Website and beta data flow

Privacy Notice

Effective 2026-10-03

The short version. 100% verbatim playback stays on your Mac. Submitting a follow-up question is a separate text send. A summarized mode sends source text you choose to read, after a limited local redaction pass, through the SkimSpeak Beta relay to privacy-qualified model routes. Do not submit material you are not authorized to transmit.

Who this notice covers

This notice covers the SkimSpeak public-beta waitlist and the invited SkimSpeak app beta for United States users age 18 or older. It describes the current website and build, not every possible future version. During the beta, contact the person who invited you or email support@skimspeak.com with privacy questions.

SkimSpeak is operated by Murchie Ewings, the publisher identified in the Beta Terms. The current beta is limited to adults in the United States; availability of the website does not extend app eligibility to other countries.

When source text leaves your Mac

SkimSpeak does not transmit clipboard text in the background. A summarized mode sends only after you trigger it and approve the SkimSpeak Beta privacy notice. The app removes certain control data and attempts to replace common credential, Social Security number, labeled banking-detail, long-number, and payment-card patterns before sending, but this redaction is only a safety net and cannot detect every secret or personal detail.

Source text can come from your clipboard, a supported local document you deliberately select, or the default-off Summarize active windows experiment. Active-window reads require your opt-in and shortcut, use a separately selectable reader for the supported foreground application, and can include recent terminal/tmux exchanges, chat replies, page text, or document/message content. They do not continuously monitor your applications. Extraction and secret filtering have limits; check the cleaned Original before relying on the summary.

A separate, default-off Read coding session logs experiment may read bounded recent requests and assistant replies from a local session file corroborated against the captured exchange. A locally recognized request and its dependent submissions can include their complete assistant replies in order, plus proven agent-initiated continuations. Structured coding exchanges over the 60,000-character bound are refused rather than cutting through a selected reply. Ordinary web pages exceeding that cap are also refused before transmission, rather than dropping the article’s opening. For newer Codex versions it may also read bounded local request history and query the local session index to match the visible question and reply; ambiguous matches are refused. It excludes tool inputs/output and agent reasoning from the selected source. Failed recovery uses the screen capture, marking recognized incomplete fragments as partial. The detailed notice bundled with the app explains the limits, including copied or forked sessions.

A summary request also sends the selected detail level, fixed summary instruction, bounded custom preferences if supplied, and limited source-kind/agent-state metadata for recognized coding exchanges. Submitting Remix deliberately sends the cleaned source again with your added instruction and uses another summary. Canceling sends nothing; closing cannot retract a request already sent.

The 100% verbatim path uses the local voice without a summarization model and does not send copied text to a provider. Numeric cleanup still replaces labeled banking details, Social Security number patterns, payment-card patterns, and standalone numbers longer than ten digits in the cleaned Original and local speech. Consult the source application for exact values. Closing the player deletes its temporary audio file through an ordinary filesystem deletion, but cannot retract text already sent for summarization.

After you close the player, SkimSpeak may keep a generated active-window summary, a fingerprint of the cleaned source, and transient process/window identifiers in memory for up to ten minutes from generation. This only supports an unchanged repeat from the same live window at the same length and settings. Reuse sends no model request and uses no Beta credit. The cache is never recovered from local logs; a different source or window, a settings or privacy change, quitting SkimSpeak, or the fixed deadline removes it sooner.

When Music is already running on macOS, audible playback may request Automation permission to check and temporarily pause it. Local Apple Events resume only the same paused track after speech. SkimSpeak does not launch Music or upload your music library. Denying this permission does not prevent reading or summaries.

The standard public-beta app includes its pinned on-device voice. If voice residency is set to 20 minutes or Always, SkimSpeak may initialize that bundled voice locally after launch, including before provider consent, so setup time absorbs the first-use delay. This initialization reads no source text and sends no text, summary, credential, audio, or model request over the network. Off releases it after a read; Always keeps it resident only until SkimSpeak quits.

Follow-up questions and microphone input

In macOS builds with Follow-up, F opens the question card for the current listen and pauses reading. Opening or closing it alone sends no model request and uses no Beta allowance. A separate acknowledgement for follow-up is required for the selected provider before the first submission, in addition to that provider's existing summary consent.

