Privacy and local-first

What stays on your Mac

Every step of dictation happens on-device. Specifically:

• Audio. When you hold the hotkey, microphone audio is captured into memory on your Mac. It is never written to disk and never transmitted off your machine.
• Transcription. Speech-to-text runs on the Apple Neural Engine via FluidAudio's Parakeet TDT model. The model file lives on your Mac after the one-time first-run download. Audio goes in; text comes out; nothing crosses the network.
• Cleanup. When AI cleanup is on, Voxstr runs an MLX-powered Qwen3 language model inside the Voxstr process. The raw transcript, the cleanup prompt, and the cleaned output stay in process memory. They are not sent anywhere.
• History. Your dictation history is stored in a local SQLite database protected with FileProtectionType.complete (encrypted at rest when your Mac is locked). Voxstr cannot read it from anywhere else, and we cannot recover it for you if you delete it.
• Vocabulary and settings. Custom vocabulary, hotkey choice, cleanup preferences — all in local app storage. None of it is synced to a server.
• Text injection. The final text is typed into your focused app via macOS Accessibility APIs. It does not leave your Mac.

The four network calls Voxstr makes

Voxstr is local-first, but it is not network-free. Here is the complete list of every outbound connection the app makes, and why:

1. License activation. When you enter your license key, Voxstr contacts LemonSqueezy to confirm the key is valid and to claim a device slot. The request includes your license key, your anonymized device identifier, and your Voxstr version. It does not include any dictation content.
2. License re-validation. Voxstr periodically re-checks your license against LemonSqueezy to keep your subscription state in sync (active, past-due, cancelled, etc.). Same payload as activation. No dictation content.
3. Auto-update check. The Sparkle framework checks voxstr.com on a schedule for new releases. The check transmits your Voxstr version and macOS version so we can serve the right update file. We rely on standard web server access logs only.
4. First-run model download. The Parakeet transcription model and the MLX cleanup model are downloaded once on first launch from their public model hosts. After that, they run from your local disk.

Crash and error reporting via Sentry is not in this list because it is off by default. If you opt in (Settings → Privacy), it adds a fifth outbound channel. See What you can turn off below.

What Voxstr never does

For symmetry with the section above, the explicit list of things Voxstr does not do:

• Send your microphone audio to a server.
• Send your transcripts to a server.
• Send your cleanup prompts or cleaned text to a server.
• Send your custom vocabulary or settings to a server.
• Track which apps you dictate into, or log window titles.
• Use your dictations to train any model — ours, FluidAudio's, MLX's, or anyone else's.
• Use tracking cookies on the website. Analytics is cookie-less and does not build a per-visitor profile.
• Sell, rent, or share user data with third parties for advertising.

What you can turn off

You control every optional channel from Settings → Privacy:

• Crash reporting (off by default). When on, Voxstr sends crash stack traces, your Voxstr version, your macOS version, and an anonymized device ID to Sentry. Reports are scrubbed of personally identifiable information before they leave your Mac. They do not include audio, transcripts, prompts, vocabulary, file paths, or window titles. We never prompt for this during onboarding — it is yours to enable only if and when you want to help us debug.
• Auto-update check. Sparkle's update check can be disabled, though we recommend leaving it on. Voxstr ships outside the Mac App Store; auto-updates are how you get security fixes.

License activation and re-validation cannot be disabled — Voxstr needs to verify your license to enable dictation. The re-validation cadence is conservative and the payload contains no dictation content.

Trial counter and license activation

The trial gives you 3,000 words of successful dictation before you need an active license. The counter is on-device. It increments only when text is successfully injected into your focused app — silent dictations and failed injections do not count.

Activating your license calls LemonSqueezy with your license key. It does not transmit any dictation content. Your trial counter and your license state are stored locally; we do not have a per-user usage database to mine.

How to audit Voxstr yourself

You do not have to take our word for any of this. If you want to verify Voxstr's network behavior:

• Little Snitch or LuLu will show you every outbound connection Voxstr attempts. You should see calls only to LemonSqueezy (license), voxstr.com (Sparkle update check), and the model hosts on first launch. With crash reporting opted in, you will also see Sentry.
• Console.app filtered to process:Voxstr shows the local debug log Voxstr writes to ~/Library/Logs/Voxstr/. The same log is on disk and is what you would attach to a support email.

A note on the landing site

Everything above describes the macOS app. The marketing site at voxstr.com is a separate surface and uses Cloudflare Web Analytics to count page visits and CTA clicks. That tool is cookie-less, sends no personally identifiable information, and does not build a per-visitor profile. It does not see your dictation content, your trial counter, or your license — those never leave your Mac. We mention it here so you see both surfaces in one place.

The legal version

This page is the practical summary. The full Privacy Policy at voxstr.com/privacy is the binding legal document and covers data subject rights (GDPR, CCPA), retention windows, third-party processors, and contact addresses for privacy requests. If anything on this page conflicts with the policy, the policy wins.