Processors — Blurt Mac Dictation App

Blurt is the controller for everything that happens on the managed Cloud plan. Most of the companies below are our processors: they act on our instructions, for the purpose named in their row, and nothing else. Where one is not our processor — because it decides for itself what to do with the data, or because no processing agreement is in place with it — its row says so in as many words rather than leaving you to assume the general sentence covers it. None of them is allowed to use your voice or your text to train a model, and we sell nothing to anyone.

When both speech and clean-up run with ready, selected local models, the speech and text providers receive no dictation content. Local speech alone does not guarantee this: when local clean-up is unavailable, the transcript may go to a cloud text provider. Check the effective processing route shown in Blurt. The last table is different, and we would rather say so than let you read past it: Blurt requires an account in either mode, so the platform providers there hold your email address, and what is stored with it, whichever way you dictate. Until 1 September 2026 this paragraph said the whole page did not apply to on-device users, which was never true of that table — see the change log.

Our promise about changes

We announce a new processor on this page normally at least 30 days before it starts receiving any of your data, and we date every change. If you object to a new processor you may terminate your subscription free of charge before it takes effect and we refund the unused part of what you paid. Removing a processor, or narrowing what one receives, takes effect immediately — that needs no notice period.

The one exception, stated plainly rather than discovered later. A provider can fail, withdraw its service, or develop a security problem. If we have to replace one at short notice to keep the service running or to protect your data, the change happens sooner than 30 days — and we then update this page without delay, naming the new provider, the date and the reason it could not wait. We will not use that exception to sidestep the notice period; your right to object and to terminate free of charge is unaffected, and it applies from the moment you learn of the change.

Want to be told rather than having to check? Email support-blurt@chbnk.one with "processor updates" and we will write to you before each change.

Who receives your voice

Scroll the table sideways to see every column.

Speech-to-text providers — managed Cloud plan only
Provider	What it receives	Purpose	Location	Transfer basis
Soniox, Inc.	Your voice audio	Live streaming transcription — the words in the pill while you hold the key. Default.	USA	DPF adequacy where certified, otherwise SCC Module 2
ElevenLabs, Inc.	Your voice audio	Live streaming transcription — the alternative live model, used when you select it.	USA	DPF adequacy where certified, otherwise SCC Module 2
Groq, Inc.	Your voice audio	Batch transcription of the recording sent after you release the key: the speech row you can pick, and the backup for a take whose live stream failed — the app names the model when that happens. Default.	USA	DPF adequacy where certified, otherwise SCC Module 2
OpenAI, L.L.C.	Your voice audio	Batch transcription when you pick an OpenAI speech model.	USA	DPF adequacy where certified, otherwise SCC Module 2

Who receives your transcript

Text clean-up providers — managed Cloud plan only. None of these receives audio.
Provider	What it receives	Purpose	Location	Transfer basis
OpenRouter, Inc.	Transcript text	Routes the default clean-up model to one of the three hosts below. Default.	USA	SCC Module 2, incorporated by § 13.2 of its data processing agreement
Baseten Labs, Inc.	Transcript text	Runs the default clean-up model. One of only three hosts OpenRouter may use — fallback beyond this list is switched off in our configuration.	USA	DPF adequacy where certified, otherwise SCC Module 2
Nebius B.V.	Transcript text	Runs the default clean-up model. The second permitted host.	Netherlands (EU) / Finland	Inside the EEA — no transfer mechanism needed
Groq, Inc.	Transcript text	Runs the clean-up model for the row named Groq, only when you pick that row. Not a host of the default row since 3 October 2026 — see the change log. The same company that transcribes batch speech in the table above.	USA	DPF adequacy where certified, otherwise SCC Module 2
DeepInfra, Inc.	Nothing since 23 August 2026	Withdrawn. Ran the alternative clean-up models until 23 August 2026, when they were withdrawn and every request moved to the default. It now serves no model and receives no data at all. Kept on this list rather than deleted, because it did receive transcript text before that date.	USA	DPF adequacy where certified, otherwise SCC Module 2
OpenAI, L.L.C.	Transcript text	Runs the OpenAI clean-up model, and is the fallback for any model not listed above.	USA	DPF adequacy where certified, otherwise SCC Module 2
Cerebras Systems Inc.	Nothing today	Standby only. Configured in our backend but serving no model, so it currently receives no data at all. Listed so that switching it on is never a surprise — and we would announce that here like any other change.	USA	DPF adequacy where certified, otherwise SCC Module 2

