Legal
Privacy Policy
Last updated 25 October 2026 · Effective 25 October 2026
The short version
- Wurd is run by 6amTech LTD, a UK company. UK and EU data protection law (the UK GDPR and the EU GDPR) applies.
- Wurd turns your speech into text. Your recording goes to our speech-to-text provider (ElevenLabs) and the transcript to an AI model through OpenRouter. Wurd itself never stores your audio.
- We don’t keep your transcripts or results unless you turn on cloud history (off by default) or attach them to a feedback report.
- We keep your account, settings, dictionary, snippets and usage numbers (counts and timings, not content) to run Wurd and show your stats.
- We don’t sell your data, show ads, or use what you say to train AI models.
- You can export or delete your data from the portal at any time.
1. Who we are
Wurd is operated by 6amTech LTD, a company registered in England and Wales (company number 13996992), with its registered office at 27 Old Gloucester Street, London WC1N 3AX, United Kingdom (“Wurd”, “we”, “us”).
We are the controller of the personal data described in this policy under the UK GDPR and the Data Protection Act 2018, and under the EU GDPR for people in the European Economic Area.
This policy covers the website wurd.ai, the web portal, the Wurd apps for Mac, Windows, Android and iPhone, and the Wurd keyboards. Questions: support@wurd.ai.
2. What happens when you dictate
- Your device records while you hold the key or the mic (or until you stop hands-free recording). The recording stays on your device until the text comes back, so you can retry if something fails. It is deleted when the text arrives, and after 24 hours at most.
- The recording travels over an encrypted connection to our server (Google Cloud Run, Singapore). The server checks your plan and sends the audio to ElevenLabs for speech-to-text, with the words in your dictionary as spelling hints. Our server holds the audio in memory only while it works and never writes it to disk or to a database.
- The transcript is sent through OpenRouter to an AI model (currently Anthropic’s Claude or Google’s Gemini) that cleans it up or translates it. With it go your dictionary terms, the detected and target languages, and the name of the app you’re typing in. Snippet text is not sent: snippets are swapped in afterwards on our server.
- Our server checks the numbers and the length of the result and returns the text to your device, which puts it where your cursor is.
- We ask ElevenLabs to delete the transcript right away. If that fails, our server keeps retrying it automatically.
Wurd never stores your audio. We don’t store the transcript or the result either, unless you turn on cloud history or choose to include them in a feedback report.
What our AI providers keep
- OpenRouter requests are sent with zero data retention required, so they are only routed to model endpoints that don’t store prompts or outputs. OpenRouter itself does not log prompts.
- ElevenLabs processes your audio under its own terms and may keep request data, including audio, for a limited time for security and troubleshooting. Items we delete can remain in ElevenLabs’ backups for up to 30 days.
On your device
The apps keep a history of your recent dictations on the device, which you can clear in the app. The Wurd keyboard on Android doesn’t save dictations from fields marked private (incognito) and turns the mic off in password fields; iPhone shows the system keyboard in password fields.
3. What we collect
| Data | What it includes |
|---|---|
| Account | From Google or Apple sign-in: email address, name, profile photo link and a unique account id. With Sign in with Apple you may share a private relay address instead. We also keep a normalized copy of the email address to prevent repeat free trials. |
| Profile and settings | Languages you speak, default target language, default mode, how Banglish is written, time zone, locale, and whether cloud history is on. |
| Dictionary and snippets | Words, spoken variants and snippet text you add. |
| Devices | Device name, platform, app version, an install id created by the app, and when it was last used. Computers and the iPhone Shortcut get a sign-in token that we store only as a keyed hash. |
| Usage records | For each dictation: time, mode, detected and target language, the id of the app you were typing in (for example a bundle id such as com.apple.mail, never anything on your screen), recording length, speaking time, word counts, result status and warning codes, processing times, provider costs, platform and app version. No audio, transcript or result text. |
| Totals and stats | Per day, week, month and all time: words, dictations, recording and speaking time, active days, top apps and language pairs. |
| Cloud history (only if you turn it on) | For each dictation: transcript, result, mode, languages, app id, word count and warnings. |
| Feedback and support | What you write, your email address and the request id you attach. A “bad result” report includes the transcript and result only if you tick the box to share them. |
| Technical data | IP address, user agent, request ids and error details in server logs; the country a device-link request came from. |
| Billing (when paid plans open) | Plan, subscription status, renewal dates and transaction ids from Stripe, Apple, Google or RevenueCat. We never see full card numbers. |
4. How we use it
- To run Wurd: sign you in, turn your speech into text, apply your dictionary, snippets and settings, and sync them across your devices.
- To apply plan limits and fair use, and show your words remaining.
- To show your personal stats (numbers only, never content).
- To keep Wurd secure and fair: rate limits, one free trial per person and device, and spotting unusual use such as long recordings with almost no speech.
- To answer support requests and fix problems, using the metadata above and any content you chose to send with a report.
- To meet legal obligations.
We don’t sell your personal data, we don’t show ads, and we don’t use your recordings, transcripts or results to train AI models.
Legal bases (UK and EU GDPR)
- Our contract with you: signing you in, turning your speech into text, your dictionary, snippets, settings and sync, plan limits, stats and support.
- Our legitimate interests: keeping Wurd secure, preventing abuse and repeat free trials, and improving reliability from usage metadata. We have weighed these against your rights, and you can object (section 8).
- Your consent: cloud history, and the transcript and result you choose to include in a feedback report. You can withdraw it at any time by turning cloud history off or writing to us.
- Legal obligations: for example keeping billing records for tax.
We don’t make decisions about you based only on automated processing that have legal or similarly significant effects.
