Security
How Fol protects your voice, your words and your account. Last updated 18 September 2026.
Fol hears you while you dictate, so it should be plain about what happens to that. This page is
the technical side of the privacy policy: not what we collect, but how
it is handled.
The short version. Your audio travels encrypted, is transcribed, and is thrown
away. What you said is never stored on our servers and never written to a log. Your sign-in lives
in your device's own secure storage, and our servers keep only a fingerprint of it.
Your voice
- Encrypted on the way. Audio goes from your device to our servers over HTTPS,
and from our servers to the speech provider the same way. It never travels in the clear.
- Transcribed, then gone. The audio exists on our servers only for the moments
it takes to transcribe it. It is not saved to disk, not kept, and not used to train
models.
- One provider. Transcription is done by OpenAI, through their API. No other
company hears your audio.
- Only while you dictate. Fol listens between your start and your stop, and at
no other time.
Your words
- Not stored on our servers. The text comes back to your device and lives
there. Our servers keep a word count, not the words — unless you choose to turn on history
syncing.
- Never logged. No log on your device or on our servers contains what you
said. This is a rule in the code, not a setting.
- Kept out of clipboard history. On the Mac, Fol types your words in through
the clipboard for a moment and then puts back what was there. It marks them so clipboard
managers skip them.
- Only into the field you were typing in. If Fol cannot confirm where your
cursor is, it shows you the words to copy instead of typing them somewhere unexpected.
Your account
- Short-lived sign-ins. The token your device uses expires after 15 minutes and
is renewed quietly. The renewal token lasts 60 days and is replaced each time it is used.
- A fingerprint, not the key. Our servers store only a one-way hash (SHA-256)
of your renewal token. A copy of our database would not sign anyone in.
- Passwords are never stored. If you use a password, we keep a salted scrypt
hash of it. Signing in with Google gives us your email address and nothing else.
- Kept in your device's safe. On the Mac and iPhone your sign-in is in the
Keychain; on Android it is encrypted with a key held in the Android Keystore.
- Checks that cannot be timed. Tokens and signatures are compared in constant
time, so nobody can guess one by measuring how long we take to say no.
- Limits where it matters. Transcription, rewrites and history are
rate-limited, so a stolen or runaway client cannot run up use. Repeated wrong passwords lock
sign-in for a while.
On your device
- Mac. Fol uses Accessibility to find the text field you are typing in and to
place your words at the cursor. It does not read or record your screen. “Keep everything on
this Mac” turns off every feature that would send text anywhere.
- Android. The accessibility service is used for the same job, finding the
field and inserting your words. What it sees stays on your phone, except the text you ask about
when you choose Ask Fol.
- iPhone. The keyboard never records: iOS gives no keyboard the microphone.
The Fol app records while its session is on, and iOS shows its orange dot for as long as it
is.
What we do not do
- No advertising, no third-party trackers, no selling data.
- No reading your screen, contacts, photos, location or browsing.
- No provider keys in the apps. The speech provider's keys live only on our servers.
Found a problem?
If you think you have found a security issue, please write to
ad@coach-bot.de before telling anyone else. We will answer
quickly and say what we are doing about it.