Privacy

What stays on your Mac, and what does not.

Most privacy policies describe a database you cannot see. This one describes ours, and every claim on it names something our schema either stores or is built so that it cannot store. The one exception is crash reporting, which is off unless you turn it on and is described in its own section below.

Your voice never leaves your Mac

Speech becomes text on the machine in front of you, and no recording is uploaded. The audio is deleted the moment it becomes text, and kept on this Mac for a day only if it couldn’t be, so you can retry. There is no server-side transcription to opt out of, because there is no server in that path at all — which is also why dictation keeps working with the network off, once you have signed in the first time.

This is the absolute claim, and it is only about audio. The two sections below say exactly what does reach us, so that this one can be read literally.

What never leaves your Mac

Your clipboard history, your dictation history and your custom dictionary are kept by the app in its own local storage. They are not synced, not backed up by us, and have no column anywhere in our database. Deleting the app deletes them.

What we hold in your account

Signing in is asked for once, on first run. From then on the account carries your dictionary and your subscription between Macs — never your recordings. We store the following and nothing beyond it:

• Who you are — your display name, your email address, and the stable identifier your sign-in provider uses for you. We keep the provider’s identifier rather than treating your email as your identity, because people change email addresses.
• Your picture, as an address — where your provider keeps it, never a copy of the image. The app asks us for it and we fetch it, so that loading your avatar does not tell your provider each time you open your Mac.
• Your devices — a name you can change, the platform, the app version, and a random identifier the app generates for that installation. Deliberately not a hardware serial or a vendor ID: those survive an uninstall and are the same value for every app on the machine. Ours is one you destroy by deleting the app.
• Your plan — which plan you are on, whether it is active, and when the current period ends.
• Your sessions — when each was issued, when it expires, and whether it has been revoked, so that signing out somewhere actually ends something.

What the app reports, and what it cannot

The app sends a usage report about once an hour so we can tell whether it is working. It is on by default, and you can turn it off in the app’s Settings; turning it off stops the counting and discards anything not yet sent. A report is counts and durations over a window, never events:

• how many dictations happened, how many were cancelled, and how many failed;
• how long the microphone was open in total, and how long processing took in total;
• the number of characters inserted — a count, not the characters;
• how long you waited for text to appear, as median and tail latencies;
• which languages were dictated in, as counts per language tag;
• which step failed when a dictation failed — recording, transcription, tidying, typing — as counts;
• the app version and your macOS major version, each stored as numbers.

The report describes a period rather than a moment, so nothing in it can place a particular sentence at a particular time. The version is three integers rather than a string for a specific reason: a text column is somewhere a transcript could later end up, and a column that cannot hold prose cannot leak it by accident.

Crash reports, only if you turn them on

Crash reporting in the Mac app is off by default. It is on only if you switch it on, in Settings → Privacy → Send crash reports. While it is off, the crash reporter is not started, so nothing is collected or sent.

When it is on, reports of crashes and app hangs are sent to Sentry, a third-party error-tracking service, in its US region. Sentry processes them on our behalf, and this is the one thing the app sends to anybody other than us. A report contains:

• the app version and build;
• your macOS version;
• your Mac’s model and architecture;
• stack traces, with every file path reduced to the file name.

A report never contains audio or your voice, transcripts, your clipboard, your dictation history, your dictionary, your snippets, window titles, the names of other apps, your user name, your Mac’s host name, or who you are in your account. Storing IP addresses is turned off in our Sentry project. Turning the setting off stops sending immediately.

What we use to test the app is ours

We measure transcription quality before each release against an evaluation corpus of audio we recorded or licensed for that purpose, with transcripts we wrote ourselves. No sample in it comes from anybody’s machine. Your dictation is never training data and never test data.

This website

There is no analytics script, no advertising pixel and no third-party embed on this site. The download button counts downloads through our own server before handing you the file: it records the day, the country your address is in, your browser and operating system as broad families, the site that linked you here (its name only, never the page) and any campaign tag in the link. Your address itself is not stored. To tell the site you came from after you have clicked around, the page keeps that site’s name in your browser’s session storage until you close the tab. The typeface is served from here rather than from a font CDN, so that visiting a page about privacy does not hand your address to somebody else. If you sign in, the site keeps one cookie: your session, sealed and readable only by the server, so that no token is ever exposed to the page.

Your choices

• Sign out. Signing out revokes the session on our side, not just in the app, so the token stops working rather than merely being forgotten locally.
• Remove a Mac from your account. Each device you have signed in on can be removed. Its name, its installation identifier and its last-seen record go with it.
• Delete your account. On your account page. Your name, your email address and your picture are erased, every Mac is signed out and removed, and your sign-in with Google is disconnected — so signing in again afterwards creates a new account rather than reopening this one. What remains is an anonymous count of how often the app was used, with nothing in it that names you, and the records of any payments, which we are required to keep. It cannot be undone.
• Delete the app. Everything it kept locally — your clipboard history, your dictation history and your dictionary — is deleted with it, and the random installation identifier stops existing. None of that was ever on our servers to begin with.
• Dictate with no network. After the first sign-in the app needs no connection, so you can confirm for yourself that nothing is being sent: turn the Wi-Fi off and keep dictating.
• Crash reports. Off unless you turn them on in Settings → Privacy, and switching them off stops sending immediately.

Changes

If what we collect changes, this page changes in the same release, because the claims on it are checked against the schema rather than written separately from it.