Privacy Policy
Last updated: March 30, 2026
TL;DR
- Audio is never written to disk. It's processed in memory and discarded.
- In Offline mode, nothing leaves your device — ever.
- In Cloud mode, audio goes to the STT provider you configure (Groq or OpenAI).
- Context awareness (Pro) reads your screen locally — data only goes to your LLM provider, never our servers.
- Dictation history is stored locally on your device.
- Telemetry is opt-in. No audio or text is ever included.
1. Who We Are
Kalam is developed by Ali Farahat / Balacode.
Ali Farahat
Email: hello@balacode.io
Website: balacode.io
Data controller note: Kalam is a desktop application that processes and stores data locally on your device. For all locally-stored data (audio, transcription history, API keys, workspace data), you are the data controller. We act as data controller only for data we actually receive — specifically, website analytics data collected through this Site, account and billing data when you use kalam.stream (see §15), and any email address you voluntarily provide.
2. What Data We Collect
Audio & Transcription
| Mode | Audio Processing | Data Destination |
|---|---|---|
| Offline | Processed locally via Whisper model | Stays on your device |
| Cloud | Sent to your configured STT provider | Groq or OpenAI (per their privacy policies) |
| Auto | Cloud by default; local for sensitive apps | Depends on active app |
In all modes, audio is processed in memory and never written to disk by Kalam.
Context Awareness (Pro feature)
When context awareness is enabled (opt-in, per mode), Kalam may read:
- App context — text from the active application window.
- Selected text — any text you have highlighted at the time of dictation.
- Clipboard — the last item you copied (within a few seconds of pressing the hotkey).
This data is read locally on your device (no API call) and sent only to the LLM provider you configure (e.g. Groq, OpenAI) as part of a single prompt alongside your transcription. Kalam never stores or forwards context data to our servers.
Sensitive app protection: When a sensitive app is detected (banking, password managers, etc.), context awareness is forced OFF regardless of mode settings. No screen content, clipboard, or selected text is read or sent anywhere.
Onboarding Email
During onboarding, you may optionally provide an email address. This is stored locally and used only if you opt in to product updates.
API Keys
API keys for Groq or OpenAI are stored locally on your device. They are sent only to the respective STT provider during cloud transcription. Kalam never transmits your keys to our servers.
Telemetry
Kalam includes optional, anonymous usage telemetry. It is disabled by default and must be explicitly enabled in Settings. Telemetry data never includes audio, transcription text, API keys, or personally identifiable information.
Website Analytics
This website (kalam.stream) uses Google Analytics (ID: G-F3WK2BDF59) and Google Fonts. Google may collect your IP address per their privacy policies.
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide voice dictation functionality | Performance of contract / legitimate interest |
| Store dictation history locally | Legitimate interest (user productivity) |
| Context awareness — read screen/clipboard for AI processing (Pro, opt-in) | Consent / legitimate interest |
| Anonymous telemetry (if opted in) | Consent |
| Website analytics | Legitimate interest |
| Accounts and Kalam Pro billing on kalam.stream | Performance of contract / legitimate interest |
4. Who We Share Data With
- STT Providers — Groq or OpenAI, only in Cloud/Auto mode, only audio data for transcription.
- LLM Providers — When Polish, custom modes, or context awareness are active (Pro), your transcription and context data are sent to the LLM provider you configure. Kalam never chooses the provider — you do.
- Google Analytics — Anonymous website usage data.
- GitHub — If you open issues, sponsor, or interact with the repository.
- Stripe — When you subscribe to Kalam Pro or checkout on kalam.stream, payment processing is handled by Stripe. We receive subscription status and limited billing metadata from Stripe, not your full card number.
- Authentication providers — If you sign in on kalam.stream, our auth vendor processes login credentials per their policy; we store identifiers and email needed to link your account and subscription.
We do not sell, rent, or trade your personal data.