5. Who processes your data
We use these service providers. Each processes data only to provide its part of Wurd.
| Provider | What for | Data |
|---|---|---|
| Google Cloud and Firebase (Google) | Servers (Cloud Run), database (Firestore), sign-in (Firebase Authentication), hosting, logs | Everything we store, and audio in transit |
| ElevenLabs | Speech-to-text | Your recording and dictionary words |
| OpenRouter | Routes AI requests to model providers with zero data retention | Transcript, dictionary terms, languages, app id |
| Anthropic, Google | AI models reached through OpenRouter | Same as OpenRouter |
| Google, Apple | Sign-in; app distribution (Google Play, App Store, TestFlight) | Account details |
| Cloudflare | DNS for wurd.ai and forwarding of email sent to support@wurd.ai | Support email |
| Google (Google Workspace) | The mailbox that receives forwarded support email | Support email |
| Stripe (when paid plans open) | Web and desktop checkout through Stripe Managed Payments. Stripe is the merchant of record: it sells you the subscription and handles payment details, tax, invoices and refunds, as a separate controller for that payment data | Billing details you give Stripe, your account email |
| RevenueCat (when paid plans open) | Subscription status for App Store and Google Play purchases | Account id, purchase receipts |
6. Where your data is
6amTech LTD is based in the United Kingdom. Our database and servers are in Singapore (Google Cloud region asia-southeast1). Firebase Authentication runs on Google’s global infrastructure. ElevenLabs, OpenRouter and the AI model providers process requests mainly in the United States. When personal data leaves the UK or the EEA, we rely on adequacy regulations where they exist, and otherwise on the safeguards in each provider’s data processing terms: the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
7. How long we keep it
| Data | Kept |
|---|---|
| Your recording | Not stored by Wurd. On your device until the text arrives (24 hours at most). At ElevenLabs, see section 2. |
| Transcript at ElevenLabs | Deleted right after the dictation (ElevenLabs’ backups up to 30 days) |
| Cloud history | Until you delete it, turn cloud history off and choose to delete it, or delete your account |
| Usage records | 90 days |
| Totals and stats; dictionary, snippets, settings | While your account exists |
| Devices | While your account exists; a device you sign out stays in your device list for 30 days |
| Feedback and support messages | Until we no longer need them to handle your request, and never longer than your account |
| Server logs | About 30 days |
| Billing records | As long as tax and accounting law requires (kept by Stripe, Apple or Google as the seller) |
8. Your choices and rights
- See and export: download all your data as a file from the portal (Settings → Export).
- Correct: change your settings, languages, dictionary and snippets in the portal or the apps.
- Cloud history: off by default. Turn it on or off in Settings; turning it off asks whether to delete what’s there.
- Devices: sign out any device from the portal.
- Delete: remove dictionary words, snippets or your cloud history at any time, or delete your whole account (section 9).
Under the UK GDPR and the EU GDPR you have the right to access your data and get a copy, to have it corrected or erased, to restrict or object to some processing (including processing based on our legitimate interests), to data portability, and to withdraw consent at any time without affecting what happened before. Most of this you can do yourself in the portal; for anything else write to support@wurd.ai. We answer within one month.
You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or, in the EEA, to the data protection authority where you live or work. We’d appreciate the chance to sort it out with you first.
We don’t sell personal information or share it for cross-context behavioural advertising.
9. Deleting your account
In the portal, go to Settings → Delete account, type the confirmation phrase and sign in again. On iPhone you can do the same in the Wurd app; if you signed in with Apple, Wurd also revokes its Apple sign-in token. Deletion takes effect at once and can’t be undone.
We revoke your sign-in tokens, then delete your profile, settings, dictionary, snippets, devices and their tokens, cloud history, usage records and totals, and your feedback and support messages, and finally your sign-in account.
What stays, and why:
- A record that an account was deleted, with a one-way hash in place of your account id and no email address (our audit log).
- A one-way hash of your normalized email address and of your device id, so a new account doesn’t get a second free trial.
- Anonymous service-wide counters, such as the number of dictations per day.
- Copies that providers keep under their own terms (see section 2) and billing records the law requires.
When paid plans open, deleting your account first cancels a subscription you bought on the web or in the desktop apps. A subscription bought in the App Store or Google Play has to be cancelled in your store account; deleting your Wurd account doesn’t stop the store from renewing it.
10. Security
- Data is encrypted in transit (HTTPS) and at rest (Google Cloud’s default encryption).
- Provider keys live only on our servers; the apps never hold them.
- Sign-in tokens for computers are stored as keyed hashes and can be revoked from the portal at any time.
- Your data can be changed only through our server, which checks every request; apps can read only their own account’s data.
- Admin access is limited, and every admin action and every deletion is recorded in an audit log.
- No system is perfectly secure. If you find a vulnerability, please tell us at support@wurd.ai.
11. Children
Wurd isn’t meant for children under 13. In EEA countries where the age of digital consent is higher (up to 16), you need to be at least that age. We don’t knowingly collect data from children. If you believe a child has an account, write to support@wurd.ai and we’ll delete it.
12. Cookies and browser storage
wurd.ai uses no advertising or analytics cookies and no third-party trackers. When you sign in, your browser keeps your session in its storage (Firebase Authentication), and the portal remembers small preferences such as dismissed announcements. Our fonts are served from our own domain. Signing in with Google opens Google’s sign-in window, which follows Google’s privacy policy.
13. Changes to this policy
We’ll update the date at the top when this policy changes. If a change matters, for example a new provider that handles your audio, we’ll tell you by email or in the app before it takes effect.
14. Contact
Email support@wurd.ai, or write to 6amTech LTD, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. See also our Terms of Service.