Privacy by design
What runs where
This page is for the sceptical reader. It describes what the app's code does today, including what is not finished. If something here changes, we update this page before the app update ships.
On the device
| Part | How | Status |
|---|---|---|
| Recording | Audio from the microphone is streamed to the speech pipeline in memory. So that a failed processing step never loses the meeting, the speech is also written to the app's private storage as an encrypted file (AES-256-GCM, key derived from the database key). It is deleted as soon as the final transcript and speaker separation succeed; if they fail, it stays encrypted so you can retry. | works today |
| Transcription | Live captions: NVIDIA Nemotron 3.5 ASR streaming 0.6B, which writes while people speak (the standard models, the default on phones with 6 GB of RAM or more); with the compact models, OpenAI Whisper Small, which writes each stretch of speech after a short pause with Silero speech detection. Both run with sherpa-onnx. After the meeting the speech is transcribed again with NVIDIA Parakeet TDT 0.6B v3, which also gives the time of every word; with "More accurate final transcript" switched on, Whisper Large v3 Turbo does this instead (about 1 GB extra) | works today |
| Speaker separation | On-device diarization after the meeting: sherpa-onnx (pyannote segmentation 3.0 + WeSpeaker ResNet34). If you say how many people took part, that number is used | works today |
| Summary and action items | A local language model through llama.cpp: Qwen2.5 1.5B Instruct or Gemma 4 E2B, both 4-bit quantised | works today |
Storage
- Transcripts, summaries, tags and settings live in one SQLite database encrypted with SQLCipher.
- The key is a random 256-bit value generated on the phone and stored with Android's secure storage, which is protected by the Android Keystore. It never leaves the device.
android:allowBackup="false": Android's own backup does not copy the app's data to the cloud.- No account, so there is nothing to sync and no copy elsewhere. Uninstalling the app deletes everything.
On screen
- On the recording and transcript screens the app sets Android's
FLAG_SECURE: no screenshots, no screen recording, and a blank tile in the app switcher. Other screens, such as the home screen, do not have this. - Transcript text you copy is cleared from the clipboard after 60 seconds.
Every network connection
The app has internet permission for these reasons only. Cleartext (non-HTTPS) traffic is blocked.
| Where | What and when | What is sent |
|---|---|---|
huggingface.co and the Hugging Face download servers it redirects to | Downloading the speech and language models, once, when you set the app up. Compact set about 2.2 GB, standard set about 4.4 GB | A normal HTTPS download request. No notes or audio |
| Google Play and RevenueCat | Checking your subscription status, when the app starts and when you buy or restore | An anonymous ID generated by RevenueCat, the app version and platform, and purchase receipts from Google Play |
vaultnotes.nl | Only when you tap the link to the terms or privacy policy on the subscription screen; it opens in your browser | A normal page request from your browser |
There is no analytics, no crash reporting and no advertising SDK in the app.
What we do not claim (yet)
- The app's privacy dashboard counts what the app itself sends per domain, but only for the model downloads (the requests, including each redirect to a download server, not the download itself). Google Play and RevenueCat run in their own libraries and are not counted, and the dashboard says so. So we do not present the counter as proof that nothing at all goes out.
- Each meeting has a privacy receipt: whether the phone had a connection during the recording, how the meeting is stored, what happened to the audio and which models ran. A recording made fully offline is labelled "Recorded in airplane mode". That is the easiest check: turn on airplane mode and record.
- The app's home screen says your data never leaves your device. That is true for audio, transcripts and summaries; the model download and the subscription check above do use the network.
- Vault Notes is Android only (Android 11 or newer).
Questions about any of this? See support. The formal text is in the privacy policy.
Last updated: 14 October 2026