Nothing to hand over.
Your voice and your transcripts never reach a server of ours. What is left is an account — a plan and a word count.
Last updated: August 26, 2026
Who is responsible
I am, Dorin Muntean. My address is in the legal notice; by email you can reach me at kontakt@nirod.de.
A data protection officer is not required — mumble is too small for that.
What never happens
This section comes first because it is the point of the product.
Your audio is never transmitted. The speech model runs on your own Mac or PC; there is no server that could hear it, and none that ever receives a recording.
Your transcripts are never transmitted either. What mumble types at your cursor exists on your machine and nowhere else. The history of past dictations is a plain file on your disk — delete it and it is gone.
Nothing of either is used to train a model, by me or by anyone else. There is nothing to train it on.
What I do store
Only what an account needs to exist:
- Your account — email address, your password only as an irreversible hash, and your plan.
- Your usage — a number: how many words you dictated in the current calendar week. That is what the free plan's weekly limit is measured against. What those words were, I do not know — the app sends a count, not a text.
- Your devices — for each device you sign in on, a name you chose and the moment it last checked in, so you can spot and sign out one you no longer use.
- Your sessions — each sign-in records an IP address and a browser identifier for the same reason. Sign-in links from emails are stored only as a hash and expire quickly; of a passkey, only the public key is kept here.
- Your payments — if you take out Pro, the payment provider handles the transaction and I keep what an invoice needs: the plan, the period and the amount. Card details never reach me.
- Your messages — if you write via the contact form or by email, I keep your name, address and message until the matter is settled.
- Server logs — every request briefly leaves an IP address, a timestamp, the address requested and a browser identifier. That is how I spot faults and attacks; the logs are overwritten by themselves after 30 days at the latest.
Why, and on what legal basis
Account, plan, word count and support are processed to provide the service to you — performance of our agreement (Art. 6(1)(b) GDPR).
Session data, logs and rate limits serve secure operation and the prevention of abuse; I have a legitimate interest in that (Art. 6(1)(f) GDPR).
Where you additionally consent — a message about a new release, for instance — your consent is the basis (Art. 6(1)(a) GDPR). You can withdraw it at any time with a message to kontakt@nirod.de. What happened before that stays lawful.
Email address and password are what I need to provide the service at all — without them no account can exist. Everything else is optional.
There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.
Where the little there is lives
On our own hardware in Germany. mumble does not run at a cloud provider — neither the application nor the database.
One qualification belongs here, or the paragraph would not be true: the servers are managed through Laravel Forge, a service based in the USA. It sets them up and applies updates, and for that it has technical remote access to the machines. It is not used to read along — but it could.
Cloudflare (Cloudflare, Inc., USA) sits in front of the servers. It resolves the name, fends off attacks and delivers the pages. Every request to this website therefore passes through Cloudflare first: your IP address, the address you called up, the time and your browser identifier are known there. Your dictations are not — they never make a request.
Data is transmitted encrypted (HTTPS) and backed up regularly.
What the app talks to
mumble reaches the network for exactly three things: to download the speech model, once; to ask whether a newer version exists; and to tell your account how many words you dictated this week, so the free plan's limit can be measured.
Unplug the network and dictation keeps working. That is not a feature that was added — it follows from the model running on your machine.
Who else receives anything
Email delivery runs through a provider: ALL-INKL.COM (Neue Medien Münnich, Friedersdorf, Germany) sends sign-in links, confirmations and receipts. A data processing agreement is in place with them; their data centres are in Germany, and the connection to them is encrypted.
The second one is Cloudflare, the network in front of the servers — what it gets to see is set out above. Both work on my behalf and are bound by my instructions; the European Commission's standard contractual clauses cover the transfer to the USA.
Beyond that I pass nothing on. There are no advertising partners, no analytics services, and no sale of data — to anyone, at any price.
Cookies and what else sits on your device
This website sets strictly necessary cookies only: one for your session and one to protect against forged form submissions. Neither requires consent, which is why you see no cookie banner here.
The app stores your settings, the downloaded speech model and your dictation history on your own machine. That is not a transfer to me but your own copy; it goes when you uninstall or delete it. No consent is required for it either (§ 25 TDDDG): without that storage there would be no offline dictation, which is the very thing you came for.
If a Cloudflare security check steps in, it may set one further strictly necessary cookie (__cf_bm) that tells real visitors from bots. That one needs no consent either — it measures nothing and follows nobody.
There is no tracking, no analytics, no ad networks, and no fonts loaded from someone else's server.
How long I keep things
Your account stays as long as you want it. The weekly word count is reset every Monday and not kept as a history.
Sessions and sign-in links expire on their own after a short while, server and error logs after 30 days at the latest. Support requests are kept until the case is closed. Invoices are kept for as long as tax law requires — ten years.
Deleting your account starts in your account settings and is confirmed through a link I email you — a single mis-click should not cost you everything. After that, the account, its devices and its passkeys are gone. Your dictation history is unaffected, because it was never here.
Your rights
You may at any time request access to your stored data (Art. 15), have it corrected (Art. 16) or erased (Art. 17), restrict processing (Art. 18), take your data with you in a common format (Art. 20) and object to processing (Art. 21).
Deleting your account you can do yourself, in your account settings. For anything else a message to kontakt@nirod.de is enough — I will see to it within one month.
If something does not sit right with you, you can complain to a supervisory authority. The one responsible for me is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (https://www.baden-wuerttemberg.datenschutz.de).
Your right to object
You may object at any time to processing I base on a legitimate interest (Art. 21(1) GDPR) — that mainly means session data, logs and the prevention of abuse. A message to kontakt@nirod.de is enough; reasons arising from your particular situation help me decide properly.
After an objection I stop processing the data in question unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish or defend legal claims. You would never have to object to advertising — there is none.
Children
mumble is meant for adults. Anyone under 16 needs a parent or guardian to agree before opening an account. If I learn that an account was created without that agreement, I delete it.
Changes
As the service grows, this policy will change. The date above tells you when it was last touched. If something material changes about what happens to your data, I will tell you beforehand.