What should a dictation app's privacy policy tell you?

A dictation app's privacy policy should tell you four things in plain words: how long your audio and text are kept, whether they train AI models, who can review them, and which vendors or AI models receive them. Many policies answer those questions under headings such as "data retention" and "how we use your data", so search for those words first. If the answer to any of the four is missing or vague, treat the product as not yet checked.

Start with how long audio and text are kept

Retention is the first question, and the EU gives a useful yardstick. Under Article 13(2)(a) of the GDPR, a controller must tell people, when their personal data is obtained, how long it will be stored, or if that is not possible, the criteria used to set that period ¹. A policy that serves EU users should therefore give a period or a criterion. If yours gives neither, that is an answer too.

Periods vary widely. Microsoft says it stores Copilot conversation activity for 18 months by default, and that you can delete individual conversations or the whole history at any time ². A policy that says "as long as necessary" without a period gives you less to rely on than that.

Check whether your words train AI and who reads them

Training and human review are separate questions, and a clear answer to one does not answer the other. Apple says that for people who opt in to Improve Siri and Dictation, only its own employees, under strict confidentiality obligations, can access the audio ³. That is a limit on who reads the audio, but it still depends on the opt-in.

Training needs its own wording. Anthropic says that in its mobile apps it deletes the audio after converting speech to text, and does not keep a copy of the speech or use it for training ⁴. Compare that with a policy that says the company "may store" data. Aqua Voice says that for users with Privacy Mode turned off, it may store transcript data on its servers to improve the product ⁵. "May" is the word to notice, and it means the setting decides.

Name every company that receives your words

A cloud dictation app can pass your words through more than one company. Wispr Flow's intelligence was described in a June 2025 report as based on a mix of Meta's Llama and OpenAI's Whisper models ⁶. A policy should name those providers, or say clearly that it does not share text with a model provider. Check the sharing section for the words "service providers" and "third parties", and then ask which ones handle audio or text.

Deletion is the other half of the storage answer. Wispr Flow says it deletes your audio as soon as it has been transcribed, unless you have turned on its Dictation cloud storage setting ⁷. The policy has to say what the setting is called and where it sits, so you can check it.

Read the keyboard and account sections too

A third-party keyboard is a separate exposure. Apple warns that if you enable Full Access for a third-party keyboard, its developers are permitted to access, collect and transmit the data you type ⁸. Read the glossary entry on Full Access before you turn it on for a dictation keyboard.

Your account type matters as well. A policy written for a personal account may not describe the rules for a work or school account, so read the section that matches the account you use.

A checklist you can run on any app

Table 1. Four questions for any dictation policy

1. Find the storage section and write down the period or the criterion.
2. Find the training and review sections and note the default, not only the opt-out.
3. Note each named provider in the sharing section.
4. Check the setting names in the app and confirm they match the policy.
5. If the content is regulated, ask the vendor for a written commitment, such as a business associate agreement, before you send it anything.

Use this list with the question on whether AI dictation apps send your words to a language model, which goes deeper on the model step. The question on how to delete voice recordings covers the controls for the big platforms. For a company policy rather than a personal one, see the question on what a company dictation policy should include.

The guide to whether voice to text is safe puts these four questions in the context of the airplane test and platform settings. A policy answers what the company says it does. The airplane test and the settings show what the app does, so use both. Run the same check on Yap, which we make, before you rely on it.