superwhisper privacy and safety: what stays on your device, and what a cloud model sends

By · Published

superwhisper stores your transcripts and audio on your own device, not on its servers. What can leave is the audio or the text of a dictation while it is being processed, and only when the mode you are using is set to a cloud model. Pick a local voice model and a local language model, or no language model, and its docs say no audio or text leaves your machine.

I make YapToText, a different dictation app for the Mac, so read what I say about superwhisper with that in mind. Every fact about superwhisper here is from its own docs, read on October 10, 2026. The pages are Sensitive Data Best Practices, Compliance & Trust, and Account & Data Deletion. Nothing here is legal advice.

Download YapToText on the Mac App StoreThis app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.

This guide in other languages: العربية, Čeština, Dansk, Deutsch, Ελληνικά, Español, Suomi, Français, עברית, हिन्दी, Magyar, Bahasa Indonesia, Italiano, 日本語, 한국어, Norsk, Nederlands, Polski, Português, Română, Русский, Slovenčina, Svenska, ไทย, Türkçe, Українська, Tiếng Việt, 简体中文, 繁體中文

On this page: 9 sections
  1. Two stages, each set separately
  2. What superwhisper says it holds
  3. What a cloud model sends
  4. The fully local setup
  5. HIPAA, GDPR and SOC 2
  6. Delete your data
  7. YapToText next to it
  8. The short version
  9. Questions

Two stages, each set separately

From superwhisper's docs page Sensitive Data Best Practices, read October 10, 2026.

StageWhat it doesWhere it can run
Voice to textA voice model turns your audio into a raw transcriptOn your device with a local voice model, or on a cloud voice service you choose
Text post-processingA language model formats or rewrites the transcript, following the mode's instructions. OptionalOn your device with a local language model, or on a cloud provider

Each mode has its own pair of models, so one mode can be fully local while another sends text out. Privacy in superwhisper is a per-mode setting, so check each mode you use.

What superwhisper says it holds

  • Transcripts and audio. Stored locally on your device. The docs say superwhisper never stores them on its servers.
  • Modes, vocabulary and settings. Local, unless you turn on Filesync, which syncs configuration through its servers. Filesync does not include transcripts or audio.
  • Your account. An email address and billing records.
  • Enterprise. Usage analytics metadata, if an organization's admin turned it on.

What a cloud model sends

With a cloud voice model the audio goes to that service. With a cloud language model the transcript does. The docs say superwhisper reaches every third-party AI provider through API agreements with zero-data-retention terms, and that your audio and text are not used to train AI models.

  • The limit of that promise. It covers data sent through superwhisper's API integrations. Text you dictate into a provider's own website or app falls under that provider's consumer terms.
  • Vocabulary. Vocabulary words are sent with the audio as recognition hints, so with a cloud voice model they reach that provider. Text replacements stay on the device.
  • Your own API keys. Pro users and Enterprise teams can route requests through their own provider account. The docs say your agreement with that provider then governs the data.

The fully local setup

  1. Open the settings of the mode you dictate with.
  2. Under Voice Model, choose a local model. The docs list Cohere Transcribe, Parakeet Multilanguage and Whisper Large v3 Turbo as local options.
  3. Under Language Model, choose a local model. Or use the Voice to Text mode, which has no language model at all.
  4. Repeat for every mode you use.

The docs call Voice to Text with a local voice model the simplest fully local configuration. The superwhisper offline page covers which local models are free and which need Pro.

HIPAA, GDPR and SOC 2

  • Local only. No audio or transcripts leave the device, and the docs say no BAA with superwhisper is required for those models.
  • superwhisper's cloud models. Sign superwhisper's Business Associate Agreement.
  • Your own keys. Sign a BAA directly with the provider.
  • SOC 2. The report is available through its Trust Center under NDA.
  • GDPR. It offers a Data Processing Addendum and takes data subject requests by email.

The docs add their own caution: whether a configuration satisfies HIPAA, GDPR or SOC 2 depends on your implementation and agreements, and you should check with your compliance or legal team. The medical dictation page goes through what to ask of any dictation app.

Delete your data

  • Recordings. Delete them in History, or set a retention period. The superwhisper history page has the steps and the folder.
  • The account. Email support from the account's address with the subject Delete my account. The docs say deletion is completed within 30 days.
  • Everything on the Mac. Uninstalling the app leaves the data folder behind. The uninstall guide covers the clean removal.

YapToText next to it

YapToText has no cloud model to choose, so no setting can send a dictation out.

  • Both stages on the Mac. The speech model and the cleanup model run locally, free.
  • No account. No analytics and no tracking. The only network use is a model download you start yourself.
  • Narrower. It runs only on Apple silicon Macs with macOS 14 or later. There is no phone or Windows app.
  • No paperwork. I make no HIPAA or other compliance claims about it, and there is no BAA or SOC 2 report to request. superwhisper offers both.

The private dictation page shows how to check any app with the network off.

Download YapToText on the Mac App StoreThis app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.

The short version

  • Stored. Transcripts and audio stay on your device.
  • Sent. Audio or text goes out only when a mode uses a cloud model.
  • Terms. Zero data retention through its API integrations, and no training on your data.
  • Local. A local voice model, plus a local language model or none.
  • Regulated work. A BAA, a DPA and a SOC 2 report are available.

If superwhisper changes these terms and this page falls behind, open an issue on GitHub. Every one gets read.

Download YapToText on the Mac App StoreThis app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.

About the author. Ryleigh Newman is a developer whose hands make typing difficult and who dictates every day with YapToText, the app this site describes. Facts about other apps come from their own sites, with the date they were read. More about the project.

Sources

Questions

Is superwhisper safe?

Its docs say transcripts and audio are stored on your device, not its servers, and that cloud providers are reached under zero-data-retention terms. A fully local setup sends nothing out.

Does superwhisper store my audio?

On your device, yes, in its recordings folder. Its docs say it never stores your transcripts or audio on its servers.

Does superwhisper train AI on my dictations?

Its docs say your audio and transcribed text are not used to train any AI models.

Is superwhisper HIPAA compliant?

Its docs describe three paths: local-only models with no BAA needed, its cloud models with a signed BAA, or your own provider keys. They also say to confirm with your compliance team.

Can superwhisper run with nothing leaving my Mac?

Yes. Use a local voice model with a local language model, or the Voice to Text mode, which has no language model.