Privacy Policy

1. What this policy covers

In short: I do not receive conversation content, voice recordings, or API keys through Mr Broccoli. The app requires no Mr Broccoli account, has no central Mr Broccoli backend for AI requests, and contains no advertising or usage analytics. Content stays on your device or is sent by the app directly to services you select.

This policy describes how Mr Broccoli processes personal data when you use the app. It covers the app itself and the data handling under my control as the app operator.

It does not replace the privacy policies of the AI, speech, or web-search providers you connect yourself. When you configure a provider in Mr Broccoli and send requests through it, that provider also processes data under its own privacy policy and terms.

2. Data processed by the app

Mr Broccoli may process the following categories of data, depending on how you use it:

• audio you record when using voice input,
• transcriptions created from that audio,
• prompts, conversation history, and assistant replies,
• provider configuration you choose, such as selected models, voices, and speech modes,
• API keys you enter for third-party providers,
• web-search queries and returned source links, if you enable web search,
• optional local debug logs or exported conversation content, if you intentionally create or share them.

3. How Mr Broccoli stores data on your device

• Conversation content and general app settings are stored locally on your device.
• Provider API keys are stored separately in secure device storage.
• The app and the operating system may create temporary local cache files for speech processing and playback. Recordings are normally deleted after processing; cache files may remain until the app, operating system, or you remove them.
• Diagnostic logs are created only when you intentionally start debug capture. When stopped, the log is written to a local file and copied to your clipboard. It is sent to me only if you choose to share it.

Mr Broccoli does not require a Mr Broccoli user account for core functionality.

4. How data is sent to third-party providers

Mr Broccoli is designed around a bring-your-own-key model. When you configure an AI, speech-to-text, text-to-speech, or web-search provider, the app sends the relevant request directly to the provider you selected, using the API key you supplied.

This may include, depending on the feature you use:

• audio for transcription,
• text prompts and conversation context for AI responses,
• text for speech synthesis,
• search queries and related parameters for web search.

I do not operate a central Mr Broccoli backend that relays these core AI and speech requests on your behalf. The third-party provider you choose receives the data needed to fulfill your request.

5. Local and native speech features

Some speech features may run locally on the device or through native operating-system speech frameworks. Processing may happen on-device or through system or device-maker speech services, including Apple or Google. Whether recognition is entirely on-device depends on the platform, device, language, and system settings.

If you switch to a provider-based speech mode, the selected provider will process the audio or text required for that request.

6. Sharing and disclosure

I do not sell your personal data.

Your data may be disclosed only in the following situations:

• to the third-party providers you explicitly configure and use inside the app,
• if you intentionally share conversation content or support logs yourself,
• if disclosure is required by law or necessary to establish, exercise, or defend legal claims.

7. Analytics and tracking

Mr Broccoli does not use an analytics, advertising, crash-reporting, or product-tracking SDK to profile users across apps or websites.

The App Store, Google Play, the operating system, or third-party providers you use may process data under their own policies. I do not receive usage profiles or conversation analytics through Mr Broccoli.

8. Legal bases under the GDPR

If you are in the EEA, UK, or Switzerland, processing may rely on the following bases:

• Article 6(1)(b) GDPR, where processing is necessary to provide the functionality you request, such as voice input, AI replies, speech output, or provider connectivity.
• Article 6(1)(f) GDPR, where processing is necessary for legitimate interests such as security, debugging, and maintaining reliable operation of the app and this website.

Microphone and speech-recognition permissions are technical operating-system permissions. You can revoke them in system settings at any time; the affected speech functions will then no longer be available.

9. Retention

• Data stored locally in the app remains on your device until you delete it, remove the app, or overwrite it through normal usage. You can delete individual conversation sessions in the app.
• API keys remain in secure device storage until you remove or replace them.
• Temporary speech files and local logs may remain in device storage until removed by the app, the operating system, or by you.
• Third-party providers may keep request data according to their own retention rules.

10. International transfers

The third-party providers you configure may process data in countries outside your own, including outside the European Economic Area. Before using a provider, you should review that provider’s privacy policy, security documentation, and regional processing terms.

The processing region and safeguards under Chapter V GDPR depend on the provider you select, your account with that provider, and its contractual terms. Mr Broccoli does not set a central processing region for these direct provider requests.

11. Your rights

Depending on the law that applies to you, you may have rights of access, rectification, erasure, restriction, objection, and data portability, and the right to lodge a complaint with a supervisory authority.

Because Mr Broccoli stores much of its operational data locally on your device and routes provider requests directly to the provider you choose, many deletion and access actions can be performed directly in the app, on your device, or with the relevant third-party provider.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority at the controller’s location is the Berlin Commissioner for Data Protection and Freedom of Information.

12. Required data and automated decisions

Providing conversation content, audio, and API keys is not a statutory or general contractual requirement. Without the data needed for a selected feature, that speech, AI, or search function cannot operate.

Mr Broccoli does not make solely automated decisions that produce legal or similarly significant effects under Article 22 GDPR. AI output is content requested by the user.

13. Accessing this privacy page

When you access this website, the web-hosting provider processes technically necessary connection data, including the IP address, time, requested URL, browser or device data, and possibly the referring page. This is necessary to deliver, secure, and keep the website stable under Article 6(1)(f) GDPR. Logs are deleted when no longer needed for those purposes or related security evidence.

This page uses no analytics or advertising cookies and loads no external trackers.

14. Contact

For privacy-related questions about Mr Broccoli, please contact contact@tobiaswinkler.berlin.

If you contact me, I process your message and contact details to handle the request under Article 6(1)(b) or (f) GDPR. I delete them when the request is complete unless a legal retention duty applies.