Privacy

Vocula has no account, no telemetry, no licence server and no analytics. Nothing you dictate ever leaves your Mac. The app talks to one place, GitHub, for two things — the speech model once, and a daily check for a new version that you can switch off — and neither carries anything of yours.

That is the short version, and it is the version every competitor also writes. So the rest of this page is the part that is harder to say.

What is stored on your Mac

• Your dictation history — one file per day, encrypted with AES-GCM, kept for one year. There is no setting for the length — a dictation is deleted 365 days after it was made — and you can switch history off entirely. Deleting a day removes its file; deleting everything removes them all. What may survive in unreclaimed disk blocks afterwards is ciphertext.
• The speech model you downloaded, in Application Support — 1.62 GB for the Whisper engine or 468 MB for Parakeet, plus 885 KB for the voice-activity detector either way. Only the engine you selected is downloaded.
• A diagnostic log of anomalies — not a log of your dictations. It records events like a microphone taking unusually long to start, and it never contains transcribed text. It is capped, local, and you can clear it with a button.
• Your settings.

The encryption key

Your history is sealed with a key created on first use and held in your login Keychain, tied to the app. We never see it and there is no recovery path through us, because there is no us in this transaction. The files alone are useless without it, another program running as you cannot read it silently, and it is never put into iCloud Keychain.

It is not bound to this Mac. Until 29 September 2026 this page said it was; measured, it is not — the app asks for device-only, and the keychain it lands in does not keep that. So if your login keychain moves to a new Mac, with Migration Assistant for example, your history is readable there.

What travels to a new Mac, and what does not

This is the inconvenient part, and it is here because saying it is what makes the rest believable.

• The three macOS permissions. Input Monitoring, Accessibility and Microphone are granted per Mac, and macOS binds them to the app’s signature. A new Mac asks again. So does a re-signed build.
• The history key travels with your login keychain, as above. What can strand it is a differently-signed build: re-signing the app can put the key out of reach, and the old days become unreadable. They are left on disk rather than deleted, because destroying your history to tidy up after our own key management would be the worse bug.
• The models. They are not in a backup of the app. A new machine downloads them again.

Where the model comes from

From Vocula's own GitHub release, not from a third-party model host. That is a deliberate constraint rather than a detail: the Parakeet engine is built on a library whose own loader will fetch a missing file from HuggingFace by itself, and Vocula refuses to load the engine at all unless every bundle is already on disk. A damaged model is repaired from our release or not at all. How that was found, and how to check it.

The two network calls, both to GitHub

• The speech model, once, the first time you use the app, from Vocula’s own GitHub release. Each file is checked against a checksum built into the app.
• A version check, once a day, while the switch in Settings → Permissions is on. It ships on, and you can turn it off there. It fetches one small signed file that says what the latest version is. GitHub sees what any web server sees from any request — your IP address and the app’s name and version — and nothing about you, your settings or your dictation. The profile of your Mac that the update framework can attach is not enabled. An update that is found is downloaded in the background and installed only when you say so.

That is the whole list. Earlier versions of this page said update checking would be manual by default; it shipped on, and this page now says so. Switch it off and, after the model download, Vocula makes no connection at all.

Where to write

[email protected]. A person reads it, not a form. Use it for the rights data-protection law gives you — access, correction, erasure — and for anything on this page you think is wrong.

There is one place your e-mail address exists at all: a purchase. The payment provider needs it to take the money and we need it to send the licence key, which is signed and mailed without being stored. The app itself never learns it, and no key or purchase is ever tied to anything you dictated.

Do not take this on trust

Run the ten-minute check. It works on us and on everyone else, and a claim you verified yourself is worth more than a page like this one.