Native privacy policy

iPhone and iPad: processing choices

Mobile build 21 adds Tellwick AI without manual server addresses or access tokens. After Connect and enable translation, message originals and transcript text may be processed remotely; personal profile and task titles require separate permission. The device receives separate speech and text credentials in device-only Keychain for up to thirty days. The Hetzner gateway stores credential hashes and daily usage counts; temporary IP rate limits stay in memory. Live speech requires confirmation before capture and streams microphone PCM to a Hetero worker with resources allocated through Hostwatch. Interim text can change; confirmed fragments can be translated while recording. The gateway does not persist audio or transcript content. Server and worker administrators can access content during processing. Disconnect destroys the session without automatic replay. Mobile model weights are remote; speaker signatures remain local.

The mobile beta requires iOS/iPadOS 26 or later. Notes, tasks, calendar events, messages, source references and recording metadata use a separate private mobile container. The macOS-specific bundled Hetero, Tesseract and live-capture descriptions below apply to the Mac version. The mobile app does not include those model weights or launch the Mac helpers.

Apple processing runs on the device when its hardware, enabled features, downloaded system assets and language are supported. Image text recognition uses Apple Vision only after you tap Recognize text. Microphone recording starts only on your action; iPhone/iPad do not capture the Mac’s system audio. There is no silent remote fallback when Apple AI is unavailable.

Starting with mobile build 19, optional speaker analysis derives timed anonymous voice turns and 24-value MFCC acoustic signatures locally from microphone audio. Remember voice saves a signature and the name you enter only after your explicit action. Profiles can be renamed or deleted locally. A possible match to a saved voice requires your confirmation; labels are probabilistic and do not authenticate or establish a person’s identity. Profile names and vectors stay in the private mobile container and are not sent to Hetero. If you approve remote speech, the audio itself still goes to the configured service as described below.

Remote Hetero text processing is optional. You must configure an authenticated HTTPS service, choose remote mode and permit the relevant data categories. Translation sends the selected original text and requested language. Personal cards send permitted messages, sender/chat identifiers and your names, interests, context and watched-chat criteria. Task suggestions send the permitted task title and requested output language. The destination operator and its selected compute worker receive that content. The current text coordinator keeps a bounded memory cache for up to five minutes; other operators may have different retention policies. These data are used for the requested app function, not advertising or model training.

Remote speech has separate credentials and asks for confirmation for each recording, showing the destination before upload. The configured speech service and selected worker receive the audio and language settings. A compatible primary service supports mixed-language processing after its capabilities are checked; a separately configured legacy sessions service remains optional. Credentials for one service do not grant another service access. Service credentials stay in this device’s Keychain without iCloud synchronization. Removing credentials stops future access but does not erase data already held by a service.

With audio retention off, the mobile Core removes the local recording when processing finishes; transcript metadata and waveform selection remain. Retained audio stays in the private mobile container. No device address-book permission, automatic reply or in-app purchase is enabled.

Starting with mobile build 20, the ordinary WhatsApp connection asks for your phone number and a short code confirmed in WhatsApp. Tellwick provisions an isolated account on its Hetzner service automatically. Its random device credential is held in device-only Keychain; the service stores its hash, not the credential. The number is used for the pairing request, not stored in the provisioning registry. Temporary IP-based rate-limit counters stay in memory for up to ten minutes. Unconfirmed accounts expire after ten minutes without a new pairing request; confirmed sessions and received history remain until you remove them.

“Disconnect and delete server history” revokes this connection’s access and removes its active session and received history from the Tellwick service. Local messages, notes and source references remain on this device. If unlinking the phone fails, remove Tellwick in WhatsApp’s Linked devices too. Separate backups and recipient copies are outside this operation. Only a hash and deletion receipt are retained for up to thirty minutes after completed erasure to support safe retries. Deleting the app does not unlink WhatsApp or reliably clear Keychain. A custom server remains an advanced option with its operator’s own policies.

Mac: local workspace and AI

Tellwick Notes stores notes, tasks, events, transcripts, source references and optional recordings in its private macOS application container. It does not share writable databases with the Electron application. Import copies data; it does not alter the original library. Local AI uses the Hetero runtime and model weights inside the app, or Apple platform features. Local Hetero requests stay on loopback on this Mac; no separate AI service installation is needed.

When native live transcription is enabled, captured audio is temporarily saved locally until processing finishes, even if permanent recording storage is off. An interrupted or failed job remains available in Recording history for Retry transcription or Finish without transcription. With storage off, successful processing or explicit abandonment removes temporary audio; partial transcripts and capture-gap warnings remain. Sound that was not captured cannot be reconstructed.

Waveforms and anonymous speaker turns are recording metadata. Remember voice saves a local acoustic signature with the name you enter; profiles can be renamed or removed in Recording. Recognition suggestions require human confirmation and do not establish identity. These profiles are not automatically uploaded or used to train models.