Everything else

Hosting, backups, the support desk, payment, email and sign-in
Provider	What it receives	Purpose	Location	Transfer basis
Hetzner Online GmbH	Everything our backend holds	Hosts the Blurt backend and the PostgreSQL database.	Germany	Inside the EEA — no transfer mechanism needed
Cloudflare, Inc.	Backups — the whole of our database, once a day: every account email address and name, the scrypt password hashes, the Stripe customer and subscription identifiers, and support tickets with the messages in them. In the same backup, our analytics database: the website's visit counts, the payment events filed under an account identifier (Section 6g), and the app's usage counts of the people who switched them on (Section 7). Erasure requests — when an account is deleted, our server's request to erase its events in our analytics passes through Cloudflare's network on the way to our own server. It carries the account identifier and nothing else. When someone switches the app's usage analytics off, the request to erase that install's counts takes the same route, carrying the install's random identifier and nothing else. Support desk — a ticket while it is on screen: your email address, the name and subject you gave, the full text of what you wrote, the app and system version recorded with it, and the reply we send back. It travels through, and none of it is stored there. Inbound email — whatever you write to our support address, in transit to the mailbox. Crash reports — the fields listed in Section 7f of the Privacy Policy, which carry no identifier of any kind.	Several roles, and it is the same company in all of them. R2 object storage holds the off-site copy of our database. Our own admin panel and crash panel run on Workers; the panel fetches a ticket from our German backend each time we open it and writes none of it into Cloudflare's own storage. Email Routing delivers mail sent to our support address into the mailbox in the row below. Cloudflare is also the authoritative DNS for blurt.me — that role carries no browsing of yours: the site's records are not proxied, so your browser reaches our German server directly and this website still loads nothing from Cloudflare. A model-download mirror at `models.blurt.me` is built into the app but not switched on; the bucket does not exist and the app fetches models upstream instead. If we do switch it on, your Mac would fetch those files from Cloudflare directly — listed now so that it is not a surprise then.	USA — the company; the network is global. The backup bucket is not pinned to the EU: it was created without a jurisdiction, so wherever its objects physically sit, nothing restricts them to Cloudflare's European region.	DPF adequacy where certified, otherwise SCC Module 2 — cl. 6.2(a) and 6.4 of the Cloudflare Data Processing Addendum (v6.4, 3 April 2026), which § 6.1 of its Self-Serve Subscription Agreement incorporates by reference
Google Ireland Limited (the support mailbox)	Every message you send to our support address, and the notification our backend raises for each new ticket: your email address, your account identifier, the subject, the full text of what you wrote, and your later replies in the same thread. Unlike the row above, the mailbox keeps them. Our answer to you is sent by our own server rather than from this mailbox, so it is not a copy that lands there.	It is the mailbox our support address delivers into. That is a different role from the Google row further down, which is sign-in only and nothing else — neither row covers the other.	Ireland (EU) is the contracting entity for the account; Google processes what is in it on its own infrastructure, which is not confined to the EEA	None agreed with us. The mailbox is an ordinary consumer Google account, so there is no Art. 28 processing agreement behind it and no transfer mechanism negotiated for it. We would rather name that gap than print a mechanism that does not exist — see the change log, and Transfers outside the EEA
Stripe Payments Europe, Ltd. / Stripe, Inc.	Email, card details, billing address, subscription state	Takes payment and manages the subscription. Never receives audio or transcripts.	Ireland (EU) with US group companies	Intra-group SCCs; DPF adequacy for the US entity where certified
Resend (Plus Five Five, Inc.)	Email address and the content of our emails to you	Sends email verification, password reset, the subscription confirmation and support replies. Never receives audio or transcripts.	USA	DPF adequacy where certified, otherwise SCC Module 2
Apple Inc.	Sign-in identifier and email	Only if you choose "Sign in with Apple". Here Apple is an independent controller for its own sign-in service, not our processor.	USA / Ireland	Apple's own terms and transfer mechanism
Google LLC (sign-in)	Sign-in identifier and email	Only if you choose Google sign-in. Independent controller for its own sign-in service, not our processor. This row is only about sign-in; the separate Google row above, about the support mailbox, is a different role with a different answer in every column.	USA / Ireland	Google's own terms and transfer mechanism

