Skip to content
← All articles

What a Privacy Policy Actually Promises About Your Voice

Real policies, read properly, on what happens to your words after you say them.

By Nelson, maker of Aurator

A dictation app hears more of your day than almost any other piece of software you own. So I read the actual privacy policies behind the voice apps people actually use, past the headline claim at the top, to the part that says what really happens to the audio.

What I found is that "on device" is often a claim about one step in a pipeline, not the whole pipeline. So here is what I found, in the policies' own words.

"On device" is a claim about one step, not the whole trip

A dictation has at least two steps. First, your voice becomes text. Second, that text gets cleaned up, formatted, or turned into something else. A privacy policy can be completely honest about step one and say nothing about step two.

Superwhisper's own policy is genuinely strong on this point, and I want to say so plainly. It states, in its own words, that it does not collect any audio recordings, transcriptions, or personally identifiable information, and that processing happens locally on your device. That is a real, verifiable claim, not a marketing line, and it deserves credit.

One pipeline, at least two steps

The checkbox that decides whether your voice trains a model

Wispr Flow's privacy settings are different, and their own words are worth reading closely. Their policy states plainly, transcription always happens in the cloud. And separately, it gives you a choice, in their own words, you decide whether data can be used to train or improve our models, through a setting called Improve the model for everyone.

I am not going to tell you what that toggle defaults to, because the policy I read did not say, and I will not guess at a fact like that. But the existence of the toggle tells you something on its own. For a choice to exist, a pathway has to exist first. Your dictation reaches a place where it could become training data for somebody else's model, and a setting decides whether it does.

A real checkbox, read closely

Why Aurator's cloud path runs through your own account, not Aurator's

By default, Aurator's speech to text, cleanup and coaching all run on your Mac, with Apple's on-device models where a model is needed, the ones I went through line by line in an earlier article. No account is required to use any of that.

If you turn on Cloud, you give Aurator your own Deepgram key for faster transcription, or your own Anthropic key for the rewrite styles, voice editing, Write for me and building your voice guide. Aurator's own privacy page states it plainly, Deepgram and Anthropic handle what they receive under the terms of your own account with them. Not Aurator's account. Yours.

That is a structural difference, not a promise. A promise is a sentence in a policy that a company can change. A structure is what the software actually does. Aurator is not a reseller sitting between you and a cloud model, holding your dictations in its own account so it can decide what to do with them later. When you choose Cloud, your words go straight from your Mac to an account that only you control, and Aurator's own page says, in its own words, none of it is ever sent to us.

Whose account actually holds it

What I would actually check in a privacy policy

Read past the first sentence. Ask these four things of any voice app, mine included.

Does the on device claim cover the whole pipeline, or only the transcription step. Is there a toggle for using your data to train a model, and if there is, find out what it defaults to before you trust the default. When the app does use the cloud, whose account is the data actually sitting in, a shared company account or one that belongs only to you. And does the company ever see the words at all, or only the provider you chose yourself.

If you want to see what the second kind of architecture looks like in a real app, Aurator is at tryaurator.app. Seven days free, every feature included, and your Cloud keys, if you ever add them, stay yours.

And if you have read a privacy policy that answers these four questions more honestly than the ones here, I would really like to read it too.

Sources, all checked on 3 October 2026