1. Scope and responsibility
September is a personal open-source project, maintained in India, not a company or a paid service. This notice covers its website, browser app, Mac app, and Mac keyboard. “We” refers to the maintainer operating this website, not everyone who contributes code. Independently hosted copies have their own privacy arrangements.
September stores your communication data on your device. There is no September login or automatic cloud sync. Optional cloud features send information to the services you connect. Website delivery and configured analytics also involve network requests. We do not receive a central copy of your spaces, notes, or conversations merely because you use September.
2. Information used on your device
- Profile and settings: your chosen name, speaking style, personal words, setup choices, and voice and model preferences personalize the app.
- Communication: spaces, Talk history, Agent conversations, notes, phrases, and learned word patterns support writing and speaking.
- Service credentials: OpenRouter issues a key when you authorize September. You enter your ElevenLabs key separately. These keys authenticate requests to those services.
- Audio: generated speech and timing information are cached to replay speech and export notes. Voice-cloning recordings remain in memory during preparation and are uploaded when you submit them.
- Local usage: typing counts, request counts, providers, models, timing, estimated costs, and error information support the usage reports.
Your words and recordings can reveal health information and other sensitive details about you or someone else. September does not require a diagnosis, Aadhaar number, or medical record to use the app. Include other people’s information only when you have an appropriate basis to do so.
The browser stores data in IndexedDB. The Mac app stores application data in SQLite and files, and service keys in the macOS Keychain. Local data is not given a separate application-level encryption layer. Device security and access to your browser profile matter. Scripts running on the browser app’s origin can access browser-stored keys.
3. Optional features and their recipients
- AI assistance: OpenRouter and the selected model provider receive your request and relevant context, such as personal instructions, conversation history, notes, and Agent tool results. With cloud suggestions enabled, requests can occur as you compose or change context, without a separate Send action.
- Cloud speech: ElevenLabs receives the words to speak, voice identifier, sound settings, and your API credential. Audio or video export can request cloud speech too.
- Voice cloning: ElevenLabs receives the recordings, name, and description you submit and creates a voice in your provider account. Only submit your own voice or a voice you have explicit permission and the necessary rights to clone.
- System voices: your operating system or browser provides speech. Some voices use network services. September does not guarantee that every system voice works offline.
- Apple Intelligence: the supported Mac feature processes writing requests through the local model service. September does not silently switch this selection to a cloud provider of AI assistance.
- Exports and calls: export files stay where you save them until you share them. September Microphone sends generated speech to the calling app you select. That app and call participants control any further recording or sharing.
Cloud providers have their own terms, retention, training, and international processing arrangements, which can vary by model and account settings. We do not promise zero retention or no training by those providers. Disconnecting a service does not delete information it already received. See OpenRouter’s privacy policy, ElevenLabs’ privacy policy, and Apple’s privacy information.
4. Camera, microphone, and keyboard access
Voice recording uses your microphone after permission. The Mac eye-tracker test bed uses camera frames and eye landmarks in memory. September does not save or upload that camera feed or calibration data. Stopping the test bed or leaving its page stops capture.
The Mac keyboard uses Accessibility permission to send keystrokes and read the focused text field, caret, and selection in other apps. When a field exposes no text, it can display an echo of keys it sent. Recognized password fields are excluded from mirroring. Other apps determine what their accessibility interface exposes. The keyboard does not send mirrored text to the maintainer. You can revoke camera, microphone, or Accessibility permission in system settings.
5. Website delivery, analytics, and support
Vercel delivers the website and can process IP addresses, request paths, timestamps, browser details, and security logs. A direct request to a named space or note URL can disclose that path to the host. Browser video export downloads processing code from jsDelivr, which receives network request information, not the note or video being processed.
When configured, the web app uses Umami to measure page visits. September replaces user-named route parameters and page titles in its page-view reports. It does not deliberately include message bodies, note contents, or API keys in those reports. Analytics infrastructure still receives network metadata and may process browser, device, and referrer information. Route masking is not a guarantee that all hosting or analytics information is anonymous. The Mac app does not load this web tracker. Local usage reports are separate and stay on your device.