Transfers outside the EEA

Where a row says DPF adequacy where certified, we rely on the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework when that company holds a current certification — you can verify any of them in the official DPF list. Where it does not, we rely on the Standard Contractual Clauses in the version adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), as contained in that provider's data processing terms, plus the supplementary measures described on our security page.

We say plainly what that does and does not buy you: the United States does not offer protection identical to the EEA, and US authorities have access powers with no EU equivalent. If that matters to you, use on-device mode — then nothing you dictate is in any of this. Your account still is, and so is anything you write to us: those follow the platform rows above whichever mode you use.

Two things on this page are weaker than that, and both are named rather than smoothed over.

The backup bucket is not in Cloudflare's European jurisdiction. Cloudflare lets a bucket be pinned to the EU when it is created, and ours was not; the mechanism above (DPF, otherwise the Clauses) is what covers it, and the choice of region does not change that mechanism — but it does mean the daily copy of our database is not held inside the EEA. A bucket's jurisdiction cannot be changed after it is created, so correcting it means moving the backups to a new bucket. That is a decision about your data, so it is written here while it is still open rather than reported afterwards.
The support mailbox has no processing agreement behind it. Mail you send to our support address is delivered into an ordinary consumer Google account. For an account of that kind Google offers no Art. 28 processing agreement and we have none — which means the messages you send us, including the ones exercising your rights under this policy, sit in a mailbox held on terms we did not negotiate. Both fixes are the same size — a business mailbox that comes with a processing agreement, or a mailbox outside Google — and until one of them is done this sentence is the honest description.

Ask us which mechanism applies to a specific provider and we will answer in writing: support-blurt@chbnk.one.

