Trust Center
A switch decides where the audio of a dictation goes — with Cloud dictation off, recognition runs entirely inside this Mac. This page is the rest of the answer: every host the code can reach, what is sent there, and which of them a published build can reach at all.
What stays on your Mac
There is exactly one path by which audio leaves this Mac: Cloud dictation. With that switch off, audio does not leave — with it on, the audio of what you say is streamed through our relay to the speech-recognition vendor in the table below. We keep no copy, and the vendors audio may reach are held to an allow-list by a ledger in the source, so adding a path outside that list fails the build.
The text you dictated follows a switch too. Leave the processing mode off Polish with AI and the tidying runs on the device, your personal dictionary stays on the Mac, and Voicecape keeps no transcript on any server. You can check this from the outside: turn both off and dictate in airplane mode, or watch it with a firewall monitor.
What the app sends on its own
Three requests, in normal use. Licence activation, when you paste a key and press Activate. A quiet re-check of that licence afterwards, carrying the same key, device identifier and activation identifier. And a daily update check that sends a version number.
There is one more that is conditional rather than routine: if the speech model inside the app is found damaged, Voicecape can fetch a replacement. That is the Hugging Face entry below, and it does not happen in ordinary use.
Two hosts in the table are reached by something other than the app: your browser goes to the checkout page when you press Buy, and our own licence server asks Polar whether a key is valid. Both are on the list anyway, because who opened the socket is not what decides whether someone received your data.
Why this list is generated
A page like this rots the moment a feature adds a recipient nobody wrote down. So it is not written by hand: it is rendered from the host ledger in the source code, which is itself held to the code in both directions by a build gate — a host in the code but not in the ledger fails the build, and a host in the ledger that the code no longer reaches fails it too.
What that gate cannot do is find a recipient that leaves no trace in the code. A native framework or a redirect can reach a host without the address ever appearing in a source file, and the ledger says so about itself. Those entries are added by a person; the gate then keeps them honest.
Every host in the ledger
The whole ledger, in the order it is declared in the source. Nothing is filtered out of it here.
-
api.voicecape.com
Licence activation and the background re-check that follows it. Carries the licence key, a device identifier and an activation identifier — no audio and no text you dictated.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Your Mac, directly
- In a published build
- Reachable
- Named in the privacy policy as
- voicecape.com
-
voicecape.com
The update feed the app reads once a day, and the help and re-download links in the app. The update check sends a version number and nothing else.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Your Mac, directly
- In a published build
- Reachable
- Named in the privacy policy as
- voicecape.com
-
huggingface.co
Fetches a replacement speech model if the copy inside the app is found damaged. It does not run in normal use — the model ships inside the app and nothing downloads on first launch.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Your Mac, directly
- In a published build
- Reachable
- Named in the privacy policy as
- Hugging Face — not in the privacy policy yet
-
buy.polar.sh
The checkout page, opened in your browser when you press Buy. Voicecape does not see or handle your card — you type it into Polar.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Your browser, handed off by the app
- In a published build
- Reachable
- Named in the privacy policy as
- Polar Software, Inc.
-
voicecape-relay.egpnwme.workers.dev
The optional cloud text-polishing service. It receives text, never audio, and it is not reachable from a published build.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Your Mac, directly
- In a published build
- Reachable
- Named in the privacy policy as
- Cloudflare, Inc.
-
api.storekit.apple.com
Not in the shipping app — Voicecape is a Mac app today and there is no mobile build to buy a subscription in. It is here because the code path exists: for the version that ships on phones, our server would ask Apple directly, sending the transaction identifier and an account identifier — no audio, no dictated text, no email.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Not reachable — development builds only
- Named in the privacy policy as
- Apple Inc.
-
api.storekit-sandbox.itunes.apple.com
Not in the shipping app. The same check as above, against the test store Apple uses for review builds — same identifiers, nothing more.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Not reachable — development builds only
- Named in the privacy policy as
- Apple Inc.
-
androidpublisher.googleapis.com
Not in the shipping app — there is no Android build yet. It is here because the code path exists: for the version that ships on phones, our server would ask Google directly, sending the purchase token and an account identifier — no audio, no dictated text, no email.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Not reachable — development builds only
- Named in the privacy policy as
- Google LLC
-
oauth2.googleapis.com
Not in the shipping app, for the same reason as the check above. Exchanges our own service credential for a short-lived token so that check can run. Nothing about you is sent here — not even an identifier.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Our server, on your behalf
- In a published build
- Not reachable — development builds only
- Named in the privacy policy as
- Google LLC
-
www.googleapis.com
Not a connection, and not in the shipping app either. This name appears in our code only as the label for the permission scope the check above requests; nothing is ever sent to it.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Our server, on your behalf
- In a published build
- Not reachable — development builds only
- Named in the privacy policy as
- Not a destination
-
api.polar.sh
Our licence server asking Polar whether a key is valid. Your Mac does not talk to this host; our server does, on its behalf.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Polar Software, Inc.
