Where your voice data goes, and doesn’t.

1. Recording

When you press the hotkey, DictateSI begins capturing audio from your microphone via AVAudioEngine. Audio frames are held in process memory only. They are not written to disk and not transmitted anywhere.

2. Transcription (always local)

When you stop recording, DictateSI passes the in-memory audio buffer to whisper.cpp, an open-source on-device speech-recognition engine bundled with the app. The Whisper inference runs entirely on your Mac’s CPU and Apple Silicon GPU. There is no network connection involved in this step.

3. AI cleanup (on-device by default)

Polishing raw dictation into clean writing runs on your Mac by default: a small open-licensed model (Qwen2.5, Apache-2.0, ~1.1 GB, downloaded once) runs in-process via embedded llama.cpp. No network connection, no API key, works offline. An automated test fails the build if any networking code ever enters this path.

Three optional alternatives exist if you choose them in Settings: Ollama (a daemon on your own machine; text stays on the device), Anthropic with your own key (the transcript text + a short prompt + the model ID go to api.anthropic.com), or an OpenAI-compatible endpoint: OpenAI, Azure OpenAI, Gemini, Groq, Mistral, OpenRouter, or a gateway your IT team runs. The endpoint receives the same three things at the URL you entered. If that URL is this machine (localhost), the text never leaves it and the audit log records it as on-device; any other host, including a server on your own network, is recorded as off-device. Audio is never sent under any backend.

If cleanup fails, DictateSI falls back to the raw transcript, and a failure on a local backend never silently escalates to the cloud. Only the backend you selected is ever used.

4. Paste or type-out

The final text (raw or cleaned) is delivered to your cursor via the macOS clipboard + ⌘V (default) or per-character keystroke synthesis (opt-in). DictateSI does not retain the pasted text anywhere except the local history database below.

5. History (local SwiftData store)

DictateSI records each completed transcription locally. Each entry contains timestamp, duration, source app name, raw transcript, polished transcript (if cleanup was used), and a flag indicating which. This database lives only on your Mac. DictateSI has no server-side component to sync, mirror, or back it up. You can clear all history from Settings → History at any time.

History is user-controllable: a "Save dictation history" toggle (off = nothing new is recorded) and a retention window (forever / 1 / 7 / 30 / 90 days) that automatically purges older entries. Deployments that must minimize data at rest can disable history entirely.

6. Read-aloud (text-to-speech, always local)

When you press the read-aloud hotkey, DictateSI reads the text currently selected in your frontmost app (captured the same way ⌘C copies it, then the clipboard is restored) and passes it to Apple’s on-device AVSpeechSynthesizer. Every voice tier (default, Enhanced, Premium, Personal Voice) synthesizes on your Mac. There is no network connection in this step and no cloud TTS path in the app. The selected text is held in memory only: never written to disk, never added to history.

Higher-quality voices are optional ~100 MB+ files. If you install one, the download is performed by macOS itself via System Settings → Accessibility → Spoken Content, not by DictateSI. DictateSI only reads the list of voices already installed and never initiates a download.

7. Audit log (optional, off by default)

Regulated deployments often need to demonstrate that a tool behaved as claimed. When enabled, each dictation appends one record: sequence number, timestamp, source app, duration, the character count of the delivered text, which cleanup backend ran, and whether the text left the Mac (true only for the cloud backend). It never stores the transcript, the audio, or any spoken content; an automated build test fails if a content field is ever added.

Records form an append-only hash chain (each entry’s SHA-256 covers its fields plus the previous entry’s hash), so editing, reordering, or deleting a record is detectable by the built-in Verify integrity check. The full log, including the chain, exports to JSON or CSV for offline review, with the headline figure for a clean deployment: off-device events: 0. An honest limit: like any purely local log, it cannot by itself prove the entire log wasn’t cleared; central log shipping is on the roadmap. The audit log makes no network requests.