# Yappy privacy model

The [privacy page](https://yappy.biz/privacy/) is the plain-language version.
This one is component by component, for people who want to check.

## Never leaves the machine

| Component | Where it runs | Why it cannot leak |
|---|---|---|
| Microphone capture | `AVAudioEngine`, in-process | Buffers are handed straight to the local recogniser and released. |
| Speech recognition | `whisper.cpp`, local | The model file is on disk; there is no network client in this path. |
| Screen context | Apple Vision OCR, on-device | The screenshot is read into text and discarded; never written to disk. |
| Learned playbooks | Local files under `~/.yappy` | Written and read by the app only. |
| Correction history | Local | Used to bias the next transcription toward words you actually use. |

There is no configuration in which audio is uploaded. Not on the free tier, not
on the hosted plan.

## Leaves the machine, by your choice

| Component | What is sent | When |
|---|---|---|
| Cleanup with a hosted provider | The text of one transcript | Only when `llm.provider` is a hosted option |
| Agent Mode | Task text plus the screen-derived context to carry it out | Only when you hold Right ⌘ |
| Update check | App version, to fetch a signed appcast | When `autoUpdate` is on |
| Usage analytics | Feature events, app and OS version | When `shareUsageAnalytics` is on |
| Send Feedback | What the dialog shows you before sending | Only when you press send |

Set `llm.provider` to `ollama` and turn Agent Mode off, and nothing in the
dictation path touches the network.

## What analytics never contains

Transcripts, audio, screen contents, filenames, window titles, prompts, and
clipboard contents are all excluded at the point of capture, not filtered later.
The events are things like "dictation completed", "agent task started", app
version, and macOS version.

## Verifying it yourself

You do not have to take our word for the local claims:

1. Turn Wi-Fi off.
2. Set `llm.provider` to `ollama` (or turn AI Cleanup off entirely).
3. Dictate.

The text still appears. Whisper, cleanup, and OCR are all running on your Mac.
Little Snitch or `nettop` will show you the same thing with the network on.

## macOS permissions

| Permission | Needed for | If denied |
|---|---|---|
| Microphone | Any dictation | Dictation is unavailable; everything else works |
| Accessibility | Global hotkey and inserting text | The key does nothing; grant and relaunch |
| Screen Recording | Screen context only | Screen context silently stays off |

Each is revocable in System Settings → Privacy & Security and takes effect
immediately. Yappy degrades to the features that permission is not needed for
rather than nagging.

## Retention

Yappy keeps no transcripts server-side, because it sends none. Local correction
history lives on your machine and is deleted with the app. Analytics events are
retained by PostHog under the project's retention window and carry no content.

---

Canonical: https://yappy.biz/docs/privacy-model/ · Last updated: 2026-08-25