Security

Last updated 27 September 2026 · How the apps and the credits service handle your data. The privacy policy says what is collected; this page says how it is protected.

Design principles

• Local first. Speech-to-text and, by default, cleanup run on the device. The apps are fully usable with no network connection and no account.
• Every remote path is explicit. Text leaves the device only through a path you turned on: your own API key, or VoiceMerge credits. The app shows which path ran on every dictation.
• Screen context never goes remote. Window titles and selected text, if you enable them, are only given to on-device models.
• We don't store what we don't need. The credits service records token counts, model, purpose and cost per request, not the text.

The Mac app

• Signed and notarized. The download is signed with our Developer ID and notarized by Apple. macOS verifies both when you open it.
• Hardened runtime. The app runs with Apple's hardened runtime, which stops other local processes from injecting code into a process that holds Accessibility trust and your API keys.
• Keys in the Keychain. API keys are stored in the macOS Keychain, never in plain files, and are sent only to the provider they belong to.
• Permissions, minimal. Microphone while the hotkey is held or a meeting records; Accessibility to type at the cursor and read a selection; System Audio Recording only for meetings; Reminders only if you send tasks there.
• Network connections. With defaults: model downloads from Hugging Face on first use, and the local Ollama server on your Mac (localhost). Otherwise only the provider you configured, or api.voicemerge.app with credits. There is no telemetry, no update ping, no crash reporting.
• Synthetic input is tagged. Text VoiceMerge types is sent as keyboard events with a marker, and the app checks that the frontmost app is still the one you dictated into before pasting or erasing.

The iPhone app and keyboard

• Distributed through the App Store, sandboxed as iOS requires.
• The keyboard has no network code. It cannot make network requests. Typing works without Full Access; Full Access is used only to read the dictated text that the app leaves in the shared App Group container.
• The keyboard never records audio (keyboard extensions cannot); dictation happens in the app.
• API keys are stored in the iOS Keychain. Privacy manifests declare what the app and keyboard access.

The credits service (api.voicemerge.app)

• Authentication is Sign in with Apple. We verify Apple's identity token and issue our own short-lived tokens signed with an RSA key held only on the server.
• Transport is TLS everywhere: device to our API, our API to Anthropic, our API to its database.
• Purchases are verified with Apple's App Store Server API and Stripe's signed webhooks. Refunds and revocations arrive as signed server notifications.
• Requests are forwarded to Anthropic under their commercial API terms (no training on your content) and are not stored by us. The ledger holds metadata only.
• Hosting is on servers we operate, as a container with a read-only filesystem and no elevated privileges, behind Cloudflare as a network proxy. Backups of the account database run nightly.
• Deleting your account deletes the account, balance and ledger.

What we don't do

• No analytics, advertising identifiers, session replay or tracking pixels, in the apps or on this website.
• No cloud sync of history, dictionary or settings.
• No audio upload, ever.

Reporting a vulnerability

Please write to [email protected] with "security" in the subject. We read every report, reply within a few days, and credit you if you'd like. A machine-readable contact is at /.well-known/security.txt.