Privacy policy

Last updated 7 November 2026.

Prates is owned and operated by cmd AS, registered as CMD AS, a Norwegian limited liability company, organisation number 938 827 478, registered in Foretaksregisteret. Its registered business address and head office are Sørkedalsveien 9B, 0369 Oslo, Norway. Contact support@prates.ai or use the contact form about privacy or your rights.

cmd AS is the controller for the account, authentication, trial, subscription-support, and website operations described here. Prates also processes writing locally under your settings and can send text directly to services you choose. Supplying the app does not give cmd AS access to that writing. For professional use, your organisation must assess its responsibilities for the people whose information it processes; a local installation does not make personal data exempt from data-protection law.

What stays on your Mac

Speech recognition runs on your Mac. Prates stores recordings, transcripts, History, dictionary rules, learned corrections, style guides, and notes there. Notes can describe you, people you write to, projects, views, and writing habits. cmd AS does not receive this writing through the app’s dictation, rewriting, learning, or drafting features. Prates has no product-usage analytics.

With writing context or learning from writing enabled, Prates can read the focused field, surrounding text, visible conversation, and recipients. With separate screen-reading permission it can recognise visible window text locally; it does not retain the picture. It skips protected fields, password managers, and excluded apps and websites. These controls reduce exposure but cannot identify every secret or make every use lawful. Use exclusions and approved models for confidential work.

Typed messages for the writing companion are held in memory for up to two hours to learn from them. Dictation learning also keeps a separate local sample cache of transcripts, rewritten text, and text you kept. Where you permit learning from context, that cache can include excerpts around the cursor and the window title, for up to 14 days, removed earlier after they have been learned from. This context is not part of History. Learned notes and counts can remain after the source dictation is deleted; inspect or remove them in Knowledge.

Prates does not upload recordings. Selected text can leave the Mac through an optional cloud model or AI tool as described below. Files you export, your own Mac backups, and other software or AI tools with file access are outside that promise.

What Prates sends, and to whom

• To sign you in, Prates sends this website your email address. Resend receives the address and sign-in code to deliver the email. The website does not store the address in its account database. Prates keeps it on your Mac to show who is signed in and to fill in checkout. The website stores a keyed hash of the normalised address, which links your account to your customer record at Polar. With the code, Prates sends the public half of a key your Mac made for itself, your Mac’s name, whether it is a virtual machine, and when Prates first ran on it. The website keeps the registered Macs, public keys, and registration and last-seen times; the private key stays on your Mac.
• To remember your trial, Prates sends an identifier for your Mac. The identifier is a one-way hash of your Mac’s hardware identifier: it tells your Mac apart from others but cannot be turned back into the hardware identifier, and no other app uses the same one. The website keeps it with the trial’s start for two years, so the trial cannot start again on the same Mac.
• To check your subscription, Prates sends this website your account’s hash and your Mac’s identifier about once a day, and the website asks Polar whether the subscription is active.
• When you subscribe from Prates, it asks this website to open a checkout for your account and sends your email address so the checkout can fill it in. Polar then collects the name, email address, and payment details you enter at checkout.
• When you delete your account in Prates, the website removes registered Macs and pending sign-in and replacement records, but retains a minimal account profile with its creation time, trial start, and reason if a trial was withheld, for two years, so the trial cannot start again. Deletion in Prates does not delete Polar’s billing records or data held by other services you chose. An active subscription must end before the in-app account-deletion action is available; you can still contact us to exercise your data-protection rights.
• To check for updates, Prates asks this website for the latest version once a day and says which version it is running.
• Only if you choose a cloud model or an AI tool for rewriting, learning, or the writing companion, Prates sends the text the task needs to that destination, not audio. That can include transcripts, selected text, your opening, surrounding messages and recipients, learned notes, and examples of finished writing, according to the task and the permissions you grant. Setup names the destination first. Text beyond a transcript needs separate permission for the exact provider and endpoint or exact tool command; changing that destination withdraws the permission. If you set up Prates before this version, style guides can keep using the cloud model you already chose without it, until you change that destination. If you separately allow web lookups for asked-for drafts, the tool can send search queries and page requests to search and website services. An AI tool also has its own permissions: Factory Droid can open files while it stays running despite Prates’s restrictions. The tool’s account settings and the receiving services’ terms and privacy policies apply.
• Backup to Git is not available in this version. If you set it up in an earlier version, Prates no longer sends anything there. What the repository holds, including earlier commits, stays under your control.

The account hash and Mac identifier are pseudonymous personal data, not anonymous data. They distinguish and link an account or Mac over time, and the account can be linked to billing data at Polar.

Why we process account and service data

• Providing the service, GDPR Article 6(1)(b): sign-in email delivery, account and device registration, access checks, checkout and subscription support, and answering requests needed to provide Prates.
• Legitimate interests, Article 6(1)(f): securing the website, preventing sign-in abuse and repeated trials, enforcing the three-Mac limit, handling disputes, and counting which links bring visitors and downloads. The interests are protecting accounts and keeping the paid service viable, using limited identifiers rather than collecting writing. You may object to processing based on these interests.
• Legal obligations, Article 6(1)(c): retaining or disclosing records where applicable accounting, tax, or other law requires it. Polar has its own duties as the seller.

