Voice Data Retention: Questions to Ask Any Dictation App

Five questions that settle it

Retention is where privacy claims either hold up or fall apart. These five questions produce specific answers, and specific answers are the useful kind.

1. Does my audio leave the device, and when?
2. If audio is uploaded, how long is it kept, and is it used for training?
3. Where do transcripts live, for how long, and does deleting mean deleted?
4. What happens by default, before I change any setting?
5. Who else receives the data: model providers, analytics, human reviewers?

Ask them in email or in a support ticket, so you have the answer in writing. A vendor that answers plainly is telling you something about how the product is built.

Vagueness is data too. Words like industry-standard and may retain without a timeframe mean the answer is complicated in a direction you would not like.

Audio: uploaded, buffered, or discarded

Audio is the most sensitive part, because your voice carries who is in the room and what the background sounds like. There are three real cases, and vendors often blur them.

• Never leaves: recognition runs on device. Verifiable by turning off the network.
• Uploaded and discarded: sent for transcription, deleted after processing. Ask for the timeframe.
• Uploaded and retained: kept for quality, training, or support. Ask how long and whether you can opt out.

Transcription does not require keeping the recording. When a vendor keeps audio, that is a product decision, and it is fair to ask what you get in exchange.

Ask about failure paths too. Some apps fall back to a server when a local model is missing, mid-download, or unavailable for your language. A local default that silently becomes a cloud request is worth knowing about before a sensitive call.

Transcripts: the part people forget

Most people ask about audio and stop. The transcript is the thing that contains names, salaries, medical details, and half-finished thoughts, and it usually outlives the recording by a long way.

• Is history stored on the device, in the vendor’s cloud, or both?
• Is it encrypted at rest, and can the vendor read it?
• Does deleting an entry remove it everywhere, including backups?
• Is history synced across devices, and can sync be turned off?
• Can support staff view your text when you file a ticket?

Check your own backups as well. A local history file can land in a cloud backup you set up years ago, which quietly moves the data you were keeping on the device.

Auri Voice keeps recognition and text improvement on the Mac by default, which keeps the transcript on the machine you are working on. Whatever app you use, find the delete path once so you are not searching for it when you need it.

Defaults matter more than capabilities

A local mode buried three screens into settings is a feature almost nobody turns on. What happens out of the box is what happens to your data, so ask about defaults rather than possibilities.

Defaults also tell you where a company’s incentives sit. A product built around local processing tends to keep it local through redesigns, and a product built on server calls tends to add more of them.

Auri Voice defaults to on-device speech to text and on-device text improvement, with cloud features optional. Auri Keyboard on iPhone defaults to cloud voice typing and offers local speech to text, which is worth changing before you dictate anything sensitive on a phone.

Subprocessors, training, and human review

Data rarely stops at the vendor. AI features often call a model provider, and each hop adds its own retention and access rules that the app’s privacy page may summarize in one sentence.

• Which third parties receive audio or text, and for which features?
• What are their retention periods, and are they contractually limited?
• Is any content reviewed by humans for quality or abuse handling?
• Is content used to train the vendor’s or the provider’s models?
• Where is data processed geographically, if that matters for your work?

Human review is the question people forget and the one that changes behavior most. Knowing that a small share of requests may be read by a person changes what you are willing to dictate.

Ask for a subprocessor list. Companies that handle business customers usually maintain one, and its absence tells you something about how the question has been handled so far.

How to verify instead of trusting the page

Most claims can be spot-checked in ten minutes. That is faster than reading a policy and tells you what the software does rather than what the marketing says.

1. Download any language or engine packs, then turn off Wi-Fi.
2. Dictate two paragraphs into the app you actually write in.
3. Note what fails: recognition, insertion, or the rewrite features.
4. Look through settings for history, sync, and cloud toggles.
5. Delete one history entry and confirm it is gone after a restart.
6. Optionally run a network monitor and watch what the app contacts.

Record the results in a note with the date and app version. Behavior changes across updates, and a dated note is what lets you notice when it does.

One caution on the offline test: recognition working offline proves the recognition path is local. It does not prove nothing is uploaded later when the network returns. Check sync settings before you conclude the loop is closed.

Where Auri stands

The same questions applied to our own products, since a guide asking you to demand specifics should offer them.

• Auri Voice on Mac runs speech to text and text improvement on device by default, and cloud features are optional.
• Text cleanup happens locally, so the punctuation and filler removal pass does not require a server.
• Searchable history stays on the Mac and can be turned off. Audio history is off by default and stays local if you enable it.
• Apple Watch dictation to Mac is encrypted in transit and transcribed locally on the Mac.
• Auri Voice requires macOS 15 or later, with a free tier and Pro at $17 per month or $120 per year.
• Auri Keyboard is a separate app: local speech to text is available, cloud is the default on iPhone, and it cannot access password or credit card fields.

For details beyond that, read the privacy policy and email us with the specific question. A written answer you can keep is worth more than a claim on a landing page, including ours.

FAQ