DOC Privacy and data
Where everything lives, and the one thing that leaves.
This page describes the application as it is built today, not as it is hoped to be. It is written to the same ledger the product uses internally, and where a promise has not been earned yet, it says so instead of rounding up.
This is a product data-boundary description. It is not yet a legal privacy policy; Voqela has no public release, no account system, and no payment channel, and a formal policy will be published alongside the first release.
The promise, in full
Voqela is designed so that microphone audio and transcript processing stay on your Mac. It has no account, and the code contains no telemetry, no analytics, no crash upload, no cloud transcription, no remote rewriting, and no request that reads the document you are working in.
It does use the network for one thing: downloading its speech model from a public model host when the model is not already on your Mac. That request carries none of your content. The promise is not shortened to "Voqela never connects to the internet", because that would not be true.
Everything it keeps, and where
One folder on your Mac holds all of it. Settings lists every store in that folder with the real path on your install, and a control that reveals each one in Finder. Nothing below is a summary of the card; it is the card.
Your data
Everything Voqela keeps is a file in one folder on this Mac. These are the real paths on this install.
Data folder
~/Library/Application Support/Voqela
Settings
Your shortcut, sound cues, formatting, and every other choice in this window.
~/Library/Application Support/Voqela/settings.json
Vocabulary
The words you told Voqela to always write your way.
~/Library/Application Support/Voqela/vocabulary.json
Transcripts and history
Every dictation's text and what happened to it, one folder each.
~/Library/Application Support/Voqela/History/
Recordings
The audio of each dictation, for playback, retry, and recovery.
~/Library/Application Support/Voqela/Captures/
Speech model
The downloaded model this Mac transcribes with, on disk and offline.
~/Library/Application Support/Voqela/Models/
Learning suggestions
Corrections you made that Voqela may offer as vocabulary.
~/Library/Application Support/Voqela/correction-suggestions.json
Diagnostics
A local record of what ran and how it went: names, outcomes, and timings, never your text.
~/Library/Application Support/Voqela/diagnostics.json
Network log
Every network operation Voqela has started on this Mac.
~/Library/Application Support/Voqela/network-activity.jsonl
Quality check references
Dictations you marked as references for quality checks.
~/Library/Application Support/Voqela/quality-fixtures.json
Quality check results
What each quality check you ran measured.
~/Library/Application Support/Voqela/quality-runs.json
What leaves this Mac
1 network operation has been recorded since recording began on 12 July 2026. It was a speech model download from huggingface.co.
No other code in Voqela can reach the network: a build check refuses any connection-capable code outside that one download, so a quiet upload cannot be added without failing the build.
A file leaves this folder only when you export it, as a transcript export or a vocabulary backup, and it goes where you choose, when you ask.
Permissions
Microphone records your speech for local transcription. Accessibility reads which field has focus and puts the text into it. Input Monitoring notices your global shortcut.
Each is explained before the system prompt appears and each has its own button. Any of them can be revoked in System Settings; a denial leaves your work intact and tells you what to do next.
Diagnostics
Diagnostics record operational state and timings, never audio, transcript text, clipboard contents, or the contents of the field you were typing in.
Retention and deletion
History has an explicit Delete. A capture whose delivery is verified is consumed; a cancelled capture gets a tombstone; pending or unverified work stays recoverable rather than being quietly discarded.
A documented retention policy, uninstall instructions, and a delete-all-local-data control are still open decisions. Until they exist this page promises no retention period and no single-control erasure.
Network behaviour
There is no update mechanism in the build today. If updates, analytics, crash reporting, payment, or licensing are ever added, this document and the application's own log of network purposes both have to change first, and the log is the harder one to fake.
The claim ledger
Every substantive claim on this website is listed here with the boundary it has to stay inside. It is published as claims.json so it can be read by a machine as easily as by a person.
supported Voqela is built for Apple silicon Macs running macOS 14 or newer, and transcribes English.
Boundary: Do not imply Intel, iPhone, iPad, Windows, or multilingual support.
supported Transcription runs on this Mac through a local Parakeet Core ML model loaded by FluidAudio.
Boundary: Model acquisition uses a public model host when the model is absent.
supported Microphone audio and transcript text have no cloud transcription path.
Boundary: Do not broaden this into an audited security guarantee.
supported Voqela has no account and no telemetry path.
Boundary: Recheck before launch if analytics or an update mechanism is added.
qualified The one network operation in this build is the one-time download of the speech model from its public host.
Boundary: Required qualifier wherever privacy is claimed. Never say zero network, no network connections, fully offline, or 100% private.
qualified Once the speech model is on your Mac, Voqela works with no internet. That is how it is built: the model is a file on your disk, your own chip runs it, there is no cloud transcription path, and a build check fails on any connection-capable code anywhere in the sources outside the single model-download seam. It is also observed. Transcription was watched succeeding with the network denied at the kernel level, zero bytes downloaded, on named hardware, on 2026-08-03.
Boundary: Two boundaries are required wherever this is used. First, acquiring the speech model needs a connection once, so the one-time download must be named and fully offline from first launch stays prohibited. Second, the observed run covers the decode path through the product command line against a retained recording, not microphone capture: the full dictation loop with no network is not yet observed, and one attended airplane-mode dictation is the remaining step. Never the bare works offline, fully offline, zero network, or no network connections.
supported Settings carries an append-only, content-free local log of every network operation the app has ever started, with no cap, no filter, no toggle, and no clear button.
Boundary: It records what Voqela itself does. It does not describe the rest of the Mac.
supported A build check fails on any connection-capable code anywhere in the sources outside the single model-download seam.
Boundary: This is a build-time structural check, not a third-party security audit or certification.
supported Settings shows every file Voqela keeps on this Mac, with the real path on that install, and a Show in Finder control on each row.
