion the invite is a TestFlight link, and joining TestFlight is between you and Apple. Write to privacy@lozenge.ai and we will delete your request.

Page views, counted on our server. When this site serves a page it adds one to that day’s count for the page, for the name of the site that linked to it if there was one, and for the campaign name if the link carried one (utm_source), and a click on Download adds one to the day’s download count and to a count for the page the button was on. It records nothing else: no IP address, no browser details, no cookie, and nothing that tells one visit from another, so these are counts of views and never of people. The counts are kept for three days, and after that only as each day’s totals. See the cookie notice.

If you apply to be an affiliate. The form on lozenge.ai/affiliates is the one place this site asks you for anything. It keeps what you type, which is a name, an email address, and what you say about where you would write about Lozenge, together with the day you applied and the day you agreed to the affiliate terms, and which dated version of them you agreed to. We keep the acceptance because a document nobody agreed to is worth little to either side in a disagreement about money. Applying again replaces what you said. Write to privacy@lozenge.ai and we will delete it. Your network address is not stored: applications are capped per address per day against a value hashed with a secret that changes daily, which cannot be turned back into an address.

The pricing, checkout, license, and renewal pages are the exception to static pages: they run on Vercel to talk to Stripe, and are covered in section 3.4. The account pages are the other exception, covered in section 3.5.

3. The application

3.1 What we collect

Nothing, unless you choose otherwise. Lozenge needs no user account, and has no telemetry unless you turn it on, no crash reporting service, and no update check that reports who you are. We do not receive your scripts, your transcripts, your research cards, your bookmarks, your templates, or the fact that you opened the app.

Telemetry is off until you switch it on, and section 3.6 says exactly what it sends if you do. It never carries anything you write, open, say, or are told.

If you buy a plan, the one exception is license renewal, described in section 3.4. If you choose to sign in, what that keeps is in section 3.5.

3.2 What stays on your Mac

Everything the app produces is stored locally:

• Sessions, scripts, and templates are files you save where you choose, plus a bundled set inside the app.
• Transcripts, research cards, and bookmarks live in the open session until you save or export them.
• Preferences (appearance, speech locale, presenter profile, model id, toggles) are in macOS UserDefaults.
• Slide thumbnails imported from a deck are written to Application Support.
• API keys and OAuth tokens are stored in the macOS Keychain under com.mrlynn.Lozenge. They are never written to preferences, never included in an export, and never logged.

Deleting the app and its container removes all of it. We cannot delete it for you, and we cannot recover it for you, because we never had it. A Pro account can keep a copy of your preferences, and only those; see section 3.5.

3.3 Microphone, speech, screen recording, and camera

The app opens at rest. It does not listen and does not open a network port until you start a session. macOS asks for microphone permission the first time you use Listen or Listening Sync, for speech recognition permission the first time you use Listening Sync, and for camera the first time you record. Listen itself never asks for speech recognition, whichever engine it is using. You can withdraw any of these in System Settings at any time, and the app will tell you plainly that the feature is unavailable rather than working around it.

Screen recording. Capturing the audio your Mac is playing, rather than only what your microphone hears, is off until you turn it on. When you do, macOS asks for the screen recording permission, because that is the permission macOS uses to gate system audio. Lozenge asks for it to hear that audio and for no other reason. It attaches only an audio output to that stream and discards anything else macOS hands it, so no picture of your screen is read, kept, or sent anywhere. To be straight about the mechanism: macOS will not run such a stream with no video at all, so the app asks for the smallest frame the system accepts, two pixels by two, once a second, and never reads it. Like the others, you can withdraw the permission in System Settings.

Listen transcribes with one of three engines. Two run on your Mac: Apple’s on-device speech engine, on the versions of macOS that have it, and WhisperKit, which runs a Whisper model you download once. With either of those, and with the locally cached speaker model that labels who spoke, audio is not sent to us and is not sent to any third party. The third engine, Deepgram, is not on device; section 4 says what it sends. It is never the default and never switches itself on.

3.4 Buying a plan

Stripe is the seller. Presenter, Pro, and the Pro Pass are sold through Stripe Managed Payments. Stripe is the merchant of record: it takes your payment details, your billing address, and your email address, calculates and collects tax, and sends your receipt. It does so under its own privacy policy. Your card details never reach us.

We can see your order in our Stripe account, including the details Stripe shows sellers, such as the email address and country you gave it. We use that only to support your purchase, and we do not add it to any list.

