Legal / Privacy
Privacy Policy
Last updated October 11, 2026
PushSense and KumoNotch have no account, no server of mine, and no telemetry. What you say, copy and keep in them stays on your Mac. This page explains that in detail, and is honest about the few cases where something does leave your machine.
PushSense, the Mac app
What it never collects
I do not operate a server for PushSense, so there is nowhere for your data to go. The app has no account system, no login, no analytics, no crash reporting, and no telemetry of any kind. I cannot see how often you use it, what you dictate, or whether you use it at all.
Audio and transcripts
Audio is transcribed on your Mac by whisper.cpp. You can record with the hotkey or Buddy, with a maximum of five minutes per take. During recording, PushSense writes a local WAV recovery file. After a successful transcript is saved to local history, that audio file is deleted. Interrupted takes and takes whose transcript could not be saved remain in the Recovered audio folder until you remove them. A 200 MiB recovery-storage budget prevents new recording when full rather than deleting existing files. These files are unencrypted local files; they are never uploaded.
The last 50 transcripts are stored locally, whether you use the hotkey or Buddy. You can clear them from the History menu. Text you type, paste, or drag into another app is also subject to that app's handling. Optional Smart mode may send transcript text to your chosen provider, as explained below.
What is stored on your Mac
- Local transcript history in
~/Library/Application Support/PushSense/history.json. - Recovery audio in
~/Library/Application Support/PushSense/DictationRecovery/. Clearing transcript history does not delete these recordings; use Recovered audio to manage them. - Local diagnostic logs in
/tmp/pushsense-runtime.logcan include transcript text and processing events. They are not automatically uploaded; clearing History does not clear this log. - Your settings: hotkey choice, model selection, paste behaviour, overlay theme. Stored in macOS user defaults.
- The speech model you downloaded, in application support. You can delete it at any time.
- An API key, only if you enable the optional cloud smart mode described below. It is stored in the macOS Keychain, never in plain text.
Removing the app and its application support folder removes all of it.
The three times PushSense uses the network
These are the only outbound connections the app makes.
| When | Where | What is sent |
|---|---|---|
| You download a speech model | huggingface.co | A normal file download request. No audio, no text, nothing identifying you beyond what any download involves. |
| The app checks for updates | api.github.com | A request for the latest release number of the public releases repository. No audio, no text, no identifier for you or your machine. |
| Only if you turn on smart mode | The provider you chose | The transcribed text, so it can be cleaned up. See below. |
Smart mode is off until you turn it on
PushSense can optionally send a finished transcript to a language model to tidy up punctuation and filler words. This is disabled by default. A fresh install never contacts any language model.
If you enable it, you choose where the text goes:
- A model running on your own machine, such as Ollama. The text never leaves your Mac.
- A cloud provider you select, using an API key you supply yourself. Your transcript is sent to that company and is then subject to their privacy policy, not mine. The app names the providers it currently supports in its settings window; that list grows over time.
Choosing a cloud provider means your transcribed text is sent to that company. That is the whole point of the feature, but it is a real trade against the local-only default, so it is opt-in and clearly labelled in the app. I never see that text, and it is not routed through any server of mine. It goes from your Mac straight to the provider you picked, using your key. Which providers are available is shown in the app rather than listed here, so this page cannot go stale.
macOS permissions and why each is needed
- Microphone, to capture audio while you hold the hotkey.
- Input Monitoring, to notice the hotkey being pressed even when another app is focused.
- Accessibility, to type the finished text into the app you are using.
Each is requested by macOS itself and can be revoked in System Settings at any time. None of them send anything anywhere.
KumoNotch, the Mac app
KumoNotch has no account, no server of mine, and no analytics. The app’s only network request is an update check: at most once a day it asks GitHub for the latest version number, and you can turn this off in Settings. When you choose to download an update, the installer comes from GitHub. Links you click in it, such as a meeting’s Join button or my website, open in your browser.
What stays on your Mac
- The shelf: what you copy and the files you drop on the notch, kept in
~/Library/Application Support/KumoNotch/(an index plus copies of images). KumoNotch keeps the most recent items, 40 by default and adjustable in Settings, plus anything you pin. Clear removes everything that isn’t pinned. - Anything a password manager or another app marks as concealed or transient on the clipboard is never recorded.
- Screenshots and screen recordings you take with KumoNotch, saved in
~/Pictures/KumoNotch/. - Your settings, stored in macOS user defaults.
Your calendar, your reminders, what’s playing and your system stats are read
from macOS while KumoNotch shows them and are not copied anywhere. Ticking off or
adding a reminder writes to Apple’s Reminders, exactly as if you had done it
there. Removing the app and ~/Library/Application Support/KumoNotch/
removes everything KumoNotch stored; screenshots and recordings in
~/Pictures/KumoNotch/ stay until you delete them.
Permissions
- Calendars and Reminders, to show your agenda.
- Screen Recording, only when you take a screenshot or a recording with KumoNotch.
Each is requested by macOS itself and can be revoked in System Settings at any time.
kumonotch.com
KumoNotch’s website uses the same self-hosted Umami as this site to count page views, referrals and clicks. It sets no cookies, and remembers your language choice in your browser’s localStorage. The site is hosted by Vercel and downloads by GitHub, which receive the request information needed to serve you and have their own privacy policies.
billyxu.dev, this website
The site uses self-hosted Umami and Vercel Web Analytics to measure page views, referrals, and clicks on download, project, article, and contact links. A download click does not confirm a completed download or installation. These figures help me understand which posts bring product interest and which lead people to my other work.
Umami sets no cookies. To preserve campaign context through navigation and language changes, this site temporarily stores campaign labels, the landing path, and the referring domain in the current tab’s sessionStorage. This context expires after 30 minutes of inactivity and is cleared when the tab closes. It contains no personal identifier and does not link devices or record your voice or typed content.
URLs sent to Umami retain only valid campaign labels, without other query parameters or fragments. Copying a product link copies a clean URL without the original campaign labels. Downloads are hosted by GitHub and the site by Vercel; they receive the request information needed to serve you and have their own privacy policies. This site uses no advertising pixels.
The feedback form
If you use the feedback form, or the “Send Feedback” item in the app that opens it, what you type is stored in a database I control (hosted on Neon) and copied into a private GitHub repository so I get notified. The app never sends anything itself; it only opens the page with the app version, macOS version, speech model and smart-mode provider filled in, and you can see those before you send. Your email is stored only if you enter it, and only so I can reply. The request’s IP address is kept as a salted hash for an hour of rate limiting and is never stored in the clear. The voting feature uses a separate table and does not read feedback entries.
Anonymous experiment votes
Lab polls use a signed first-party cookie, valid for up to one year, to remember an anonymous browser and let you change its vote. Votes and experiment versions are stored in a separate Neon table with hashed browser identifiers and salted network-address hashes for abuse limiting. No name, email, or raw IP is stored in that table. The page publishes only totals; your own selection is returned to your browser. This cookie is not used for advertising or cross-site tracking. You can remove it through your browser’s site-data settings.
Children
PushSense and KumoNotch are general-purpose utilities, are not directed at children, and collect no personal information from anyone.
Changes
If this policy changes, the date at the top changes with it. Material changes to what either app sends over the network would also appear in the release notes for the version that introduces them.
Contact
Questions, or something here that does not match what you observe: use the feedback form or open an issue for PushSense or KumoNotch on GitHub. Corrections to this page are as welcome as bug reports.