Privacy by design
What runs where
This page is for the sceptical reader. It describes what the app's code does today, including the parts that are not finished. If something here changes, we update this page before the app update ships.
On the device
| Part | How | Status |
|---|---|---|
| Recording | Audio from the microphone is streamed to the speech pipeline in memory. It is not saved as an audio file. | works today |
| Transcription | OpenAI Whisper as an ONNX model, run with sherpa-onnx, with Silero speech detection. Whisper Small on phones with less than 6 GB of RAM, Whisper Large v3 Turbo on others | in development |
| Speaker separation | On-device diarization (sherpa-onnx, or Picovoice Falcon if you choose it) | in development |
| Summary and action items | A local language model through llama.cpp: Qwen2.5 1.5B Instruct or Llama 3.2 3B Instruct, both 4-bit quantised | in development |
Storage
- Transcripts, summaries, tags and settings live in one SQLite database encrypted with SQLCipher.
- The key is a random 256-bit value generated on the phone and stored with Android's secure storage, which is protected by the Android Keystore. It never leaves the device.
android:allowBackup="false": Android's own backup does not copy the app's data to the cloud.- No account, so there is nothing to sync and no copy elsewhere. Uninstalling the app deletes everything.
On screen
- On the recording and transcript screens the app sets Android's
FLAG_SECURE: no screenshots, no screen recording, and a blank tile in the app switcher. Other screens, such as the home screen, do not have this. - Transcript text you copy is cleared from the clipboard after 60 seconds.
Every network connection
The app has internet permission for these reasons only. Cleartext (non-HTTPS) traffic is blocked.
| Where | What and when | What is sent |
|---|---|---|
huggingface.co | Downloading the speech and language models, once, when you set the app up. Compact set about 1.1 GB, standard set about 2.8 GB | A normal HTTPS download request. No notes or audio |
| RevenueCat | Checking your subscription status, when the app starts and when you buy or restore | An anonymous ID generated by RevenueCat, the app version and platform, and purchase receipts from Google Play |
| Picovoice | Only if you choose Picovoice Falcon for speaker separation (not active in the current build): a one-time online licence check | A hash of the access key, the app version and platform |
There is no analytics, no crash reporting and no advertising SDK in the app.
What we do not claim (yet)
- The app has a Privacy Dashboard with a "bytes sent" counter. That counter is not connected yet and always shows zero, so we do not use it as proof.
- The app's home screen says your data never leaves your device. That is true for audio, transcripts and summaries; the model download and the subscription check above do use the network.
- On iPhone, the screenshot protection and the on-device speech pipeline are not ready; the beta is Android only.
Questions about any of this? See support. The formal text is in the privacy policy.
Last updated: 14 October 2026