Submitting a typed or transcribed question sends the original permitted source, current summary, your question, an approximate or unknown reading position and nearby passage, and up to four recent question-and-answer turns from that listen, together with the current Speculation flag and the mode recorded for each prior answer. Source and summary are each limited to 60,000 Unicode characters, questions to 2,000, recent turns to 8,000 combined, and the whole request to 256 KiB. The summary is partitioned around the paused word without a duplicate full summary; uncertain alignment is marked unknown. Position is a clue, not proof of what you heard. The same limited local filtering applies. Follow-up does not capture a new window, unsent composer, file, saved history, or web page.

The question uses the selected provider. Included Beta access uses the Cloudflare relay and its approved direct Cerebras or OpenRouter routes and bounded fallback described below. Own-key routes retain their existing provider and privacy controls. The on-device reading provider currently reports follow-up unavailable instead of switching to a cloud provider. Each submitted Beta question uses one included summary unit, including an approved relay fallback. There is no automatic web search. Replies normally use one to three sentences and fewer than 60 words, with a hard 160-word limit; general explanations must be labeled as general rather than document evidence.

Speculation is off by default. With it off, replies may give labeled concept definitions but must not guess causes, likelihoods, predictions, or missing document facts. Turning it on allows clearly qualified hypotheses and general pretrained model knowledge beyond the source; replies must distinguish these from source-supported facts. Earlier speculative answers are never independent source evidence, including after switching Speculation off. This changes the answer mode, not the selected provider, original source, summary, or quota rule. There is no web search in either mode.

Included Beta uses a server-selected approved GPT-OSS 120B or DeepSeek model with the existing bounded fallback. GPT-OSS 120B's published knowledge cutoff is June 1, 2024; this does not establish another route's cutoff. Own-key model choices follow the configured provider. Pretrained knowledge and hypotheses can be wrong or outdated. See the official GPT-OSS 120B model documentation for that model's cutoff.

For Included Beta in this build, the updated follow-up acknowledgement also covers an optional intent check when Speculation is on. Only the filtered question and a summary excerpt of at most 6,000 Unicode characters go to TypeSafe's Jev via OpenRouter with zero data retention and data collection denied. The classifier receives no original source, history, reading position, or audio. A confident decision can keep the answer grounded or permit qualified reasoning beyond the source; it cannot turn Speculation on. The check waits at most 350 milliseconds, including reading the response. A timeout, error, or uncertain decision leaves intent to the answering model's judgment within the permitted mode. There is no extra included-summary debit. Older acknowledgements do not enable this additional route; own-key routes do not use this classifier.

Included Beta may also use Jev to choose a writing style for a captured web page. Only fixed hints, such as the presence of Experience and Education headings or a professional role, go to OpenRouter with zero data retention and data collection denied. No source prose, names, page URL, screenshot, history, or audio goes to this framing check. When a build identifies a LinkedIn profile locally, its profile tag skips this check. It waits at most 350 milliseconds; a timeout, error, or uncertain result keeps the general page style, without an extra included-summary debit. The summary still uses the selected source and existing provider. Own-key routes do not use this check.

Recording requires an explicit action plus macOS Microphone and Speech Recognition permissions. SkimSpeak uses Apple's Speech framework with mandatory on-device recognition, checks local support, and offers no cloud transcription fallback. It does not upload microphone audio. Availability depends on macOS, hardware, language, local language assets, permissions, and microphone; type instead when recognition is unavailable. Apple/macOS controls its own permission and language-asset services. Recognized words appear in the question field. An explicit Stop + send action finalizes recognition and sends text only when follow-up permission is acknowledged.

