Dictation app privacy: what ten vendors actually publish

Ten dictation products were read on 2026-08-29 against their own privacy policies, data processing agreements, support docs, and trust centres. One of the ten, Otter.ai, publishes a complete, dated, public subprocessor list. Two products carry a “never leaves your device” claim on one page that the same vendor’s own documentation on another page does not support.

Nothing below is inferred. Every cell is a quote from a document the vendor publishes, or a statement that a document does not address the question. Where a page returned 404 or named nothing, that is recorded as an absence and nothing further is read into it. Voice Type is the last row and is held to the same standard, including where the answer is unflattering.

The page is refreshed quarterly. Policies change, and a claim about a vendor is only as good as the date beside it.

The table

Every cell read on 2026-08-29 from the linked sources. Vendor names link to the detail below. Retention, training, and human review are reported as the vendor writes them, including where the vendor writes nothing.

The two contradicted local-only claims

Both products below run recognition locally by default, and both are good software. The problem is not the default. It is that the marketing sentence describes the default as though it were the whole capability, while the same vendor documents a cloud path elsewhere.

Superwhisper is a near miss worth naming separately. Its privacy policy is dated June 19, 2024 and states the product is "designed to process audio data locally on your device", while the current docs describe optional cloud voice models and a Superwhisper-hosted cloud tier. The docs are the more current description, and unlike the two above they are explicit about the cloud path, per mode, on the same site.

Vendor by vendor

Voice Type, same columns

Voice Type has three subprocessors. Apple handles App Store distribution, payment, receipts, and the iCloud mailbox behind [email protected]. Cloudflare handles website hosting, DNS, the files.carelesswhisper.app host, and email forwarding. PostHog handles website analytics on us.i.posthog.com, which is PostHog’s United States cloud. None of the three receives dictation, because none of them sits in the dictation path.

The app makes one call to a host we own. Every six hours it issues a plain GET to files.carelesswhisper.app/review-gate.json, a static file with three fields: an approved build number, a timestamp, and a schema version. No body, no identifier, no custom header beyond Accept. Run curl -s https://files.carelesswhisper.app/review-gate.json and you see everything that call can return.

The app bundles no analytics or crash SDK. Its dependency manifest pins exactly two packages, sindresorhus/Defaults and swiftlang/swift-syntax. No PostHog, Sentry, Mixpanel, Amplitude, or Firebase ships inside Voice Type.

The unflattering entries belong here too. Voice Type holds no SOC 2 report and no ISO 27001 certificate, and offers no HIPAA BAA. The website analytics sit on PostHog’s US cloud rather than its EU cloud. Neither fact is hidden behind a stronger sentence elsewhere on the site.

The one case where text leaves your Mac

Recognition never needs the network. One feature can use it: LLM rewrite, which takes text that has already been transcribed and asks a language model to clean it up. It ships off. The default is set in the app source at WhisperState.swift:1835, where llmRewriteEnabled is declared false. Auto-rewrite is a separate switch, also false, at WhisperState.swift:2370.

The default is the easy part to publish. The capability is the part that matters, so here is the full list. The provider enum at LLMProvider.swift:212-232 names every destination the feature can reach. Three of them keep the rewrite on the machine:

• Apple On-Device, which uses Apple Intelligence on macOS 26 and needs no key.
• Ollama, which runs the model on the same Mac.
• A user script, which runs a local executable you install yourself.

The rest are remote, and every one of them is bring-your-own-key. You supply the credential, you pay the provider, and the request goes from your Mac to that provider’s endpoint. There is no Voice Type server in the middle, because there is no Voice Type server. The remote options are Alibaba Cloud, Amazon Bedrock, Anthropic Claude, Azure OpenAI, Cerebras, Cohere, DeepSeek, Google Gemini, Groq, Mistral, OpenAI, OpenAI via a Codex OAuth sign-in to your own ChatGPT account, OpenRouter, Perplexity, Together AI, and XAI, plus a custom OpenAI-compatible endpoint you supply.

None of those providers is a Voice Type subprocessor. A subprocessor is a party we engage to process data on our behalf, and we engage none of them. They appear here because a reader deciding whether this app is private needs the list of places text can go, not just the switch position we happen to ship.

How to check this yourself

None of this required special access. It is six habits, applied to documents any vendor publishes.

1. Open the marketing page and the security or privacy documentation side by side. Marketing describes the default. Documentation describes the capability. Where a product has an optional cloud path, the two pages are written by different people for different readers, and the gap between them is the finding.
2. Ask for the subprocessor list by name. Try /subprocessors, then the trust centre, then the DPA. A vendor that processes speech in the cloud and names no processor has not told you who holds the audio.
3. Read the date on the privacy policy. A policy from 2024 attached to a product that shipped cloud features in 2026 describes an older product.
4. Separate "we do not train on your data" from "our vendors do not train on your data". Both sentences can appear on the same site and mean different things about different parties.
5. Check whether a certification claim names an auditor, a scope, a type, and a date. SOC 2 Type I and SOC 2 Type II are different reports, and "compliant" is not the same word as "audited".
6. Turn off Wi-Fi and dictate. An app that keeps working offline is doing the recognition locally, whatever any page says.

Run those six against Voice Type as well. The trust page lists the three subprocessors, the app keeps working with Wi-Fi off, the certification row says none, and the rewrite provider list above is longer than the one sentence about the default.

Method and limits

• Sources are the vendors’ own live pages, read on 2026-08-29. No third-party review sites, no summaries of policies, no archived snapshots.
• A missing document is recorded as a missing document. "No published subprocessor list" means the pages named above did not contain one on that date, and nothing more.
• Silence is not evidence. Where a policy does not address training or human review, the cell says so rather than guessing the answer in either direction.
• Claims that exist only in secondary sources were left out. That includes a widely repeated 90-day free-plan audio retention figure for Notta, which no Notta document confirms.
• Voice Type facts come from the shipping Swift source and the site source, with file and line references given above.