Privacy
Vocula has no account, no telemetry, no licence server and no analytics. It makes no network connection at all after the one-time model download. There is nothing for us to collect because there is nothing that reaches us.
That is the short version, and it is the version every competitor also writes. So the rest of this page is the part that is harder to say.
What is stored on your Mac
- Your dictation history — one file per day, encrypted with AES-GCM, kept for one year. There is no setting for the length — a dictation is deleted 365 days after it was made — and you can switch history off entirely. Deleting a day removes its file; deleting everything removes them all. What may survive in unreclaimed disk blocks afterwards is ciphertext.
- The speech models you downloaded, in Application Support. Around 1.6 GB.
- A diagnostic log of anomalies — not a log of your dictations. It records events like a microphone taking unusually long to start, and it never contains transcribed text. It is capped, local, and you can clear it with a button.
- Your settings.
The encryption key
Your history is sealed with a key created on first use and held in your Keychain, marked as belonging to this device and tied to the app’s signature. We never see it and there is no recovery path through us, because there is no us in this transaction.
Three things that do not travel
This is the inconvenient part, and it is here because saying it is what makes the rest believable.
- The three macOS permissions. Input Monitoring, Accessibility and Microphone are granted per Mac, and macOS binds them to the app’s signature. A new Mac asks again. So does a re-signed build.
- The history key. It is marked device-only and tied to the signature. Restore your Mac from a backup onto different hardware, or run a differently-signed build, and the old history cannot be decrypted. It is left on disk rather than deleted, because destroying your history to tidy up after our own key management would be the worse bug.
- The models. They are not in a backup of the app. A new machine downloads them again.
The one network call there will ever be
Software updates. When update checking ships it will be manual by default — a button you press — with an optional automatic check that is off unless you turn it on, and system profiling explicitly disabled. Pressing that button is a network call and we are describing it as one. Everything else on this page stays true whether you ever press it or not.
Where to write
[email protected]. A person reads it, not a form. Use it for the rights data-protection law gives you — access, correction, erasure — and for anything on this page you think is wrong.
There is one place your e-mail address exists at all: a purchase. The payment provider needs it to take the money and we need it to send the licence key, which is signed and mailed without being stored. The app itself never learns it, and no key or purchase is ever tied to anything you dictated.
Do not take this on trust
Run the ten-minute check. It works on us and on everyone else, and a claim you verified yourself is worth more than a page like this one.