Plain language about what we collect, why, and how your journal is protected. No jargon we can avoid — and where legal terms are unavoidable, we explain them.
1
Utspoken (the "app") is owned and operated by Macdermott Consulting Pty Limited as trustee for the Macdermott Business Trust (ACN 150 067 968), trading as Utspoken (hereinafter "Utspoken", "we", "us", "our"). We collect, use, and are responsible for certain personal information about you.
When we do so we are regulated under Australian privacy law. We may also be regulated by the General Data Protection Regulation ("GDPR"), which applies across the European Union ("EU"), including the United Kingdom ("UK"), and we may be responsible as "controller" of your personal information for the purposes of those laws.
For any privacy question, request, or complaint, contact us at privacy@utspoken.app — full contact details are in Section 21.
2
We collect personal information in a number of ways when you use Utspoken. This section sets out what we collect, how, and why.
What: your email address and your timezone setting.
How: collected when you sign up via magic-link authentication
(through our provider, Clerk) and when you set your timezone in Settings.
Why: to identify you, sign you in, and group your entries by the
correct local date.
We use this content solely to provide the journaling service to you.
What: your Stripe customer reference and current plan tier —
we do not collect or store your card details ourselves.
How: collected when you subscribe via Stripe Checkout.
Why: to know what you're entitled to use and to manage your
subscription.
What: a one-way hash of your connection token (never the token
itself), and a log of tool calls made through it — tool name, timestamps,
response status, and, for search requests, the text of the search query. We do
not log the content of entries returned by a read request.
How: collected when you generate a connection token and use it.
Why: to operate the feature securely and detect misuse of it.
What: standard web request data such as IP address.
How: collected automatically on every request.
Why: used transiently, in memory, for rate-limiting and abuse
prevention — it is not written to our database as a persistent log tied to your
account.
3
You need to provide an email address to create an account — without it, we can't provide the service. Beyond that, you choose what you record: audio retention, AI access, and your timezone are all optional. If you don't provide them, the related feature simply won't be available to you; the core journaling experience still works.
4
We do not use your journal content to train any AI model, and we do not sell your personal information to anyone.
5
We don't sell or rent your personal information. We share it only with the service providers ("subprocessors") who help us run Utspoken, each of whom we only use because they agree to privacy standards consistent with this policy:
We may also share your information with law enforcement agencies in connection with an investigation to help prevent unlawful activity, or otherwise as required by law, or to protect the rights, property, or safety of Utspoken, our users, or third parties. If your information would be shared in a manner other than as explained in this policy, we will notify you and give you the opportunity to object, where practical.
Transcription itself runs on our own servers using a locally-hosted, open-source model — your voice recordings and transcripts are not sent to any external AI provider as part of normal journaling. The only exception is the AI-access feature you opt into, described in Section 8.
We will not knowingly share your personal information with any third parties other than in accordance with this policy, and we promise not to spam you.
6
We may share your personal information with any related entity of Macdermott Consulting Pty Limited or the Macdermott Business Trust, but only where that entity agrees to privacy standards consistent with this policy. As of the effective date of this policy, Utspoken's user data is not shared with any related entity for their own independent use.
7
We may combine information within Utspoken (for example, your account details with your usage of the AI-access feature) to operate and improve the service. We do not combine your journal content with data purchased or sourced from outside Utspoken, and we do not combine it with data from any other product.
8
When you connect an AI assistant, your entries travel to that provider's servers.
AI access is an optional, paid-tier feature. If you generate a connection token and link an AI assistant (for example, Claude desktop), that assistant can read your journal entries when you ask it to. At that point, the relevant entry content is transmitted to the AI provider you've chosen (e.g. Anthropic) and is subject to their privacy policy, not this one.
You control this entirely: nothing is sent unless you ask your AI to read it, and you can revoke the connection at any time from Settings, which immediately disables the token.
Full detail on how this feature works is at utspoken.com/mcp.
