Which Dictation Apps Keep Your Voice Data Private? 8 Questions to Ask Before You Choose
By Dictāta TeamTable of Contents
6
Table of Contents
6"Private" on a dictation app's homepage can mean four different things. Some promises are about where your voice is processed, some about how long it is kept, some about whether it trains a model. They are not interchangeable, and an app can make one of them while breaking another.
This guide explains the four, lists the questions that separate a real answer from marketing, and shows how to check a claim yourself. At the end we answer the same questions for Dictāta, including where our own limits are.
Four promises that sound alike
| Promise | What it guarantees | What it does not guarantee |
|---|---|---|
| On-device processing | Speech recognition runs on your computer or phone, so the audio does not have to leave it | That the text is not saved elsewhere afterwards, and that the app makes no other network requests |
| Zero data retention | The vendor and its providers do not keep audio or transcripts after processing | That your audio never reaches a server. It still goes there to be processed |
| No training on your data | Your audio or text is not used to improve a model | That it is not stored for some other reason, for example logs or support |
| Regional processing (e.g. EU) | Processing happens in a stated region | That nothing is kept, or that every part of the account (billing, analytics) stays in that region |
Only the first one removes the question of a server altogether. The others are policies about what a server does with your data, and you rely on the vendor and its subprocessors to follow them.
8 questions to ask any dictation vendor
- Where is the audio processed? On the device, or on whose servers, in which region?
- Which subprocessors are involved? Most cloud dictation sends audio to a speech provider and often to a language model for cleanup. Each one has its own retention rules. A good vendor lists them.
- How long is audio kept? "Not stored" and "deleted after 30 days" are different answers. Ask for the default setting, not the best case.
- Are transcripts kept? Audio and text can be treated differently. Some apps discard audio but keep text in a history.
- Is training excluded by default, or only if you switch it off? And is that a contract term or a setting?
- What else leaves the device? Analytics, crash reports and usage counts are separate from the content of your dictation.
- How do you delete your data? Look for a deletion path for history and a separate way to delete the account.
- For a team: what does the contract say? A data processing agreement, the list of subprocessors, and admin controls matter more than the homepage. If SSO or audit logs are requirements, ask for the current status instead of assuming it.
How to check a claim yourself
- Read the data page, not the slogan. Look for a data controls, security or privacy page that names retention periods and subprocessors. Example of how one vendor publishes this: Wispr Flow's Privacy Mode documentation.
- Test an "offline" claim. Turn off Wi-Fi, then dictate. If it still works, recognition is local. If it asks for a connection, it is not.
- Remember what happens to the text. Text dictated locally can still end up in a synced notes app, an email account, a backup or a clipboard manager. That is outside any dictation app's control.
- Treat "compliant" as a claim, not a fact. Whether a tool meets your legal or professional obligations is a decision for you or your compliance team, not something a vendor can certify for you.
How Dictāta answers these questions
These are the documented behaviours, and where they stop.
- Cloud mode, EU routing. With EU routing selected, audio is transcribed through the EU endpoint of the speech-to-text provider and text is processed in Frankfurt (europe-west3). Details are on the GDPR page.
- Storage. Dictāta does not store raw dictation audio or full transcript text in its database, and your voice is not used to train AI models. Dictation history is kept on your device.
- Limits. Account, usage and billing data held by service providers is not covered by regional processing. In Cloud mode the audio does leave your device to be transcribed.
- Local mode. Speech recognition runs on your computer with NVIDIA Nemotron 3.5 Streaming. While Local is on, audio and dictated text are not sent anywhere, and the app only allows sign-in, billing pages, model downloads, the version check and feedback you send. Sign-in and the subscription check still need a connection. See Dictāta Local.
- Not answered here. Questions such as SSO or admin controls for large teams are not covered by this article. Check the security page for the current state instead of assuming.
Summary
Ask what a promise does and does not cover. On-device processing removes the server question; retention, training and region promises tell you what a server is allowed to do. Check the vendor's data page, test "offline" claims by going offline, and decide for yourself whether the answers meet your obligations.