Munin — Privacy Policy

Version 1.2 (2026-09-17). Version stamp recorded on acceptance of Terms.

1. Privacy nutrition label

• Data Not Collected — no analytics, no telemetry, no advertising identifiers, no third-party SDK that performs network I/O on user data.
• Data Not Linked to User — there is no user account.
• Data Not Used for Tracking — Munin never tracks you.

2. What stays on your device

With Munin's default settings, the following never leaves your device over the network:

• Audio recordings.
• Transcripts.
• Summaries, decisions, action items.
• Voice fingerprints (when present).
• Embedding vectors used for on-device search.
• Note titles, folder names, tag names, edit history.

All of the above lives in an encrypted vault on this device. The encryption key is bound to Face ID or Touch ID / passcode and the Secure Enclave. The developer has no access to user content and cannot recover it.

The only settings that can change this are two explicit opt-ins, both off by default: iCloud Sync (§4) and Apple speech servers (§3).

3. On-device processing

• Transcription uses an on-device Whisper speech model (via WhisperKit) by default, or Apple's SFSpeechRecognizer in on-device mode as fallback. In both defaults, audio is processed entirely on this device and is not sent to Apple or any other server.
• Optional Apple speech servers — Settings contains a toggle, off by default: "Allow Apple speech servers." If you turn it on, transcription may send your audio to Apple's speech-recognition servers when no on-device model is available for your language. That audio is handled under Apple's privacy policy, not ours. This is the only setting under which recorded audio can leave your device — and it goes to Apple, never to the developer.
• Summarization uses Apple's Foundation Models on supported devices, or an on-device model you install. In all cases, summaries are generated entirely on this device.
• Search uses Apple's NLContextualEmbedding framework, on-device.

4. Network calls — exhaustive list

Munin reaches the network in only these places:

• StoreKit 2 — purchase and subscription verification with Apple. No user content is sent.
• Speech-model download (default engine) — the on-device Whisper transcription model (up to ~216 MB) is downloaded once from HuggingFace, only after you choose to during setup, from a Download prompt on first use, or from Settings. Depending on the model tier your device fits, it comes from our own mirror (asksolz/munin-whisper-small-216mb) or directly from the WhisperKit publisher's repo. It is a static binary, identical bytes for every user, analogous to a keyboard language pack. No user content is sent — only an HTTP GET for the model bundle. The model's tokenizer ships inside the app itself, so it needs no separate network fetch.
• Summarization-model download (opt-in) — if you choose to install an on-device summarization model, it is downloaded once from HuggingFace (asksolz/munin-*-mlx). Same properties: static bytes, no user content.
• Search-model asset (system framework) — Apple's NLContextualEmbedding (used for on-device search, §3) fetches its language model asset via Apple's system asset daemon on first use, the same way system keyboards and dictation download their language data. It is a static model asset, identical for every user. No user content is sent — only the framework's own asset request, handled by Apple's system daemon, not Munin's own network code.
• CloudKit — only if you explicitly enable iCloud Sync in Settings (off by default). Sync is end-to-end encrypted; metadata implications are disclosed before you turn it on. CloudKit is Apple's service, governed by your iCloud settings.
• Apple speech servers — only if you enable the off-by-default toggle described in §3.
• System APIs that incidentally check connectivity (e.g., to surface "no network" errors). No user content is involved.

That's it. Munin reaches no analytics, telemetry, advertising, or tracking endpoint, ever.

5. Permissions Munin asks for

• Microphone — to record audio. Local-only.
• Speech recognition — for transcription (see §3 for exactly when it is on-device).
• Notifications — to tell you when a long transcription or summarization finishes, and to warn you before audio is auto-deleted under your retention setting. Notification text contains no note content.
• Calendar — only when you tap "Add to calendar" on an action item. Munin creates the event you asked for; nothing else.
• Reminders — only when you tap "Send to Reminders." Same scope.
• Face ID or Touch ID / passcode — to unlock the vault. The passcode never leaves the Secure Enclave.

6. Not a regulated service

Munin is a personal voice-notes app. It is not a HIPAA-covered service, and the developer signs no Business Associate Agreement. Munin is not intended for handling Protected Health Information, attorney-client privileged material, or other regulated data. Users in regulated professions should consult their compliance officer before using Munin with sensitive content.

7. Data retention

You control retention:

• Audio — the retention policy is configurable in Settings (default: 30 days). You can mark any note "Keep audio forever," which exempts that note's audio from the policy. Munin notifies you before audio is auto-deleted.
• Transcripts and summaries — kept until you delete the note.
• Deleted notes — move to Trash and are permanently erased (audio, transcript, summary, action items, embeddings) 30 days later, or immediately if you empty Trash. If iCloud sync is enabled, deletion mirrors on next sync.
• Diagnostics — a 7-day rotating log of technical events (job lifecycle, errors). It never contains note content or audio, and it leaves the device only if you explicitly export and share it.

8. Children

Munin is rated 17+ and is not intended for children under 13.

9. Changes to this policy

The developer may revise this Privacy Policy. Material changes are surfaced in-app with 30 days' notice before taking effect.

10. Contact

Bug reports and privacy questions: solz.ask@gmail.com.