Boundary: It is a view. It adds no delete-all control and makes no retention or deletion promise.
supported A file leaves that folder only when the person exports it, and it goes where they choose, when they ask.
Boundary: Export is user-initiated. Do not imply any automatic sync or backup.
supported Every dictation is kept on this Mac as your own record: History is a searchable local list with Copy, Retry, and an explicit Delete, one transcript exports as a plain text file, and the whole history exports as one JSON archive in a declared order with stable bytes, so two exports can be compared.
Boundary: Export is user-initiated and writes only to a destination the person chooses. It adds no retention promise, no deletion promise, and no sync or backup of any kind.
supported A local voqela command line reports the installation's status, its settings, its per-application rules, its diagnostics, and where every file it keeps lives, and every read verb speaks JSON.
Boundary: It never prints transcript text, dictated audio, clipboard contents, or history, and it adds no second export path. Do not describe it as a way for an assistant to read your dictations.
supported One customizable global shortcut, Control-Option-Space on a fresh install, works as hold-to-talk or press-to-toggle.
Boundary: Physical global-shortcut behavior still awaits attended proof.
supported A transcript is saved locally before insertion is attempted.
Boundary: Field delivery in every application still awaits attended proof.
qualified Captured audio is journaled locally while you speak, and work found after an interruption waits behind an explicit Recover Dictation action.
Boundary: Approved wording: deterministic process-death tests recover the exact committed prefix. Never never loses work, crash-proof, or guaranteed recovery.
supported History is a searchable local list of transcripts with Copy, Retry, and explicit Delete.
Boundary: Visual polish and cross-app behavior await attended proof.
supported Automatic Return is optional, off by default, and only fires after insertion is verified.
Boundary: It can submit content, which is why it ships off.
supported Your vocabulary is a local list of words with a written form and optional spoken forms, applied to whole-token spans.
Boundary: It is a deterministic text rule, not model training. Do not imply the model learns or adapts.
supported Local learning suggestions propose vocabulary rules from your own corrections, are off by default, and never change output until you approve one.
Boundary: Not fine-tuning, no upload, no background decoding of retained audio, nothing applied automatically.
qualified Voqela learns the words you use: a correction becomes a proposed vocabulary rule, and an approved rule writes that spelling in every dictation after it, including the names and the dialect a general model has never met.
Boundary: The learning is the suggestion system plus the list you approve, both deterministic text rules applied after the decode. Nothing about the speech model changes. Never learns your voice, adapts to your voice, trains on your voice, or fine-tuned to you.
qualified The complete recording is decoded in one pass; on the retained fixture the beginning, the negation, and the ending were all present.
Boundary: The fixture is generated synthetic English audio and scored three of six protected spans exact. Never state an accuracy rate and never imply nothing is ever missed.
supported Rendering is a set of exact, bounded text rules: no option infers tone, emotion, or intent, and the Verbatim profile leaves output byte-identical to the decode.
Boundary: It describes the rendering stage. Correct Last and Improve Last are actions a person presses; do not present automatic cleanup, summarising, or rewriting as a feature.
qualified Voqela is designed to insert into standard Mac text fields.
Boundary: Name only applications actually accepted in the attended matrix. Never works everywhere or works in any app.
qualified Voqela types where you already type: it is pointed at the cursor rather than at an application, so it inserts into the field that had focus in whatever you were in, the way a paste does. Per-application rules can change how it behaves in one place without changing anywhere else, and an application that refuses the insertion costs you nothing, because the transcript is already saved in History.
Boundary: Describe the mechanism (it is aimed at the focused field) and never a coverage guarantee. Insertion is attempted once and then verified, never forced or reposted. Describe kinds of place, never a named application, until that application is accepted in the attended matrix. Never works everywhere or works in any app.
qualified Voqela is designed to restore the clipboard only while it still owns it.
Boundary: Live cross-app proof is pending. Never preserves your clipboard, unqualified.
qualified A retained 10.25-second fixture decoded in 0.071 seconds after model preparation; warm decodes in the repository were previously observed between 0.075 and 0.094 seconds.
Boundary: The fixture is generated synthetic English audio. It is not a natural-voice, microphone, perceived-latency, or field-delivery receipt, and it must be published with that sentence beside it. Never instant or zero latency.
qualified The downloaded model artifact occupied approximately 595 MB on the Mac it was measured on.
Boundary: Report it as a measurement on one machine. Onboarding states approximately 595 to 614 MB for the current model.
supported Voqela asks for Microphone, Accessibility, and Input Monitoring, each explained before the system prompt.
Boundary: A denial must leave user work intact. Do not imply the permissions can be skipped.
supported The product is a menu-bar application: a compact popover with a recording overlay and six fixed action tiles, plus a Settings window.
Boundary: The rendered look has not been visually accepted yet, so site illustrations must be labelled as illustrations, never presented as screenshots.
supported Sound cues mark the start and the end of a dictation, and a distinct cue fires only on a real failure.
Boundary: Cues can be turned off in Settings. Do not describe them as spoken feedback.
supported You can pin one microphone by its stable identifier, and Voqela refuses honestly when that device is absent instead of silently substituting another.
Boundary: The default remains the system default input.
qualified macOS custom vocabulary is part of Voice Control, an accessibility feature, rather than part of Dictation, and Apple's newer on-device speech framework has no documented custom-vocabulary surface where the older one carried contextual strings.
Boundary: A factual difference in what each tool exposes, read from published Apple support and developer documentation plus one developer analysis. Never a speed, accuracy, or quality comparison against Apple, and never a claim that Apple has stated the absence itself.
supported Price, availability, and distribution are not decided, so the site publishes none of them.
Boundary: No price, no launch date, no App Store promise, no free-forever promise, no update policy, no source-availability promise.