Names/mentions, interests, personal context, watched-chat identifiers, cached translations and AI summary cards with their source references are stored in the private local workspace. Automatic translation and analysis can be disabled separately in Settings and run while the app is open. Dashboard analysis uses the bundled local model; your relevance profile is not sent to a remote Hetero coordinator. Selection, summaries and inferred relevance may be incorrect; each card explains relevance and links to its original messages.

There is no advertising SDK, advertising identifier, cross-app tracking or automatic upload of recordings for model training in this native build. Translation and transcription can be inaccurate; their source stays available for review. Apple speech/translation assets and permissions are managed by macOS. A user-selected remote Hetero coordinator receives the text/audio needed for the chosen request and operates under its own operator's privacy policy.

Image OCR runs locally only when you press Recognize text. Packaged Tesseract language models include Hebrew, English, Russian, Ukrainian and Arabic. Temporary OCR image/text files are removed after the request; saving the result as a note retains it locally with its source reference. Previewing an image does not run OCR or send it to a CLI. Optional Codex/Claude processing is disabled by default. After you enable and configure a CLI gateway in Settings and press Process, only selected text and your instruction are sent to that gateway. The CLI may forward them to its provider cloud under the provider’s terms and retention policy. Gateway tokens are stored in Keychain. Automatic dashboard analysis and translation do not use this connection.

WhatsApp server exception

WhatsApp is optional. Connecting links your phone account to a Go service using the unofficial whatsmeow library. That linked device runs on the configured server, not solely on your Mac. In the owner's current deployment this is a Hetzner server in Germany. The server operator and administrators with access to that host can access the session and stored message data.

The service stores a separate session database and message database for each account: linked-device keys, identifiers (which may include phone numbers), chat/sender names, message text, timestamps, direction, attachment metadata, descriptors for encrypted attachments, embedded history thumbnails where supplied, and a send idempotency ledger. A requested attachment is downloaded and decrypted by that server before delivery to your Mac. Persistent server storage currently holds message text, descriptors and embedded thumbnails; the download response is streamed/returned for the selected attachment.

WhatsApp transport encryption does not make the Tellwick server's plaintext message database end-to-end encrypted against its operator. The current databases have no application-level encryption at rest. SSH/TLS protects the Mac-to-service connection; use a private tunnel or an authenticated HTTPS endpoint. Credentials are stored in macOS Keychain, not in the local work DB.

Data is processed to provide account pairing, history replay, inbox display, selected attachment retrieval and a manually confirmed reply. No message is sent automatically. The native app does not request your WhatsApp password. WhatsApp/Meta and the selected infrastructure provider have their own policies. Tellwick is not affiliated with or endorsed by WhatsApp, Meta or Microsoft.

A profile-picture request retrieves the available WhatsApp preview through the configured server. The service keeps a bounded temporary memory cache and does not write these requested profile pictures to disk; unavailable or hidden pictures use initials in the app.

Mac: retention, disconnecting and deletion

Local work remains until you delete it or remove its stored data. Deleting the app alone may leave its container or Keychain configuration on the Mac. Disconnect pauses the Go connection and retains its session/history for reconnection; it is not an erase operation. Remove the linked device from WhatsApp on your phone to revoke access. Removing an account from the app's connection list also does not erase server history or unlink the phone.

Connections provides a separate confirmed “Erase session and history” action. With the current Go service, it removes that account's active server session, message database and send ledger, then its local inbox messages, cursor, chat metadata, AI cards, processing markers and watched-chat selections for that account. Saved notes and tasks remain. The operation can be retried after an interrupted request; configuration is removed only after both copies are cleared. An older server that lacks this endpoint returns an error rather than claiming erasure.

The server attempts to revoke the linked device when it is connected. If that cannot be confirmed, the app asks you to remove it in WhatsApp on your phone. Erasure does not remove independent server backups, recipient copies or saved exports, and is not a guarantee of forensic deletion. The server owner must delete retained backups separately. The Mac’s own-service setup does not provision managed accounts; its paired history has no automatic retention expiry. For export or deletion requests contact privacy@tellwick.com; do not include private chat content in the email. A managed service still needs retention and backup-deletion policies before paid availability. Revocation does not recall delivered messages.

Permissions, support and Apple

Recording begins only when you start it. macOS asks for microphone, selected system-audio/screen capture or speech access as needed; permissions can be revoked in System Settings. Attachment export and library import use files selected by you. This app does not request access to your system address book.

If you send a support report, we receive what you choose to send and your contact address. Apple processes App Store purchases and TestFlight feedback under Apple's policies; TestFlight may provide crash and testing information to the developer. Do not submit recordings, tokens or private chats in feedback unless they are necessary and you knowingly choose to include them.

You may request access, correction, export or deletion and exercise rights provided by the law applicable to you. We do not sell personal data or use message content for advertising. Disclosures may occur where legally required or necessary to protect users. Material changes will be described in the app and in the published policy before a changed processing practice is introduced.