AI dictation privacy comes down to one question per tool: does your speech get processed on your device, or does it travel to someone's server first? The answer differs by app, by setting, and sometimes by which model you pick inside the same app. I read the vendors' own pages on 2026-10-09 and put what they say in one table, with "unknown" wherever a page did not say.
This is a map to check, not a guarantee. Vendors change these pages, your contract may override them, and I could not install or inspect any of these apps. For the LLM side of the same question (what happens to text after it reaches a model API), see the retention and training opt-out table.
How did I read the pages?
I fetched each page with curl, converted the HTML to plain text with a small script, and read the text. Quotes below are from that text, not from a summary. A page that returned an error is marked. I did not read the full privacy policies or terms for any vendor, only the pages listed in the last column of the table. I did not test any app.
What does each tool say?
| Tool | Where speech is processed | Kept or used for training, as the page says | Unknown after reading | Pages read (2026-10-09) |
|---|---|---|---|---|
| Wispr Flow | Cloud. "Transcription always happens in the cloud." | Audio is deleted once transcribed unless Dictation cloud storage is on. A setting controls use of audio, transcripts and edits for training. Local history can be kept, auto-deleted after 24 hours, or never saved. | Default training setting on individual plans. Retention period when cloud storage is on. | wisprflow.ai/privacy |
| Superwhisper, local models | On your device. Docs: with a local voice model and a local language model, "no audio or text ever leaves your machine". | Docs say transcription history is stored locally. | Whether any telemetry is sent (the docs mention optional enterprise usage analytics). | superwhisper.com/docs and its sensitive-data and compliance pages |
| Superwhisper, cloud models | Voice and language steps are separate. Either can run through a cloud provider. Docs list Anthropic, OpenAI, Deepgram and Groq among providers. | Docs say access is through API agreements with zero-data-retention terms and no training. Custom vocabulary words are sent with the audio to a cloud voice model. | I cannot verify the provider agreements. | Same docs pages |
| Apple Dictation (Mac, iPhone) | On the device or on Apple servers. The Keyboard settings text says which. | If sent to servers, "will not be stored unless you opt in" to Improve Siri and Dictation. Opt in and Apple may store audio and review a sample. A separate passage says request history, including transcripts, tied to a rotating random identifier, may be kept up to two years. | Whether that retention passage applies to on-device dictation. Which languages and Mac or iPhone models process on-device. | Apple Support "Dictate messages and documents on Mac"; Apple Legal "Siri, Dictation & Privacy" (page dated 2026-09-14) |
| Windows voice typing | Online. Microsoft Support: it "uses online speech recognition, which is powered by Azure Speech services" and needs an internet connection. | Not stated on the page. | Retention, human review, training use. | Microsoft Support "Use voice typing to talk instead of type on your PC" |
| Google Docs voice typing | Depends on your browser. Google's page: "your web browser controls the speech-to-text service." | Not stated on the page. | Where the browser sends audio, and what it keeps. | Google Docs Editors Help "Type and edit with your voice" |
| Gboard voice typing (Android) | Not stated on the help page I read. | Not stated. | Everything. | Gboard Help "Type with your voice" |
OpenAI transcription API (/v1/audio/transcriptions), used by apps that take your own API key | OpenAI servers. | Data controls page: API data is not used for training unless you opt in. In the endpoint table this endpoint shows no abuse-monitoring retention, no application-state retention, and Zero Data Retention eligible: Yes. | The app between you and the API may keep its own copy. | OpenAI platform "Data controls" guide |
| ChatGPT's own dictation | Not read. The help article returned HTTP 403 to my fetch. | Unknown. | Everything. | None |
| Talon | Not stated on the homepage I read. | Unknown. | Everything. | talonvoice.com homepage only |
| MacWhisper | Not read. Only the help center index loaded. | Unknown. | Everything. | Help center index only |
Two caveats on rows I did read. Superwhisper's separate privacy policy page was last updated on 2024-06-19 according to the page, and it describes a product that transcribes everything locally. The newer docs describe cloud options as well. Read the docs for the mode you actually use and ask the vendor which document governs. And for Apple, the legal page and the support page frame storage differently, as the table says; I would rather show that gap than smooth it over.
