Privacy Policy

Last updated: 5 October 2026

This policy explains what personal data is collected when you use xaviesteve.com, its online tools, and my mobile apps (together, the “Services”), why, and what your rights are. I try to collect as little as possible.

Who is responsible for your data

The data controller is Xavi Esteve, an individual based in Spain. Contact: contact page or support@xaviesteve.com.

What I collect and why

Data	Purpose	Legal basis (GDPR)
Comments: name, email, website, IP address and the comment itself	Publish your comment, prevent spam, reply to you	Consent (you submit the form)
Contact messages and emails you send me	Reply to you	Legitimate interest / your request
Newsletter or notification sign-ups (email address)	Send what you subscribed to	Consent
Server logs: IP address, browser, pages requested, time	Security, abuse prevention, troubleshooting	Legitimate interest
Analytics (Google Analytics): pages viewed, approximate location, device and browser, cookie identifiers	Understand which content is useful	Consent where required, otherwise legitimate interest
Advertising data (Google AdSense / AdMob): see below	Show ads that fund the Services	Consent where required
Push notification identifiers (OneSignal), in apps that offer notifications	Deliver notifications you opted in to	Consent
Voice audio from your microphone, in apps and tools that offer dictation (such as Dictate). It is processed on your device and is not sent to me or to any server.	Convert your speech to text	Consent (you press Start and allow microphone access)

I do not sell your personal data, and I do not use it for automated decision-making or profiling beyond the advertising described below.

Advertising (AdSense and AdMob)

The website uses Google AdSense and my Android apps use Google AdMob to show ads. Google and its partners may collect and use data such as your IP address, device identifiers (including the Android Advertising ID), app and device information, and ad interactions to serve, measure and personalise ads and to prevent fraud. They may use cookies, local storage or SDKs for this.

Where required (for example in the European Economic Area and the United Kingdom), personalised ads are only shown with your consent, collected through a consent message.
You can manage personalisation at Google My Ad Center, and on Android under Settings → Privacy → Ads, where you can reset or delete your advertising ID.
Learn how Google uses data from sites and apps that use its services: policies.google.com/technologies/partner-sites. Google’s own Privacy Policy applies to the data it handles as a controller.

Mobile apps

My apps generally keep your content on your device. If an app sends data to a server, its store listing or in-app screens will say so.
I do not require you to create an account to use the apps unless stated.
Apps that show ads include the Google Mobile Ads SDK (see above). Apps that offer notifications include OneSignal, which processes a device identifier to deliver them (OneSignal’s privacy policy).
Apps may use limited diagnostic information (such as crash reports) to fix bugs.
Permissions are only requested for features that need them, and you can revoke them in your device settings.
I answer the data safety questions in Google Play based on the above. If an app differs from this policy, the app’s own notice takes precedence.

Voice dictation (Dictate)

Dictate turns your speech into text using the Whisper speech recognition model. The model runs on your device, in the app or in your browser. The audio from your microphone is processed there and is not uploaded, recorded to a server, or shared with me or with anyone else. I never receive your audio or your transcripts.

The app asks for microphone access only when you use it, and only listens while you are recording. You can revoke the permission at any time in your device or browser settings.
Your transcript draft and your settings (language, model, sensitivity) are stored only on your device. You can delete them with the “Delete local data” button, by clearing the app’s data, or by uninstalling the app.
The first time you use a model, Dictate downloads it (roughly 40 to 250 MB depending on the size you choose) from the jsDelivr content delivery network and from Hugging Face, and keeps it on your device for later use. Like any download, this lets those providers see your IP address and technical request information; no audio or text is included in those requests. Their own privacy policies apply to that data.
The Android app does not use Google Analytics. It shows ads through Google AdMob as described above. The Dictate web page uses Google Analytics and Google AdSense as described above.
If you save or share a transcript from the Android app, it goes to the app you choose in the Android share sheet; that app’s own privacy policy applies from that point.

Who else receives data

I use these providers, who process data on my behalf or as independent controllers:

Google (Analytics, AdSense, AdMob, YouTube embeds)
Cloudflare (content delivery and security)
OneSignal (push notifications in some apps)
jsDelivr and Hugging Face (delivery of the speech recognition model to your device in Dictate)
My hosting and email providers

Some of these providers are located in the United States. Where data is transferred outside the EEA, it relies on safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

How long I keep data

Comments and their details: until you ask me to remove them or I delete them.
Emails and contact messages: as long as needed to deal with your request, then deleted.
Server logs: kept for a limited period for security and then rotated out.
Analytics and advertising data: according to the retention settings of Google, which I keep to the shortest practical option.

Your rights

Under the GDPR (and Spanish data protection law) you can request access to your data, correction, deletion, restriction, objection to processing and portability, and withdraw consent at any time. Email me and I will respond within one month. If you are unhappy with my response you can complain to the Spanish data protection authority, the AEPD, or your local authority.

California residents: I do not sell or share personal information for cross-context behavioural advertising outside of the ad services described above, and you can exercise your access and deletion rights by emailing me.

Children

The Services are not directed at children under 13 (or under 16 where local law requires), and I do not knowingly collect their personal data. My apps are not designed for children. If you believe a child has provided personal data, contact me and I will delete it.

Security

Data is transmitted over HTTPS and stored on servers in the European Union where possible. No system is perfectly secure, but I take reasonable measures to protect it.

Changes to this policy

I may update this policy as the Services change. The date at the top shows the latest revision.

Contact

Questions or requests: support@xaviesteve.com or the contact page.