Privacy architecture

Audio

• Captured only while your hotkey is held, at 16 kHz mono, into memory.
• Never written to disk — there is no audio file to find, recover, or leak.
• Discarded as soon as text exists.
• Never transmitted. There is no setting that causes audio to leave your Mac, because no code path exists to send it.

What is written to disk

Everything lives under your own user account, in ~/Library/Application Support/OpenVoiceFlow/:

File	Contents
settings.json	Your preferences. No secrets.
dictionary.json	Your personal dictionary.
snippets.json	Your snippets.
styles.json	Your per-app style map.
profile.json	Your Know-Me profile.
History and stats files	Recent transcripts (most recent 500), word counts, per-app and per-day totals, and your first-ever transcript.

Speech models are cached separately at ~/Documents/huggingface/models/argmaxinc/whisperkit-coreml/. API keys are in the macOS Keychain, service app.openvoiceflow.apikeys — never in any file above.

Every outbound connection

The app makes exactly four kinds of network request, and you can reason about all of them:

Request	When	Contains
Model download	The first time you select a given Whisper model	Nothing about you — it is a public model file fetch.
Update check	Daily, and at launch, if automatic updates are on	A request for the signed appcast at openvoiceflow.com. No account, no identifier.
Cleanup request	Per dictation, only if you enabled a cloud backend	Transcript text, cleanup instruction, style, and your dictionary/profile context. Never audio.
Usage sync	Roughly every few minutes of active dictation, only if “Share anonymous usage & leaderboard rank” is on (Settings ▸ Privacy — on by default since 0.5.7)	See Analytics & leaderboard below. Never audio, never dictated text.

Set cleanup to None (the default) or Ollama, and the cleanup row never happens. Turn off automatic updates and the update-check row stops too. Turn off usage sharing and the fourth row stops immediately — nothing queues up and sends later.

Analytics & leaderboard

Since 0.5.7, the app can share an anonymous usage summary to power an in-app leaderboard ranked by time back (typing time avoided, not a net saving — see the dashboard manual). This is a real change from earlier versions, which sent nothing — it's on by default, and this section says exactly what that means.

Turning it off: Settings ▸ Privacy ▸ “Share anonymous usage & leaderboard rank”. Off stops every request in the row above; nothing is cached to send later. The screen and feature counters keep counting locally — that is how Home shows your own totals — they simply stop leaving your Mac. “Delete my leaderboard data” clears the local counters too, so nothing you deleted can be re-uploaded by the next sync.

What's sent, when it's on:

• A random device ID generated for this installation (not tied to your Apple ID, email, or any account — there is no account) and a display name you can change, shown to other users on the leaderboard. Installations remain separate even when they use the same nickname, so three computers produce three independent rows.
• Aggregate counters already shown on your Home pane: total words dictated, total time back, your streak, and which features are on (cleanup enabled, snippet/dictionary counts, whether you've run Know-Me) — counts only, never contents.
• Which parts of the app you use (since 0.5.22). A running count per screen (Home, History, Personalize and its tabs, Settings, Leaderboard) and per feature you press (finished a dictation, added a dictionary word or a snippet, started the Know-Me interview, changed the cleanup backend, checked for updates, opened Feedback, and similar). Each one is a fixed name and a number — pane.history, 12 — with no timestamps and no ordering, so it can show that a feature gets used and never when you used it or what you did around it. The list of names is compiled into the app and the server discards anything not already on its matching list, which is what keeps text you type or dictate out of it entirely.
• Your country, derived server-side from the request at the moment it arrives. Your IP address itself is never logged or stored.

Aggregate totals sync periodically during active dictation. Opening Leaderboard sends the same aggregate snapshot before fetching standings, so saved local totals can restore that installation's row. Changing a nickname also sends the snapshot once when you press Return or leave the field; individual keystrokes are not uploaded.

What's never sent, whether or not this is on: dictated text, snippets, dictionary entries, Know-Me profile content, or anything from the cleanup path. Those stay exactly as described in the rest of this page.

The leaderboard itself never discloses how many people use OpenVoiceFlow in total — only ranks and time-saved figures for the people shown. Two things keep it that way: the API names only the leaders past a usage bar and caps how many rows it will return, and the app draws a fixed number of rows whatever comes back, masking the ones it has no name for. So neither the response nor the height of the board is a headcount. Masked rows stand for withheld names; they are never invented people.

What is never collected

• No dictation content, ever. Not your words, not your audio — the usage summary above is aggregate counts only.
• No account. Nothing to sign up for. The device ID above identifies one app installation, not a person; installations are never merged by nickname.
• No precise location. Country-level only, derived at request time; no IP address is stored.
• No screen reading. Accessibility permission is used only to send a paste keystroke.
• No keystroke logging. Input Monitoring watches for one key; everything else passes straight through.

Verifying this yourself

Two checks anyone can run:

• Airplane mode. Turn off Wi-Fi with cleanup set to None and dictate. It works, because dictation itself never needs a network — the usage sync above is fire-and-forget and never blocks it.
• Network monitor. Run Little Snitch or similar and watch. With cleanup off and usage sharing off, dictation generates no connections at all. With usage sharing on (the default), you'll see the occasional request described in the table above, and nothing else.

OpenVoiceFlow's source is public, so every claim here is checkable in the code itself rather than taken on trust. If anything on this page does not match what the app does, that is a bug — tell us at contact@openvoiceflow.com.