What do the cloud tools let you switch off?
Where a page lists switches, these are the ones that change what stays behind. Wispr's page names four.
- Improve the model for everyone controls whether your audio, transcripts and edits are used to evaluate, train or improve models.
- Dictation cloud storage controls whether transcripts, audio and history are stored on Wispr's servers for cross-device use. Off means the dictation stays on your device and audio is discarded once transcribed.
- Context awareness reads limited text from the app you are dictating into. Off means Flow transcribes without reading anything on your screen. If your screen often shows secrets or customer data, this one matters.
- Local data storage controls the history on your computer: keep it, auto-delete after 24 hours, or never save it.
Apple's equivalent is the Improve Siri and Dictation toggle under Privacy and Security. Superwhisper's equivalent is the choice of voice and language model per mode, since the docs say each stage is configured independently.
What counts as a second leak: the AI formatting step?
Many dictation apps now do two jobs: turn speech into text, then rewrite the text with a language model (fix grammar, change tone, follow a custom mode). Those can be different data paths. Superwhisper's docs spell it out: a local voice model with a cloud language model is allowed, so your audio stays local while the transcript goes to a provider. Wispr's page says transcription happens in the cloud and does not break out a separate formatting step. If an app offers an "AI polish" or "rewrite" mode, ask where that stage runs, separately from where the transcription runs.
How do I test whether a tool is really offline?
This is a procedure I did not run, because my environment has no microphone or desktop dictation apps. It is a first filter, not proof.
- Install the app and finish any model downloads while online.
- Turn on airplane mode, or unplug the network.
- Dictate three sentences into a text editor, then a sentence with an AI formatting mode if the app has one.
- Note what fails. Plain transcription that still works is processed locally. A formatting mode that fails or hangs is calling a cloud model.
- Reconnect and check the app's history and settings for anything it kept.
Windows voice typing will fail step 4 by design, since Microsoft's page says it needs an internet connection. Passing the test does not cover analytics or crash logs, which only the vendor can describe.
Which tool fits which kind of speech?
| What you will say | Reasonable starting point | Why |
|---|---|---|
| Ordinary emails, personal notes, public posts | Any built-in or cloud tool, training off where possible | Low harm if the text leaks, so convenience wins |
| Client confidential, unpublished code, contracts under NDA | A local model, or written client approval for a named cloud tool | Your contract, not the tool's marketing, sets the rules |
| Health, legal or financial details about other people | Local only, or a vendor that signs the agreement your regulator or employer requires | Rules differ by country and field. Ask a professional |
| Passwords, API keys, tokens | Type them, or do not put them in text at all | No dictation tool needs your secrets |
| A folder of old recordings | A local script such as the Whisper batch script | The audio never leaves your machine after the model download |
If you are weighing the tools themselves on features and price, the dictation tool comparison covers that, and the voice coding workflow has a settings checklist for cloud dictation near real code.
What should I record once I have chosen?
Write it down once, with the date, so the next audit or client question takes a minute. This is a template, not something any vendor supplies.
Tool and version:
Plan:
Date settings checked:
Speech processed: on device / vendor cloud / provider cloud (name)
AI formatting step: none / local / cloud (name)
Training or improvement setting: off / on / not available
Cloud history or storage: off / on
Retention period per vendor page: (quote or "unknown")
Who approved it, and for what kind of speech:
Page URLs read and date:
If you run a team, the AI use policy template is the place to say which categories of speech may go to which tools. If your work touches personal data of people in India, the DPDP checklist is a starting point, but check legal questions with a professional.
What I could not verify
- I did not install or run any app, so every statement is what a page says, not what the software does.
- ChatGPT's dictation, Talon and MacWhisper have no statement in this table because I could not read a relevant page.
- I did not read Wispr's, Apple's, Microsoft's or Google's full privacy policies. Terms there can add to or qualify these pages.
- Vendor claims about audits, agreements and zero data retention are theirs. I did not see the reports or contracts.
- The offline test above is a procedure, not a result.
Re-read the live pages before you quote any of this to a client.