-
api.portone.io
Our licence server charging and refunding Korean-won subscriptions through PortOne, a Korean payment gateway. Your Mac does not talk to this host, and no card number travels this path — the server sends a billing token, an email address and an amount.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- 주식회사 코리아포트원
-
generativelanguage.googleapis.com
One of the language models the polishing service can hand text to. Reachable only from a development build.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Google LLC
-
api.openai.com
A second language model for the polishing service, used when the first one fails. Reachable only from a development build.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- OpenAI, L.L.C.
-
api.groq.com
A third language model for the polishing service, chosen because it fails for different reasons than the other two. Reachable only from a development build.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Groq, Inc.
-
stt-rt.soniox.com
The speech-recognition vendor for Cloud dictation. While that switch is on, the audio of what you say is streamed here through our relay and transcribed in real time; by contract no copy is retained.
- What is sent
- Audio
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Soniox Inc.
-
api.deepgram.com
A second cloud speech vendor under the same evaluation, and under the same limit: the code checks that it answers, and sends no audio.
- What is sent
- Audio
- Who opens it
- Our server, on your behalf
- In a published build
- Excluded
- Named in the privacy policy as
- Deepgram, Inc.
-
supabase.co
Accounts — sign-up, sign-in, sessions and deletion. Shipping since 1.3.0. Nothing is sent here unless you create an account or sign in.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Your Mac, directly
- In a published build
- Reachable
- Named in the privacy policy as
- Supabase
-
appleid.apple.com
Sign in with Apple. macOS makes this call for us and hands back an identity token; we never see your Apple password. The button is only drawn on a build signed for it, and it is off in the current release.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- macOS, on our behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Apple Inc.
-
accounts.google.com
Sign in with Google, on the website. Your browser is sent there by the account service; the Mac app itself never names this host and has no Google button.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Your browser, handed off by the app
- In a published build
- Reachable
- Named in the privacy policy as
- accounts.google.com
-
example.com
Not a real destination. It is the placeholder in test fixtures and in an input field hint, and it is listed here only because this table is the whole ledger rather than a selection from it.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Your Mac, directly
- In a published build
- Not an egress at all
- Named in the privacy policy as
- Not a destination
-
api.paddle.com
Only if your workspace is on a paid plan. Our server asks Paddle to change or cancel that subscription, sending the subscription and price identifiers and the number of seats. Your card never travels this path — it goes from your browser to Paddle directly, and we never see the number.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Paddle.com Market Ltd.
-
cdn.paddle.com
Your browser loads the checkout script from here when you open the billing page. Card details are typed inside a window that belongs to Paddle, not to us, so the number never reaches our servers.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Your browser, handed off by the app
- In a published build
- Reachable
- Named in the privacy policy as
- Paddle.com Market Ltd.
-
sandbox-api.paddle.com
Not in anything you use. It is Paddle’s test environment, reachable only from our own machines and preview builds; the shipped console refuses this host.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Not reachable — development builds only
- Named in the privacy policy as
- Not a destination
-
api.resend.com
Account email only — the confirmation message when you sign up and the link when you reset a password. Your address and that link go out; nothing you recorded or dictated does.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Plus Five Five, Inc.
-
api.notion.com
Only if an admin in your workspace turns the Notion integration on. Then the summary text — the points, decisions and action items — is written into the database they chose. Turning it off stops it; it is off until someone turns it on.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Notion Labs, Inc.
-
slack.com
The sign-in step of the Slack integration. When an admin connects Slack, this is where the authorisation happens and where we exchange the resulting code for a token — the summary itself does not travel here.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Slack Technologies, LLC
-
hooks.slack.com
Only if an admin in your workspace turns the Slack integration on. Then the summary text is posted to the channel behind the webhook address they pasted. Turning it off stops it.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Slack Technologies, LLC
-
api.recordport.app
Ours. This is the server that does the transcription and summarising work; the console and the apps talk to it. Where it goes next is every other line on this page.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Not a destination
-
voicecape.com
The update feed the app reads once a day, and the help and re-download links in the app. The update check sends a version number and nothing else.
- What is sent
- Request metadata only — nothing you said, nothing you typed
- Who opens it
- Your browser, handed off by the app
- In a published build
- Reachable
- Named in the privacy policy as
- Not a destination
-
app.voicecape.com
Ours — the web console itself. The address appears in our own code because links in emails, share links and the payment callback have to point somewhere; it is the same site you are signed in to.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Not a destination
-
admin.recordport.app
Ours — the console’s older address. Links we sent before the rename still point at it, so it stays online and forwards you to the current console. Same site, older name.
- What is sent
- Text, never audio — the line above says which text
- Who opens it
- Our server, on your behalf
- In a published build
- Reachable
- Named in the privacy policy as
- Not a destination
Some rows carry “not in the privacy policy yet”. That marker is read from the ledger’s own backlog, and the build gate holds it in both directions — a recipient still marked after it has been named fails just as loudly as one that was never named. Every row carrying it today is either unreachable from a published build, or receives nothing about you; the generator refuses to render this page if that stops being true.
Reading the rest
The privacy policy is the document with legal force, and it names the same recipients in the terms the law uses. What Voicecape sends over the network walks the three requests one at a time, with the actual endpoints. If you find something on this page that does not match what your firewall shows you, write to us — that is a report we want.