Boswell Privacy Policy

Last updated: 2026-05-17

TL;DR

Boswell is local-first. Your voice memos, transcripts, and meeting recordings stay on your Mac. Boswell does not run a server, does not have user accounts, and does not collect or store any of your data on a Boswell-operated backend. Optional cloud features (BYOK AI providers, opt-in analytics, app-update checks) only contact the network when you explicitly enable them.

What data Boswell collects

By default, none. Voice memos, transcripts, meeting recordings, summaries, and exports live in your local ~/Library/Application Support/Boswell/ directory. They never leave your Mac unless you choose to send them somewhere — by exporting to a file picker destination, syncing an Obsidian vault, or configuring a cloud AI provider.

Boswell has no user account system. There is no "log in to Boswell" because there is nothing on a Boswell server to log into.

Third-party services that may be touched

These are all optional and user-initiated. None run by default.

Apple Developer + Sparkle update server (direct-distribution path only)

If you installed Boswell via the direct DMG download from https://boswellapp.net, the app uses the Sparkle update framework to check for new versions. Sparkle sends a request to Boswell's appcast URL (https://boswellapp.net/appcast.xml) to see if an update is available. The request is anonymous — it carries no user identifier — and exists only so the app can show you the in-app "Update Available" prompt. You can disable update checks in Settings → Updates.

Mac App Store builds of Boswell do not embed Sparkle; updates flow through the App Store instead.

PostHog analytics (opt-in only)

If you turn on analytics in Settings → Privacy → Send anonymous usage data, Boswell sends anonymized usage events (e.g. "user opened the Voice Memo screen") to PostHog. Events do not include the contents of your recordings, transcripts, file paths, or any personally identifying information. Analytics is off by default and can be turned off at any time. PostHog's own privacy policy applies to data once it reaches their service.

Cloud AI providers (BYOK — bring your own key)

If you configure a cloud AI provider in Settings → AI Services (OpenAI, Anthropic, DeepL, Ollama, etc.) for summarization, translation, or cloud STT, Boswell sends the relevant audio or text directly to that provider using your own API key. Boswell does not proxy these requests through a Boswell server, does not log them, and does not see your API key after you enter it (the key is stored in your macOS Keychain). The provider's own privacy policy governs what they do with the data once it leaves your Mac.

You can revoke any provider configuration at any time from Settings → AI Services.

System permissions

Boswell asks for the following macOS permissions at the moment you first use the feature that needs them:

• Microphone — when you start a voice memo, dictation, or meeting mic track.
• Screen recording — when you start a meeting capture (system audio only — no video is captured).
• Contacts — only if you opt into speaker-name resolution.
• Calendars — only if you opt into upcoming-meeting auto-detection.

Each prompt is the standard macOS prompt; you can revoke any permission later in System Settings → Privacy & Security. Boswell gracefully degrades when permissions are revoked — the relevant feature stops working, but the app continues to run.

Children's privacy

Boswell is a professional productivity tool not directed at users under 13. We do not knowingly collect personal information from children.

GDPR / CCPA stance

Boswell does not maintain any server-side user data. There is no database to query, no account to delete, and no "data subject" record for us to surface. To erase all data Boswell holds about you, uninstall the app and delete ~/Library/Application Support/Boswell/.

If you turned on optional PostHog analytics, anonymized event data may live on PostHog's servers. PostHog provides its own data subject request flow at https://posthog.com/privacy.

If you configured BYOK cloud AI providers, the provider you chose is the data controller for anything you sent to them. Each provider has its own GDPR/CCPA flow.

Changes to this policy

Material changes to this policy are versioned in the Boswell git repository at docs/PRIVACY-POLICY.md. The "Last updated" date at the top is the canonical signal — if it's older than the version you remember, nothing has changed.

Contact

Questions about this policy or your data: support@boswellapp.net.