Reading and answer audio stop before recording. Leaving Follow-up stops recording and answer audio, cancels the local pending request, and ignores late results. Cancellation cannot retract text already sent or guarantee that relay or inference processing stops. Follow-up text and its bounded conversation stay in memory for this listen. Follow-ups in log defaults to Omit: they are not added to local history or content-bearing logs. Choosing Include separately allows completed privacy-filtered question-and-answer exchanges and their answer mode to be appended to the existing local content log, linked to the original permitted listen. This requires Summaries or Verbose logging. Off and Analytics never store follow-up text, even with Include selected. Source privacy exclusions still apply; changing this setting cannot reopen an excluded listen. Drafts, failures, cancellations, stale answers, and microphone audio are not retained by this option. Closing the listen, replacing its source, or quitting clears the in-memory conversation; existing opted-in local records remain until deleted. This does not restore conversation state or restart source/audio retention deadlines. Answer audio follows the existing temporary-audio deletion lifecycle. The relay keeps only content-free quota, routing, timing, status, operation labels, and token metadata. A bounded response buffer enforces reply length in memory; it is never logged or stored and is discarded after the request.

Who processes summarized text

With included Beta access, the request passes through a SkimSpeak relay hosted by Cloudflare and then uses a server-controlled set of approved model routes. GPT-OSS can go directly to Cerebras's official API; DeepSeek and the Groq-pinned GPT-OSS route go through OpenRouter. Direct Cerebras requests fix the endpoint and model and request low reasoning and streaming. OpenRouter requests require Zero Data Retention routing, deny model-provider data collection, and enforce server-selected model/provider and price limits. Operational, abuse, security, billing, and legally required metadata may still exist under the participating third parties' policies.

If a fast route fails before producing visible summary text, the relay may send the same sanitized source once more through its privacy-qualified control route. Up to two privacy-qualified upstream routes—and potentially both Cerebras and OpenRouter—may therefore process one summary request, while it uses no more than one included Beta summary.

Those providers apply their own terms and privacy policies. Provider output can be incomplete or wrong. SkimSpeak does not claim to control third-party retention or make their commitments on their behalf.

Zero Data Retention limits inference content retention; it does not mean no processing or no metadata. Cloud processing may occur outside your country. SkimSpeak does not promise EU-only processing or a country-level data residency guarantee.

What SkimSpeak stores

The opaque Beta pass is stored in SkimSpeak’s private macOS Keychain item.
When a first-install Beta pass is available, SkimSpeak creates its random pass locally after consent and sends it once over HTTPS. The relay receives the pass and stores only its one-way hash for the seven-day allowance; it does not receive a hardware identifier, email address, or browser identifier.
Preferences, consent records, and content-free Beta status are stored in Application Support.
Generated audio is temporary and deleted when the player closes, a new listen starts, or the app quits.
Fresh installs keep a local, content-free timing and usage log; it is not sent to SkimSpeak.
If you deliberately choose a text-bearing local logging mode, redacted source and summary text can remain in local history until you delete it.
The Beta relay keeps hashed access tokens and content-free quota, timing, status, and abuse-control records. Per-request operations records can include a random request ID, a fixed summary/follow-up operation label, requested summary detail when applicable, a coarse source-length band, routing-policy ID, selected pinned route, outcome, bounded upstream and downstream statuses, elapsed, first-body-byte and first-visible-content timing, fallback outcome, allowlisted route, model, provider and finish-reason labels, and bounded integer token counts—not request or response bodies.
If you explicitly redeem a separately issued refill code, the relay stores only its one-way hash, a random issuance ID, fixed unit/expiry metadata, and its redeemed subject/timestamp. It never stores or returns the raw code, and your existing Keychain pass is not replaced.
The relay maintains random entitlement subject identifiers and a content-free grant, debit, refund, and redemption ledger. If a referral campaign is enabled and you supply a referral code during manual activation, it records the code's one-way hash, campaign, inviter and referred subject identifiers, activation time, and qualifying debit/reward references. This links two pseudonymous access subjects; it is not anonymous data and contains no email, source text, summary, or audio. Beta credit rewards are not a paid affiliate or market revenue-share program.
The relay can hold a transient pre-output buffer of at most 256 KiB solely to detect visible fast-route output. It is never logged or stored and is discarded after delivery or fallback.
For an unsupported active-window reader, the shortcut first shows a local error. If that build offers Request Feature, only a separate click sends the exact application bundle identifier or fixed source/failure category named in its confirmation. It sends no title, file name/path/extension, URL, text, screenshot, Accessibility tree, clipboard, email, Beta pass, content, device/install ID, or persistent user ID. The credential-free endpoint keeps only a UTC-day aggregate count, with a global daily ceiling on new aggregate keys. Exact unknown-app bundle identifiers make the demand actionable and can reveal which app was foreground. Cloudflare sees ordinary network metadata; short-lived one-way network rate keys are not stored in SkimSpeak's durable database, and request bodies are not logged. The direct transport does not follow redirects or use ambient proxy settings; it reports locally whether delivery was confirmed.