If somebody referred you. A referral link puts a short code for that person in the address of the page it lands on, our links carry it on to the pricing page, and if you buy, that code goes to Stripe with your order so we can pay them. It is not a cookie, nothing about it is stored on this site, and it says nothing about you. We credit only a purchase that follows the link in the same visit, which is the whole reason there is nothing here to remember you by.

Your license holds nothing about you. It is a line of text with a plan, dates, and a Stripe order or subscription id, signed by us. The app checks it on your Mac. It is stored in your Keychain.

Your license by email. After checkout we use the email address you gave Stripe to send you the license, through Google (Gmail, as part of Google Workspace), so you have it if you close the page. That is the only thing we use it for.

Getting it again. If you lose it, type the address you bought with at lozenge.ai/license. If Stripe has a purchase for that address, we email every current license to that address and nowhere else. The page answers the same way whether or not it found one.

What we keep. We read the address from Stripe when we send, and keep neither it nor the license. To send each license only once, we keep its Stripe order id for 30 days. To limit how often the page can be used, we count requests for an hour against a hashed form of the address and of your IP address. The hash cannot be turned back into either, and changes every day.

Renewal. A subscription license in its last week, or after it ends, is sent to lozenge.ai at most once a day. That request carries the license and nothing else. We ask Stripe whether the subscription is paid and send back a renewed license. We do not store the request. Vercel keeps its standard request log of it, as for any page. A one time purchase is never sent.

3.5 If you sign in

An account is optional, only for people who bought a plan, and the app never needs one. Your license works the same without it. If you sign in at lozenge.ai/account, we keep:

• Your email address, the one you bought with, and when the account was made and last signed in to.
• Sign-in sessions: one strictly necessary cookie in your browser, and a token in the Keychain of each Mac you link. We store only a keyed hash of each, so our copy cannot sign anyone in. A browser session ends 30 days after you sign in. A Mac’s ends after 180 days unused.
• Your linked Macs: the name each Mac gave itself, and when it was linked and last seen. Unlinking, here or in the app, removes that record.
• Synced preferences, with Pro: appearance, speech language, which Listen engine and Whisper model you use, which model provider and model, and whether the Lozenge sound plays. Nothing else fits. API keys, your presenter profile, scripts, transcripts, and sessions never sync.

What you bought is not copied into the account. The account page asks Stripe each time, the same way the success page does. To sign in, you type your address, and we ask Stripe whether it has bought a plan; if it has, we email it a six digit code, good for ten minutes. For up to an hour after that we keep a keyed hash of the code and of the address, to limit how many codes and wrong tries one address gets. If the address has bought nothing, no email is sent and nothing is kept.

Who processes it. The account lives in MongoDB Atlas, run by MongoDB, Inc., in the United States. The sign-in email is sent by Google (Gmail, as part of Google Workspace). The pages run on Vercel, which keeps its standard request log. Stripe is asked about the address you type, and answers what it bought. None of them get more than the part they handle.

How long, and how to delete it. Until you delete it. The account page has a Delete button that removes all of the above at once. Stripe keeps its own record of your purchase as the seller.

3.6 If you turn on telemetry

Lozenge can send an anonymous note of which features you use and what fails. It is off unless you turn it on. You are asked once, on the Home page, and you can change the answer at any time in Settings. Until you say yes, no identifier exists on your Mac and nothing is collected or queued. If you say no, nothing is kept.

What it cannot send. Anything you write, open, say, or are told. Not session titles, beat text, transcripts, briefs, research, answers, prompts, file names, folder names, or paths. This is not a promise about how carefully the code was written: every event name and every value is a fixed word chosen from a closed list, so there is nowhere in the message for text of yours to go. Our server refuses anything outside that list as well.

What it does send. A random install identifier, the app version, the major version of macOS, and a short list of fixed words saying which features ran, which model provider and transcription engine were chosen, and what failed. Lengths and counts are sent as broad ranges, never as figures, and times are rounded to the hour.

The identifier. Random, created only when you agree, and replaced every 90 days. It is never derived from your hardware and is never linked to your email address, your account, your license, or your purchase.

Where you are. Our server reads a city and country from the connection and stores those. We do not store your IP address. Vercel, who host this site, process the address to deliver the request and keep their own short-lived operational logs, as section 4 describes for every request to this site.

What it never includes. Your spending. Lozenge counts what your own model usage costs, and that stays on your Mac. Telemetry carries no token counts and no cost, and is never joined to your license or your account.

