Parolo privacy policy

Version 8, 3 October 2026.

Parolo is a voice keyboard for Android: you speak, and the text appears in the field where the cursor is. Speech is recognized on your device. The app is developed and sold by NEXIOTY ELECTRONICS LIMITED (Hong Kong), which is also responsible for the data processing described here. Privacy questions: apps@nexioty.com.

In short

• Microphone sound is processed only on the device, only in memory, and is not stored. It is not sent anywhere.
• The recognized text goes only into the field where the cursor is. Parolo does not store it or send it.
• Parolo uses the network to download the speech model for your dictation language once (325 to 682 MB), and the Google Play Billing Library sends Google its own diagnostics (see "Purchases and Parolo Pro").
• Parolo Pro purchases are handled by Google Play. Parolo sees only the fact of a purchase, never your payment details. We have no server of our own for purchases. The Google Play Billing Library built into the app sends its own diagnostic events to Google.
• Crash reports are off by default. They are sent only if you turn them on in the settings. They never contain sound, text or field contents.
• The button over apps is off by default. If you turn it on, an Android accessibility service learns only the field type and the app the field is in; it does not read the screen.
• Parolo has no ads, no analytics of its own and no accounts (for the Google library's diagnostics, see "Purchases and Parolo Pro"). We do not sell data or share it for advertising.

Microphone sound

Parolo records sound only while the Parolo keyboard window is on the screen, and only after you act. Usually that is while you hold the microphone button in the keyboard window. If you turned on the button over apps, by default recording starts right after you tap it ("Start right after tapping"; in the settings you can choose "Hold the mic" instead, and then the button only switches the keyboard and recording lasts while you hold the mic). Recording stops when you release the microphone button or tap it again, when the keyboard hides, and after 120 seconds at most.

The sound stays inside the app: it goes from the keyboard process to a separate recognition process of the same app on the same device. It exists only in memory while the phrase is recognized; after that the recognition buffer is overwritten with zeros. The sound is never written to files, never sent over the network and never included in crash reports.

Recognized text and input fields

The recognized text is inserted into the field where the cursor is, in the standard Android way for keyboards. Every keyboard inserts text the same way. Parolo does not press Send or Enter. Parolo keeps no history and does not send the text anywhere. From then on, the app that owns the field handles the text under its own policy.

To insert the text correctly, Parolo receives information about the input field from Android:

• the field type (dictation is disabled in password fields);
• the name of the app that owns the field;
• the field name set by the app's developer and the field hint, to tell one field from another when the app restarts input. The hint is not stored; only its hash goes into the log;
• one character before the cursor, to put a space between phrases.

This information is used only on the device, at the moment of typing.

When you turn on any third-party keyboard, Android warns that it "may be able to collect all the text you type". The system shows this for every keyboard. Parolo collects only what is described here.

Voice messages and audio files you share

If you share a voice message or an audio file with Parolo ("Share" → "Transcribe"), the file is processed only on the device. Parolo receives it from the sending app with a temporary Android permission, makes a temporary copy in the app's internal folder, converts it into audio for recognition and recognizes it the same way as dictation. The copy and the audio are deleted when you close the transcription screen (including swiping it away from recent apps), and leftovers after a crash are deleted automatically after about an hour. The file, the audio and the text are not sent anywhere.

The transcript is shown on the screen and is not saved: you can copy it or send it to another app yourself. Only the number of words is counted on the device, for the weekly limit and the statistics. The technical log keeps the file format and length and the processing time, without the text, the file name or the sending app.

Button over apps (optional)

On Android 13 and later, Parolo can show a microphone button over other apps. It is off by default. To turn it on, you agree on a separate screen in Parolo and turn on the "Parolo button" service yourself in Android's Accessibility settings.

The button is shown by an Android accessibility service. When you tap the button, the service switches your keyboard to Parolo, and the Parolo keyboard starts recording right away, or waits until you hold the mic if "Hold the mic" is chosen in the settings. To finish, tap the mic; recording also stops by itself when the keyboard hides and after 120 seconds. Recording never starts by itself in password, number, phone and date fields. About 1.5 seconds after an inserted phrase, and when the Parolo keyboard hides (for example, when you press Back), Parolo switches back to your keyboard; the "⌨" key does it at any time. If an accessibility button or gesture is set up in Android, pressing it does the same as the Parolo button.

From Android the service receives only:

• whether an input field is focused, and its type, so the button stays away from password, number, phone and date fields;
• the name of the app that owns the field, so the button stays away from banking apps, system screens and apps where you hid it.

The service has no permission to read the screen: Android gives it neither the text on the screen or in fields nor screenshots. The service does not type, does not tap anything for you, sends nothing, and does not use the network. On the device it keeps only your button settings: its position at the screen edge and the apps where you hid it (see "What is stored on the device"). Sound is recorded by the Parolo keyboard as described above. Parolo does not ask for the "Display over other apps" permission.