Browser storage is used for application functions. September does not implement advertising cookies or targeted advertising. Reading this policy does not give consent to optional personal-data processing. Where consent is required, the relevant processing needs a separate choice before it starts.
If you contact us, we receive your contact details, correspondence, and any information you choose to include. We use this information to answer you, investigate problems, and handle requests or legal obligations. We do not sell your personal information or use your private communication content to train our own shared AI model.
6. Choices, withdrawal, and deletion
- You can use basic writing, saved phrases, and available system speech without connecting a cloud provider.
- To stop future requests for AI assistance through cloud providers, select no writing service and remove any separate cloud Suggestions override. To stop cloud speech, select a system voice. Disconnect provider keys in Settings and revoke them with the provider if needed.
- You can review and edit local content in the app. Settings → Data exports a portable backup. It excludes service keys and cached audio.
- Clearing September’s site data in your browser removes local browser data and settings. Export anything you want to keep first.
- On Mac, uninstalling the app alone may leave its data files and Keychain entries. Disconnect services first and remove September’s application data separately. Ask for help if needed.
- Delete exported files, shared copies, and provider-hosted voices separately. September cannot remotely erase another recipient’s copies.
You can also withdraw consent or request access, correction, or erasure of information we hold by contacting the maintainer. Withdrawal does not undo lawful processing already completed. A feature that needs the withdrawn information may stop working. We cannot retrieve, correct, or restore device-only information remotely.
7. Retention
Local content remains until you delete it or your browser or device removes it. Browser eviction, device loss, and storage failure can remove it sooner. Local usage events older than 90 days are removed when the app performs its retention cleanup. The browser speech cache is limited to 100 MiB and evicts older, less-used files. Mac audio files can remain in application storage until removed. Exported backups remain wherever you save them and are not automatically encrypted by September.
We retain support correspondence only while needed to resolve the request and meet applicable legal or dispute requirements. Hosting and analytics retention depends on the configured service and necessary security or legal requirements. Optional cloud providers apply their own retention schedules. We do not describe those records as temporary or automatically erased.
8. Sharing, transfers, and security
Infrastructure and support providers may process information for the purposes described here. We may disclose information we hold when legally required, or as permitted by law to investigate abuse or protect people and the service. We limit disclosure to what the purpose requires. A change of maintainer does not authorize an unrelated use of your information.
Hosting, support, and connected providers can process data outside India. There is no promise that all data stays in India. Applicable transfer restrictions and safeguards still apply. Selecting a cloud feature does not waive your legal rights.
Cloud API requests use HTTPS. Local access is protected by browser isolation and your device’s security controls, including Keychain for Mac credentials. No software or storage system guarantees complete security. If a breach affects information under our control, we will investigate and take corrective action. We will notify affected people and authorities as required by applicable law.
9. Children and assistance
A parent or lawful guardian should help a child choose suitable tools and connected services. September does not provide a verified parental-consent process. Do not send a child’s personal information through cloud features unless the required permissions and provider safeguards are in place. If you believe the maintainer has received a child’s information, request private contact so it can be addressed.
Speech or motor disability does not remove your ability to make decisions. A caregiver can help at your direction. Acting as a lawful guardian requires authority under applicable law.
10. Your rights in India
You can request access, correction, or deletion of personal information the maintainer actually holds. Device-only information must be managed on your device. Applicable Indian privacy rights and remedies are not waived by the MIT License.
The Information Technology Act and SPDI Rules apply where their legal conditions are met. The DPDP Act, 2023 and Rules, 2025 have phased commencement. Statutory rights and complaint procedures apply when the relevant provisions are in force and cover the processing concerned. Personal or open-source status is not a blanket exemption from applicable law.
See the official DPDP commencement notification.
11. Changes to this notice
We will update the date and explain material changes before new practices take effect, except where urgent legal or security action is necessary. A revised policy does not authorize a new purpose that needs fresh consent. We will seek that consent separately where required.
Contact the maintainer
For questions or concerns, open a GitHub issue. Issues are public. For a privacy concern, ask how to contact the maintainer privately without including personal information. Do not post API keys, medical details, recordings, or backups.
This is a volunteer project, with no guaranteed support or response time. Any duties and deadlines required by applicable law still apply.