Local where it can be.
Explicit where it leaves.

01 / THE PUBLIC SITE

A product page and an illustrative sample.

The page fetches public offer configuration to decide whether checkout and download are available. It does not use analytics trackers or collect signup details. Cloudflare hosting and security operations may process operational request metadata, such as network/request information needed to deliver and protect the service.

The Buy button takes you to Whop to review the price and complete your purchase. Whop handles its checkout interface and associated data. External links open only when you choose them. The sample’s Focus, Mute, and behavior controls change sample text and appearance; they never start capture.

02 / BILLING AND SOFTWARE ACCESS

Whop handles payment. Licensing checks access.

Whop handles card/payment and billing information. OnAir IQ’s server does not receive or store your card details. Review Whop’s own privacy information when using its checkout or member account.

When you activate, the desktop sends the entered license key to the OnAir IQ Cloudflare licensing service, which passes it to Whop for validation. The licensing service does not retain that key. The desktop installation token is protected using Windows account encryption; the server retains a hash of that token rather than the plain token.

Licensing records can include membership ID, paid-access status, installation/device hash, signed-access-receipt metadata, processed webhook IDs, and pseudonymous rate-limit records. These support access checks, the one-installation limit, renewal/revocation, replay protection, and service protection.

Your AI API key, microphone audio, transcripts, Twitch chat, and local History notes are not sent to the licensing server. A signed offline lease is limited to up to 24 hours and capped by the paid term; it does not provide offline AI processing.

03 / THE WINDOWS WORKSPACE

Your topics and notes stay on your PC.

Topics, preferences, research caches, estimated usage metadata, and optional session outlines/notes are stored locally. History retention starts off. The app does not automatically save raw audio or full transcripts. Freeform notes contain the text you deliberately enter; they are not automatically checked for pasted secrets or semantically redacted.

Personal API keys and installation tokens use protected Windows-account storage. A separately selected session-only API key stays in memory and clears on Quit or profile change. Local profiles organize workspaces but are not separate Windows users. Readable local notes, caches, exports, and recovery files should be treated as private content.

Voice preferences are local and Windows-specific. Installed Microsoft Desktop speech reads only the eligible current cue question after session approval. No speech API call, voice bundle, or cloud-voice fallback is used. Resume retains the existing session approval and mute setting; new Start asks again.

04 / ONLY AFTER APPROVAL

Selected content goes to OpenAI.

After an approved listening Start, selected speech segments go to OpenAI for transcription using your personal API key. Bounded transcript context and saved interests can then be used for follow-up cues. If you separately approve selected saved continuity, only the displayed saved title, notes, and unfinished-thread excerpt is included. Other History records and unsaved edits are not included automatically.

Approved research sends only the selected topic name for a cited brief; it does not send microphone audio, transcripts, other topics, or the exclusion list as part of that research request. Cached summaries are stored locally and can contain errors or become stale.

Literal phrase exclusions are checked after transcription. They are not a semantic privacy filter and cannot prevent matching speech from reaching transcription. Pause or Stop before sensitive conversation. OpenAI’s API retention and provider policies apply to content you approve for processing, and provider usage is billed separately.

05 / A SEPARATE AUTHORIZATION SERVICE

Read-only chat and bounded encrypted grants.

Optional branded Twitch sign-in uses a separate OnAir IQ Cloudflare authorization broker. It exchanges authorization codes and refreshes credentials. Actual Twitch refresh credentials stay encrypted on that service; the desktop receives an access token and an opaque connection handle, protected locally or held in memory according to your selected storage choice.

Server authorization grants have a fixed maximum of 30 days. A reconnect or refresh does not extend that cap. Chat is displayed separately in temporary desktop memory, bounded to recent messages. It never goes to AI, speech, research, History, profile exports, or the licensing server.

Forget authorization removes local credentials and requests server grant deletion/revocation. If the service cannot be reached, remote revocation cannot be guaranteed at that moment; fixed grant expiry remains a fallback. Disconnect retains local authorization for another explicit reconnect. Session-only desktop storage does not automatically revoke the separate server grant.

06 / LIMITS AND CLEANUP

Retention depends on the data’s role.

Application deletion does not erase copies you exported, copied, or retained in other backups. Platform recovery copies can outlast active records; cleanup is not an immediate physical-erasure guarantee.

07 / A DIRECT REQUEST ROUTE

Contact the seller through Whop.

For access, correction, or deletion questions, use Whop’s Contact Seller route from your membership or the OnAir IQ Whop hub. Include the relevant order/membership reference and the kind of request. Do not include private keys, tokens, audio, or History notes.

The legal seller is identified in Whop checkout. Your mandatory privacy and consumer rights remain in effect.