You can turn the button off in Parolo (Keyboard and microphone), with a long press on the button, or in Android's Accessibility settings.

Purchases and Parolo Pro

Parolo Pro is the paid part of Parolo: no weekly word limit. You can buy it on the "Parolo Pro" screen, as a yearly subscription or "forever".

Payment is handled by Google Play (Google LLC). You enter your card number, name, address and other payment details in Google Play; Parolo never sees or receives them. NEXIOTY ELECTRONICS LIMITED receives sales reports from Google like any seller on Google Play; Parolo has no accounts of its own.

What the app sees on the phone. Through the Google Play Billing Library (Google's library inside Parolo, which talks to the Google Play app on the phone), Parolo asks whether the Google account selected in the Play Store has a Parolo Pro purchase: which product, its state (paid, waiting for payment, on hold), whether the subscription renews, and the purchase token, to acknowledge the purchase with Google Play. It asks when you open the settings or the "Parolo Pro" screen, tap "Restore purchases", and once a day in the background when there is a network connection, including in the free version: a purchase made outside the app (for example, a promo code redeemed in Google Play) has to be acknowledged with Google Play within three days, or Google Play refunds it. Parolo does not store the order number.

What is stored on the phone: your Pro entitlement (the kind of purchase, whether it is acknowledged, when the yearly subscription was bought, so that the app can remind you 30 days before it renews, the date and code of the last Google Play answer) and a checksum of the purchase token; the token itself is not stored. For the free version, the number of words this week and short phrases today; for the Pro trial, its start date and the number of words in the trial week. These are only numbers, with no text. The Pro trial (7 days from the first inserted phrase) is counted only on the phone, with no card and no Google Play.

The country of your Google Play account. The app may ask Google Play for the country of your account, but only in a build where "pay what feels right" for Russia is enabled; it is currently disabled in every build. The answer is used once, in memory, and is never stored, as Google requires.

We have no server of our own: nothing about purchases is sent to our servers.

The Google library's own diagnostics. Like other Google code, the Google Play Billing Library sends Google its own diagnostic events about how the library works (through Google's datatransport component). We have not yet verified exactly what these events contain or how often they are sent; we will check on a device and update this section. They cannot contain sound or text: the library has no access to them. Google processes this data under its own policy: policies.google.com/privacy.

When Pro ends (the trial ends, a subscription is canceled or refunded), only "no limit" turns off; your data and settings stay.

Rating on Google Play. Occasionally, no more than once every 120 days and no more than three times in total, Parolo may show Google Play's rating card on the main settings screen. The app decides this on the phone from its own counters: how many days and phrases you dictated, and how recently there was a failure, the limit or the Pro screen. These are only numbers and dates, with no text, and they never leave the phone. The rating and review, if you leave them, go to Google Play (under its own policy), not to Parolo: the app does not even learn whether you rated it. "Rate Parolo on Google Play" under "About" simply opens Parolo's page in the Play Store.

"Contact the developer" under "About" opens your email app with the address apps@nexioty.com and the subject "Parolo <version>"; the app itself adds nothing and sends nothing. If you write to us, we receive your address and your message and use them only to reply.

Technical log on the device

Parolo writes technical events to the Android system log (logcat). These are recording and recognition timings, error types, the model download state, the names of the apps where the keyboard was opened, field types, field names set by the apps' developers, and a hash of the field hint (not the hint text itself). There is no text or sound in the log. The log stays on the device, and other apps cannot read it. It can be read only from a computer with developer tools over a connection you have authorized, or in a bug report you create yourself.

Speech model download

During setup, Parolo downloads the speech recognition model for the dictation language you choose: GigaAM v3 for Russian (five files, about 325 MB), Parakeet TDT v3 for English and Spanish (about 670 MB), and, if you turn on "Text while you speak" for them, Nemotron 3.5 ASR Streaming (about 682 MB). The same happens when you choose another dictation language or tap "Download again". By default the model is downloaded over Wi-Fi only, unless you allow mobile data.

The files are downloaded over HTTPS from a single server listed in the app under Settings → About. Currently this is parolo.nexioty.com, a delivery network run by Cloudflare, Inc. The files themselves are stored in Hetzner Object Storage (Hetzner Online GmbH, a data center in Helsinki, Finland); Cloudflare fetches them from there, and your device connects only to parolo.nexioty.com.

As with any internet request, this server receives your IP address, the time of the request, the names of the files and a string like "Parolo/0.1.0" (the app name and version). The requests carry no device identifiers, accounts or cookies. The server needs this data to deliver the files. We do not use it to identify you and do not combine it with other data. Cloudflare processes it under its own policy: cloudflare.com/privacypolicy; the policy of Hetzner, where the files are stored: hetzner.com/legal/privacy-policy.

The integrity of the download is checked against checksums built into the app.