How long. A row is deleted 180 days after it arrives. Counts worked out from those rows may be kept longer, and carry no identifier at all. Turning telemetry off in Settings deletes the identifier and anything still waiting on your Mac; because what has already been sent is not linked to you, it cannot be picked out afterwards to delete, and it ages out on the same 180 days.

3.8 Lozenge for iPhone

We collect nothing from the phone either. The iPhone app has no account, no telemetry, no crash reporting, no advertising, and no server of ours to talk to. The only network connection it makes is to Lozenge on your own Mac, when you pair it.

What stays on the phone. The scripts you add, type, paste, import, or send from your Mac, and the takes you record, are kept in the app’s own storage on the phone until you delete them. They leave the phone only when you share one, save a take to Photos, or back up the phone, which iOS may include in an iCloud or computer backup under your own Apple account. Deleting the app removes them. You can also see them in the Files app, under On My iPhone, Lozenge, and copy them to a Mac over a cable in Finder. Takes there are the recordings as made, without the Lozenge credit.

Microphone and speech. The Prompter asks for the microphone and for speech recognition the first time you start Follow Voice. It turns your speech into words on the phone and requires on-device recognition: if the phone cannot recognize your language on the phone, Follow Voice does not start, rather than send audio to Apple’s servers. The audio is not recorded unless you are recording a take, and is never sent to us.

Camera and Photos. The camera is used to record a take and to scan a pairing code shown by your Mac. Saving a take to Photos asks only to add a video; the app cannot read your photo library.

Pairing with your Mac. iOS asks for local network access the first time you pair. The phone and the Mac talk directly over your Wi-Fi, encrypted with a key that only the pairing code carries, and nothing goes through a server. While paired, the phone shows the script, the delivery report, and the Listen session from your Mac, but keeps none of it once the pairing ends. The one exception is a script you send with Send Script to iPhone, which is kept like any other script on the phone. Notes and bookmarks you add go to your Mac. If that Mac has a Presenter or Pro license in force, the phone keeps the date it last saw one, and nothing else about the license, so videos can leave without the credit for 30 days.

The Lock Screen widget knows one thing: whether a session is live. It holds no script, no names, and no transcript.

You can withdraw any of these permissions in the Settings app under Lozenge.

4. Third parties you can choose to involve

Several features call a service using credentials you supply. None of them can reach your data until you supply a credential. Once you have, the two features that run on their own during Listen, research and live answers, each switch off from the Listen menu; the rest act only when you ask them to. None of them route through us. Each is listed here with what is sent.

These providers handle that data under their own terms and privacy policies, and your relationship is with them, not with us. Their retention and training practices are theirs to state. If that matters for the conversation you are in, use one of the on-device Listen engines and leave the model features off. The app works without any of them.

5. The Google Slides bridge

The optional presenter bridge binds a port on 127.0.0.1 and speaks only to a Chrome extension on the same machine, using a six character pair code minted when the bridge starts. It carries next and previous, nothing else. It is off by default, it binds only while a session is running, and it is not reachable from your network or from the internet.

6. Recording other people

Lozenge is a notetaking tool for the person in the conversation. It is not a monitoring product and it should not be used as one. Laws on recording and transcribing a conversation differ by state and country, and some require every party to agree. You are responsible for having that conversation and for any consent it requires. Say plainly that you are taking notes. It costs nothing and it is the right thing to do.

7. Children

Lozenge is a tool for work. It is not directed at children under 13, and we do not knowingly collect anything from them. Since we collect nothing from anyone, there is nothing to delete, but write to us if you believe otherwise.

8. Your rights

Privacy laws including the GDPR, the UK GDPR, and the CCPA give you rights to access, correct, delete, and port your personal data, and to object to its processing. We can honour every one of those requests immediately for the simple reason that we hold no personal data about you, unless you signed in, and then only what section 3.5 lists, which the account page lets you delete yourself. Your app data is on your own disk and is entirely under your control. We do not sell or share personal information, and we never have.

If you want to exercise a right, or you think we have something of yours, write to privacy@lozenge.ai and we will answer within 30 days.

9. Security

Credentials use the macOS Keychain. Network calls the app makes use TLS. The app is signed with an Apple Developer ID and notarized, so macOS can verify it has not been altered since we built it. No system is perfect, and we will tell you promptly and specifically if something goes wrong that affects you.

10. Changes

If this policy changes we will update the date above. A change that materially affects how your data is handled will be called out on this page rather than slipped in quietly.