The email address and registration data needed for sign-in are required to use the commercial app; without them we cannot create or authenticate your account. Cloud writing is optional. Permission inside Prates controls what the app may read or send; it is not, by itself, a legal basis for processing another person’s data. Professional users must also meet applicable confidentiality, notice, lawful-basis, and sensitive-data requirements.

The service automatically checks subscription eligibility and trial rules, including virtual-machine and disposable-email checks. If you think a decision is wrong, contact us for a human review.

This website

The website and account service run on Cloudflare. The website sets no cookies and keeps nothing in your browser. It counts visits to its front page, downloads, Macs signing in for the first time, and checkouts opened. Each count keeps only the campaign named in the link that brought you (such as ?ref=), the website that linked to ours, and your country as Cloudflare reports it; never your IP address, browser details, account, or Mac. Cloudflare keeps these counts for three months. Cloudflare receives your IP address, request time, requested address, and browser or app details to deliver and secure requests. IP addresses are also used to rate-limit sign-in attempts. Infrastructure diagnostics may be retained under the service’s logging settings. Downloads of speech models also contact their model host, which receives ordinary connection metadata.

Sign-in emails are sent through Resend, which processes the recipient address, message, and delivery information. Our support inbox receives whatever you choose to send us and is hosted through Apple iCloud Mail. Do not send recordings, writing samples, passwords, or API keys to support unless they are necessary and we have agreed a suitable way to handle them. See the privacy information from Cloudflare, Resend, and Apple.

Payments

Polar Software, Inc. sells Prates as the merchant of record and acts as a controller for its checkout, payment, billing, and compliance operations. It and its payment providers process the information you enter at checkout, under Polar’s privacy policy. We can access customer and subscription information made available to suppliers, including name, email address, country, and subscription status, for subscription support and administration. The website’s account database not storing your address does not mean cmd AS cannot access it in Polar. Polar’s checkout and portal may use their own cookies.

Where service data is processed

Our infrastructure, email, support, and payment providers may process personal data outside Norway and the EEA, including in the United States. A transfer subject to GDPR must have an applicable transfer mechanism, such as an adequacy decision covering the recipient or standard contractual clauses with any necessary additional safeguards. Contact support@prates.ai for information about the safeguards applicable to your data and how to obtain a copy.

For an optional model, AI tool, or web lookup that you connect yourself, the destination depends on your choice and that service’s configuration. Check its processing locations, onward recipients, retention, and transfer arrangements before sending personal or confidential information. A permission in Prates does not replace those requirements.

How long data is kept

• On your Mac: History keeps dictations for 14 days and recordings for 7 days by default. You can change those limits in Privacy. Learning samples are kept separately, up to 400 in total and 40 per kind of field and language, until displaced or cleared by resetting learning. Context in those samples expires after 14 days or is removed after learning from it. Notes, corrections, style guides, and counted habits have their own fading, limits, and deletion controls; deleting History alone does not delete them. Settings recovery copies and your own exports and backups can also retain information.
• Accounts and Macs: registration records remain while the Mac is registered, unless you remove it or delete the account. The account’s minimal trial profile is removed two years after the account is deleted or its last Mac is removed. The separate Mac trial registry expires two years after its record is written. You may ask us to review or erase retained personal data; a justified legal exception may require limited retention.
• Sign-in records: a code and a device-replacement ticket are valid for ten minutes; rate limits use recent attempts. Expiry stops their use, but does not necessarily erase the stored record at that instant. These records are removed or replaced as the account is used. An account that never finishes signing in is removed a day after its code was asked for, and in-app account deletion clears codes and tickets and keeps only the last hour of sign-in attempts.
• Support, infrastructure, and billing: retention depends on the purpose, provider settings, and applicable legal duties. A message sent through the contact form goes straight to our support mailbox with your address to reply to; the website does not store it, and counts only how many messages it sent each day. Support correspondence may be kept while needed to resolve your request or establish or defend a legal claim. Polar retains its own transaction records under its policy and legal obligations. Contact us for the applicable retention details; account deletion is not a promise that every provider or backup immediately erases every record.

Your rights

Subject to the conditions in data-protection law, you can request access, correction, erasure, restriction, and portability of personal data we control, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Write to support@prates.ai; we may need proportionate information to verify your identity. We normally respond within one month and will explain any lawful extension or refusal.

History and Knowledge can be exported or deleted in Prates; learning and reading permissions can be turned off in settings. Signing out or uninstalling is not the same as erasing local files, exports, backups, or account data. cmd AS cannot remotely read or erase writing stored only on your Mac or in a repository you control. For a request about writing processed by an employer or another organisation using Prates, contact that organisation; contact Polar about data it controls.

You can complain to Datatilsynet, the Norwegian Data Protection Authority, or the competent authority where you live or work. You do not have to contact us first.

Changes

We will update this page when processing changes and provide direct notice before a material change where required. A policy update does not silently give permission for optional reading or a new destination.