Crash reports: only with your consent

The switch is in Settings → Privacy → "Send crash reports". It is off by default.

If you turn it on, after a crash (including an "app isn't responding" freeze), a recognition failure or an unexpected error while downloading the model, Parolo sends a technical report to the Sentry service (Functional Software, Inc.). Reports are stored in Sentry's European Union data region (Germany). A report is sent over HTTPS. Crashes that happened before you turned the switch on are not reported.

What a report contains:

• the error type and where in the code it happened (the call stack of Parolo and its libraries); for a native crash, the signal and the addresses in the libraries;
• the technical error message, after automatic cleaning: file paths, names of other apps, email addresses, long identifiers and non-Latin words are cut out;
• the Parolo version and build type, and which process failed (keyboard or recognition);
• the device manufacturer, model and CPU architecture, the Android version and build, the system language and time zone, the screen size;
• total and free memory and storage, a low-memory flag, and whether there is a network connection and of what type (Wi-Fi or mobile);
• whether the app was on screen, and which Parolo permissions are granted;
• technical events before the crash, with times: which Parolo screens were opened, low-memory signals, network changes.

What a report never contains: sound, recognized or typed text, the contents of input fields, the names of the apps you type in, your list of keyboards, the device name. It contains no identifiers either: no advertising ID, Android ID, IMEI or serial number. The installation ID that Sentry creates itself is removed from the report. Parolo does not send your IP address to Sentry. Sentry's server sees it when you connect, like any server, but the project is set not to store IP addresses.

Reports are kept for no longer than 90 days and are then deleted automatically. They are used only to fix bugs.

How to turn it off. Turn the switch off. From that moment no new reports are created or sent. Reports not sent yet and Sentry's working files are deleted from the device. Only a report that is being transmitted at that very moment may still get through.

What is stored on the device

• the speech models you downloaded (325 to 682 MB each);
• your settings: whether downloads may use mobile data, the keyboard to go back to, whether to warm up the model when the keyboard opens, your consent to crash reports, the interface language (on Android 12 and earlier; on Android 13 and later the system keeps it);
• the settings of the button over apps: whether it is on, when you agreed and to which version of the text, how to start recording, where the button sits on the screen, whether to hide it in banking apps, and the apps where you hid it (their package names);
• while the button has switched you to the Parolo keyboard, a mark saying so: two time values, with no text and no app names;
• dictation counters: words and dictation minutes for the "Your stats" card, and words this week and short phrases today for the free limit; only numbers;
• your Pro entitlement and the Pro trial dates (see "Purchases and Parolo Pro"), with no purchase token and no account country;
• counters for tips and the rating prompt: how many phrases and days you dictated, the days you reached the limit, when tips and the rating card were shown — only numbers and dates (see "Purchases and Parolo Pro"); "Reset stats" does not erase them, uninstalling the app does;
• if crash reports are on, the reports that have not been sent yet.

All of this is kept in the app's private folder, which other apps cannot access. Parolo turns off backup of its data to Google's cloud and transfer to another device.

Permissions

• Microphone, for dictation. Asked the first time you tap the microphone or the "Allow microphone" button during setup. Choose "While using the app": with "Only this time" Android takes the access back after a minute.
• Internet and network state, to download the model and to wait for Wi-Fi; if crash reports are on, to send them; for the Google Play Billing Library, to send its diagnostic events.
• Background work with a notification (a "data sync" foreground service), so that the model download continues when you leave the app.
• Notifications, to show the download progress. Asked when you tap "Download". The download works without it too.
• The list of installed keyboards, so that the "⌨" key takes you back to your keyboard. This list never leaves the device.
• Accessibility service, only if you turned on the button over apps (Android 13 and later); what it receives is described in the section about the button.
• Google Play purchases (com.android.vending.BILLING), added by the Google Play Billing Library to talk to the Google Play app on the phone. You are never asked for it.

Children

Parolo is not directed at children, and it collects no personal data from anyone, apart from the crash reports described above, which must be turned on by hand.

Your rights and deleting data

• You can turn crash reports off at any time (see above).
• The "Delete model" button in the settings deletes the speech model.
• Uninstalling the app, or "Clear data" in the Android settings, deletes the model, the settings and any unsent reports.
• Reports carry no identifiers, so we cannot find the reports of a particular person. If you believe a report contains your personal data, write to us with the approximate time, and we will delete the reports from that period.

Changes to this policy

If Parolo starts to handle data differently, we will update this page and its version number. If crash reports are ever extended to include more data, the app will ask for your consent again.

What changed in version 8: a section on voice messages and audio files you share with Parolo for transcription.

What changed in version 7: the model is downloaded only from parolo.nexioty.com; the backup address of the Hetzner storage has been removed from the app and from the list of servers.

Contact

NEXIOTY ELECTRONICS LIMITED, Hong Kong. Email: apps@nexioty.com.