Privacy

Controller

The controller for the processing described here is:

What this notice covers

Two different things, kept apart because they behave differently. The first part is this website. The second part is the WordScript application, which runs on your own machine and which we never see.

This website in one paragraph

It sets no cookies, stores nothing on your device, has no accounts, no forms and no embedded third-party content. Nothing on it profiles you and nothing follows you to another site. What remains is the connection data that reaching any web server produces, plus a reach measurement that does not touch your device. Both are described below.

Hosting, content delivery and DNS

This site is delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which also resolves its domain name. All traffic between your browser and this site therefore passes over Cloudflare's network. Cloudflare processes technical connection data, including your IP address, in order to deliver the site, to keep it available and to defend it against attacks.

The legal basis is our legitimate interest in providing this site securely and efficiently, Article 6 (1) (f) GDPR. A data processing agreement under Article 28 GDPR is in place with the provider. Transfers to the United States are covered by Cloudflare's certification under the EU-US Data Privacy Framework and, in addition, by standard contractual clauses. Their own notice is at https://www.cloudflare.com/privacypolicy/.

Server log files

We operate no web server of our own for this site and we neither receive nor keep access logs. The connection data described in the previous section arises at Cloudflare and is retained by Cloudflare under its own policy. We have no access to it in a form that identifies you.

Reach measurement

We use Cloudflare Web Analytics to see how this site is used and how quickly it loads. The service sets no cookies and stores nothing on your device. It does not build profiles across devices and does not recognize you on other sites.

Processed are: the pages requested, the referring page, country, browser, operating system and load-speed measurements. IP address, user agent and further request headers are used to tell one visit from another, are hashed immediately in the process and are not stored. Query strings are not logged. The data is available to us for six months.

The legal basis is our legitimate interest in a site that is shaped by how it is actually used, Article 6 (1) (f) GDPR. Because nothing is stored on or read from your device, no consent under section 25 TDDDG is required and this site therefore has no cookie banner.

The script that performs it is served fromstatic.cloudflareinsights.com and reports tocloudflareinsights.com. Both are Cloudflare, the same provider that already delivers this site and is named as such above. No further party is involved.

Typefaces

Every typeface this site uses is served from this domain. No request goes to a font provider and no connection to a third party is opened in order to render text.

Links to other sites

We link to GitHub, Discord, SW labs, LinkedIn. These are ordinary links, not embedded content: nothing is transferred to those providers before you click one, and no request to them exists while you are only reading this site. Once you follow a link you have left this site, and the provider's own terms and privacy notice apply from that point.

Contact by email

If you write to us, your message and the details in it are processed in order to answer it and to deal with follow-up questions. The legal basis is Article 6 (1) (b) GDPR where your enquiry relates to a contract or its initiation, and otherwise our legitimate interest in answering enquiries addressed to us, Article 6 (1) (f) GDPR. We keep correspondence for as long as the matter it concerns is open, and delete it afterwards unless a statutory retention period applies to it.

The WordScript application

WordScript is a desktop application. It runs on your machine, it has no account and no sign-up, and there is no server of ours behind it. It contains no telemetry, no usage reporting and no crash reporting: it sends us nothing, and we hold no data about how you use it.

What you dictate is written to a directory you chose, on your own disk. The application also keeps a runtime log and a record of its own operations there. None of it leaves the machine.

Audio leaves your machine only if you point a profile at a cloud model. Then that profile's audio and the text made from it go to the vendor you selected, over your own account and your own key, and that vendor's terms and privacy notice govern what happens to it. We are not a party to that relationship and we receive nothing from it. The choice is made per profile, not once for the whole application, and a profile on the local lane reaches no network at all.

Your provider key is held in your operating system's own secret store and is stripped from the application's configuration file whenever that file is written.

The application makes one request of its own accord: when you first open its About section, and again whenever you ask it to check, it queries the GitHub releases endpoint for this project to find out whether a newer version exists. That request reaches GitHub and carries your IP address and the version you are running. It does not run at startup and it runs for no other section.

Your rights

You have the right at any time to:

• access the data held about you, Article 15 GDPR
• have inaccurate data corrected, Article 16 GDPR
• have data erased, Article 17 GDPR
• have processing restricted, Article 18 GDPR
• receive your data in a portable form, Article 20 GDPR
• withdraw a consent you gave, with effect for the future, Article 7 (3) GDPR

Write to forge@sw-labs.de to exercise any of them.

Right to object

Where we process data on the basis of legitimate interests under Article 6 (1) (f) GDPR, you may object at any time on grounds arising from your particular situation, Article 21 GDPR. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Right to complain

You may complain to a supervisory authority, Article 77 GDPR. The authority responsible for the private sector at our seat is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany. You may also approach the authority in your own country of residence or place of work.

Changes to this notice

We update this notice when what it describes changes: a service added or removed, a change in the entity behind the site, or a change in the law it rests on. The date at the foot of this page is when the whole of it was last checked against the site and the application, not when a word in it last moved. The source of both is public, and the licence is AGPL-3.0: what this page describes can be verified rather than taken on trust.

Last reviewed 27 August 2026