9
We keep your account and journal data for as long as your account is active, so the service can function. You can request deletion of your account and all associated personal information at any time by emailing privacy@utspoken.app. We will action verified deletion requests within 30 days, except for the limited billing records we are legally required to retain (for example, for tax purposes).
Deleting your account removes your entries, audio (if retained), AI-access tokens and associated logs, and your account record.
Your personal information will be kept in a form which permits your identification for no longer than is necessary for the purposes described in this policy.
10
Where GDPR applies, we rely on the following lawful bases to collect and use your personal information:
11
Utspoken is not directed at, and is not intended for use by, anyone under 16 years of age. We do not knowingly collect personal information from anyone under 16, and we do not have a parental-consent mechanism for younger users. If you believe a child under 16 has created an account, please contact us at privacy@utspoken.app and we will delete the account and associated data.
12
Part or all of our business may be merged, restructured, or sold, including through a sale of business or of stock, a corporate reorganisation, or a change in control. If this happens, we may transfer your personal information, including personally identifiable information, as part of that transaction — the recipient would remain bound by a privacy policy consistent with this one, or would need to obtain fresh consent to materially change how your information is handled.
13
We limit access to your personal information to those who have a genuine need to know it, and anyone processing it on our behalf is subject to a duty of confidentiality. No system is perfectly secure, and we are a small, early-stage team — we cannot guarantee the security of information transmitted over the internet. If we become aware of a data breach affecting your personal information, we will notify you and the relevant regulator as required by law.
14
Our business is based in Australia. Some of the service providers listed in Section 5 operate infrastructure in other countries, including the United States and the European Union, so your information may need to be shared with organisations both inside and outside Australia.
Australia has data protection laws, but they vary in some respects from the laws that apply in the UK and European Economic Area ("EEA"), and the European Commission has not given a formal decision that Australia provides an adequate level of data protection equivalent to the UK/EEA standard. Where we transfer, share, store, or handle your information outside the UK or EEA, we take steps to ensure it is protected in accordance with applicable data protection laws and recognised transfer mechanisms — for example, standard contractual clauses, or relying on an adequacy decision where one applies to the destination country.
For more information on the basis of any such transfers or our safeguards, contact us using the details in Section 21.
15
We are committed to ensuring that any personal information we hold about you is accurate and up to date. You have the right to request access to any personal information we hold about you, and to request that it be updated or corrected. We will take all reasonable steps to correct or erase inaccurate information without delay. To make a request, contact us using the details in Section 21.
16
Under Australia's Privacy Act 1988, and where the GDPR / UK GDPR applies to you, you have a number of important rights, including the right to:
For further information on these rights, see the Office of the Australian Information Commissioner (OAIC), or the UK Information Commissioner's Office (ICO) guidance on individuals' rights under the GDPR.
To exercise any of these rights, email, call, or write to us (Section 21), let us have enough information to identify you and confirm your identity, and let us know what your request relates to.
17
Utspoken uses a first-party session cookie set by our authentication provider (Clerk) to keep you signed in. We do not currently use advertising cookies, third-party trackers, or product analytics. If that changes in future, we will update this policy first and, where required, ask for your consent.
18
This Privacy Policy is subject to the laws of New South Wales, Australia, and each party submits to the jurisdiction of the courts of New South Wales, Australia.
19
We take complaints about our handling of your personal information seriously and will endeavour to handle them promptly and fairly:
20
We may update this policy as the service evolves. If we make a material change, we will notify you by email or an in-app notice before it takes effect. The "Last updated" date at the top of this page always reflects the current version.
21
Macdermott Consulting Pty Limited as trustee for the Macdermott Business Trust
(ACN 150 067 968), trading as Utspoken.
Email: privacy@utspoken.app
Mail: Utspoken, PO Box 678, Baulkham Hills NSW 1755, Australia
Data Protection Officer: SH Macdermott
If you would like this policy in another format (for example: audio, large print, braille), please contact us using the details above.