Change log

5 October 2026 — no new provider. The app's optional usage analytics (Section 7 of the Privacy Policy) moves, in the release after Blurt 0.3.31, from our backend database to OpenFrog — the analytics software we already run on the same Hetzner machine in Germany for the website's visit counts and the payment events. The app sends to blurt.me, so the counts pass through no other company; like everything else they are in the daily off-site backup already listed under Cloudflare, and the request to erase an install's counts crosses Cloudflare's network the way the account erasure request does — both rows now say so. What does change is stated in the policy rather than here: with the user's yes and while they are signed in, the counts are linked to their account identifier, and they are kept for 25 months. The app asks everyone who had said yes again before it sends anything under the new terms.
5 October 2026 — no new provider. This website now counts its visits with OpenFrog, analytics software we run ourselves on the same Hetzner machine in Germany that serves the site (described in Section 6f of the Privacy Policy). No cookies, nothing stored on the device, no IP address kept. The browser loads it from blurt.me and sends to blurt.me, so the site still loads nothing from Cloudflare; the counts are part of the daily off-site backup already listed under Cloudflare. No analytics provider was engaged. The same software also records the payments of a subscription under the account identifier (Section 6g): sent by our own server through blurt.me, and erased when the account is deleted. That erasure request is the one part that crosses Cloudflare's network; it carries the account identifier only, which Cloudflare already holds in the backup, and the Cloudflare row now says so.
3 October 2026 — Groq no longer stands behind the default clean-up row. On 29 September it was added there as a third host that answered when Baseten and Nebius both failed — which meant a dictation could be cleaned up by a host the row you picked did not name. It is now a row of its own in the app, named Groq, and receives transcript text only when you pick it; the default row names its two hosts and goes to no other. Nothing new receives your data — this narrows what Groq receives. The other side of it is stated plainly: when Baseten and Nebius are both down, the default row returns your words without clean-up, and the app says so. The same day Whisper on Groq became a speech model you can pick, and when Groq transcribes a take whose live stream failed, the app names its model.
29 September 2026 — Groq now also receives transcript text, as a third host OpenRouter may send the default clean-up request to, after Baseten and Nebius. Groq was already on this list for voice; what is new is that it may now receive the text of a dictation as well. This did not wait the usual 30 days, and here is why. On 29 September both permitted hosts failed at the same time — Baseten's capacity at OpenRouter was exhausted and Nebius was degraded — and while they were down clean-up did not run at all: dictations arrived as raw transcripts, with spoken commands such as "new line" or "translate into English" typed out as words. With only two hosts and fallback deliberately switched off, that can happen again whenever both are down together, so the fix is a third host rather than a wider fallback. Groq was run through the same checks as the other two before being added. Baseten stays first and Nebius second; Groq receives a request only when neither of them answers. Your right to object, and to terminate your subscription free of charge, applies from today.
1 September 2026 — this list was incomplete, and this entry is the correction. Two companies that receive personal data were missing from it. Cloudflare holds the off-site copy of our database, routes the mail sent to our support address, and runs the panel through which we read support tickets — all of it already running, none of it introduced today. Google holds those tickets in the mailbox that address delivers into, which is a different role from the Google sign-in already listed here. Nothing about where your data goes changed on this date — every one of those routes was already running. What changed is that they are written down, with what each one receives and on what basis it leaves the EEA. Two facts came out of the same review and are stated in Transfers outside the EEA rather than buried: the backup bucket is not pinned to the EU, and the support mailbox has no processing agreement behind it. The entry below, of 26 August 2026, says "no change to this list": that was true of the analytics feature it describes, which did engage nobody new — but the sentence also reads as a claim that the list itself was complete, and the list was not. It is left exactly as it was published, because that is what it was; a wrong record is not repaired by editing it. We do not claim in exchange that this page is now finished. It is the list as we verified it on 1 September 2026, against our own code and our own infrastructure rather than against memory, and a name goes on it the day we find one missing. Two sentences elsewhere on this page were corrected the same day for the same reason: the opening paragraph used to tell on-device users that none of this page applied to them, and the transfers section said the same thing again — true of the speech and text providers, never true of the platform table, where your account has always been.
26 August 2026 — no change to this list. Blurt gained optional usage analytics (opt-in, off by default, described in Section 7 of the Privacy Policy). It is recorded here precisely because it added nobody: the events are processed on the same Hetzner infrastructure in Germany as the rest of the service, in the same database, and no analytics provider was engaged. A feature of this kind normally arrives with a new name on a list like this one, so its absence is worth stating rather than leaving to be noticed.
23 August 2026 — first published. Added to the public record: ElevenLabs (voice), OpenRouter and its two permitted hosts Baseten and Nebius (text), Cerebras (standby, receiving nothing), and Hetzner (hosting), all of which were already part of the service but were not named in the Privacy Policy. DeepInfra was withdrawn the same day: the two alternative clean-up models it ran were retired and every request moved to the default, so it now receives nothing. It is listed above rather than omitted, because it did receive transcript text until that date.

See our Privacy Policy for what each provider does with the data, the security page for how it is protected, the data processing agreement if you use Blurt as a business, and the Terms of Use.