Website and download data

If you join the public-beta waitlist, the site stores the normalized email address you submit plus content-free confirmation claim, delivery, and retry timestamps. Resend receives the address and a one-time confirmation message so it can tell you that you are on the list. SkimSpeak will use that address to send the requested public-beta access message as invitations roll out. The waitlist confirmation contains no download link, invitation, Beta pass, unlock code, source text, prompt, or summary.

If you use the separate invitation-only download flow, the site stores the normalized email address plus content-free request, delivery, and cooldown timestamps. Resend receives the address and the transactional message so it can deliver that email. A requested first-wave access invitation includes the manually issued invitation code in that message; SkimSpeak and Resend necessarily process it for delivery, but the site does not add the raw code to an email or waitlist database row. The gated download flow separately stores hashed invitation and ticket values, download counts, and ordinary hosting and security metadata. An email row does not contain an invitation, download ticket, Beta pass, summary count, source text, prompt, or summary, and it has no database relationship to those records.

Invitation-gated archives remain private. Separately shared approved installers are available on the unlisted builds page without an email or code; anyone with its URL can download the latest approved build, and the link has no scheduled expiry. Beta setup and consent remain in the app. Emailed download links can be retried until they expire after 3 days; while the invitation remains active, the same code can request a fresh link. Expired ticket records are removed. The site does not sell signup emails and does not receive app clipboard text unless a user explicitly submits a summarized read, Remix, or follow-up question.

A beta-extension request stores the normalized email, optional early feedback, the separate developer follow-up choice, first and last request timestamps, and a delivery status in its own table. Network rate limiting happens outside that table. The request does not create a code automatically; if approved, an operator issues a separate code manually. Neither the request row nor the acknowledgement message is joined to a Beta pass, token, usage count, source text, prompt, model request, or summary.

If you email support@skimspeak.com, your email provider and ours necessarily process your email address and message so we can respond. Do not include source text, credentials, or other sensitive material in a support message.

A separately delivered build-update notice records the recipient email, release version, and sent time to prevent duplicate delivery. The email delivery provider processes the recipient and message. These records do not contain summary content and do not join to summary requests.

How long service records remain

Expiry of a Beta pass ends access and does not delete its database records. Entitlement, referral, invitation-email, waitlist, and extension-request records currently have no automatic deletion schedule and remain until an operator deletes them. Expired download tickets and stale fallback rate-limit rows are pruned by their respective request paths. Hosting, email delivery, security, and operations logs follow the relevant provider's configured retention; we do not promise a fixed deletion interval for those provider logs. Local timing and text-history files grow until you delete them. Turning logging Off stops new records and does not delete old ones.

Your controls

In Settings you can withdraw the Beta privacy choice, change local logging, and inspect Beta access status. You can uninstall by deleting the app, its Application Support folder, and its Keychain item. Local uninstall and withdrawing the app's privacy choice do not delete server records or retract earlier processing.

Contact support@skimspeak.com to request access, correction, or deletion of records held by SkimSpeak. We may need limited information to locate your record or verify ownership; do not send your Beta bearer, credentials, or source text. For a managed-Beta request involving one of our providers, contact us so we can investigate and coordinate with that provider. Requests about a separate provider account you supply must also go to that provider.

Children, regulated data, and security

This beta is not for anyone under 18. Do not use it with protected health information, regulated data, or third-party confidential material. SkimSpeak offers no BAA or DPA for this beta. No system is perfectly secure; use your own judgment and do not send material whose disclosure would be unacceptable.

Changes

A material change to what a future build sends or retains will be reflected in an updated notice and effective date. See the Beta Terms and EULA for the license and current Beta limits.