Third-party disclaimer: When you use cloud transcription, audio data is transmitted directly from your device to the STT provider you configure. We have no control over and accept no responsibility for how those third-party providers collect, store, process, or retain your data. You should review the privacy policy of your chosen provider before using cloud mode:
5. Data Retention and Deletion
- Audio — Ephemeral. Processed in memory, never persisted.
- Dictation history — Stored locally. Retention period configurable in Settings. You can clear history at any time.
- App data — To fully reset, delete the Kalam data directory on your system.
- Sync data (Pro) — If you enable multi-device sync, tasks, notes, modes, settings, and encrypted API keys are stored in our database (Cloudflare D1). Dictation history does NOT sync — it stays on the machine where it was spoken. You can disable sync at any time.
- Account and billing records — Retained as required for tax, fraud prevention, and contract administration; you may request deletion where applicable (see §6).
6. Your Rights
EEA / UK (GDPR)
You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. Contact us at hello@balacode.io.
California (CCPA)
California residents have the right to know what personal information is collected, request deletion, and opt out of sale. We do not sell personal information.
7. Security
We implement reasonable technical measures to protect your data. API keys are stored using your operating system's secure storage where available. All cloud STT requests use HTTPS.
However, no method of electronic storage or internet transmission is 100% secure. We cannot and do not guarantee the absolute security of your data. You acknowledge that you provide data at your own risk, and we are not responsible for any unauthorized access to, or breach of, data stored on your device or transmitted to third-party services.
8. Children's Privacy
Kalam is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
9. Third-Party Links
Kalam and this website may link to third-party services (GitHub, Groq, OpenAI). We are not responsible for their privacy practices and accept no liability for any data processing carried out by third parties.
10. International Data Transfers
If you use cloud transcription, your audio data may be transmitted to STT providers located outside your country of residence — including to the United States. These providers may be subject to different data protection laws than those in your jurisdiction. By choosing to use cloud mode, you acknowledge and consent to this transfer. We encourage you to review the data handling practices of your chosen STT provider.
Website analytics data collected via Google Analytics may also be processed in the United States by Google LLC.
11. Cookies and Tracking
The Kalam desktop application does not use cookies.
This website (kalam.stream) uses cookies set by Google Analytics to distinguish unique visitors and track page
views. These are third-party cookies governed by Google's privacy policy. The website also stores a theme
preference in localStorage (not a cookie) which never leaves your browser.
When you sign in, session cookies (or similar tokens) may be set by our authentication provider to keep you logged in. When you start a Stripe Checkout session, Stripe may set cookies required for fraud prevention and payment compliance.
You can block cookies via your browser settings or by using a browser extension. Blocking cookies may affect checkout or sign-in on this website.
12. Limitation of Liability
To the maximum extent permitted by applicable law, we are not liable for any loss, damage, or claim arising from:
- The processing of your data by any third-party STT provider.
- Unauthorized access to data stored on your device.
- Any inaccuracy in transcription output.
- Your failure to secure your API keys or credentials.
- Any action taken by you in reliance on transcription output.
This section supplements, and does not limit, the limitation of liability and disclaimer of warranties in our Terms of Service.
13. Changes to This Policy
We may update this policy from time to time. Material changes will be noted on this page with an updated "Last updated" date.
14. Contact
For privacy-related questions or requests:
Email: hello@balacode.io
We aim to respond within 30 days.
15. Accounts, billing, and Kalam Pro (kalam.stream)
This section applies when you use account features or purchase Kalam Pro on this website (not the desktop app in isolation).
Sign-in and identifiers
We store your user id, email address, and session-related data needed to operate your account and enforce subscription entitlements.
Billing (Stripe)
Payments are processed by Stripe. We receive webhook events and customer metadata (e.g. subscription status, invoice references) — not your full payment card details.
Kalam Pro subscription data
We process data necessary to deliver Pro features and communicate billing changes. Cloud STT usage remains BYOK in the app unless we disclose otherwise in-product.