Plain words about your data.

The app, in local mode (the default)

When you hold the shortcut, audio is captured from your microphone and kept in memory and, unless Do not keep is selected, in a short-lived journal file while the dictation is processed. In Local mode, transcription and cleanup run on your Mac. No audio or transcript is sent to a provider.

What the app keeps on your Mac, and for how long

Text history. The raw transcript and the final text of each dictation are stored in Application Support. The default is Forever. You can choose 30 days, 7 days, or Do not keep, which holds text in memory only until the app quits and writes no transcript file.

Recordings folder. By default, every dictation is also saved, failed ones included: the audio as a WAV file, the raw transcript, the final text, and a small metadata file with the engine, microphone, timings, outcome and the name of the app you dictated into. From version 1.2.2, new recordings are saved in Rambleproof's own folder in your Library, ~/Library/Application Support/Rambleproof/Recordings. iCloud Drive, Dropbox, OneDrive, Box and similar services do not sync that folder. History uses these files for playback and retry. The folder carries a marker that asks Spotlight not to index it, so dictated text stays out of search on setups that honor the marker. Turn this off in Settings under History and Privacy, or choose Do not keep, and nothing more is written there.

Versions before 1.2.2 saved recordings in Documents/Rambleproof/Recordings. Rambleproof never moves or copies them, and reads one only when you play or export it or delete your data. If iCloud Drive or another service syncs your Documents folder, those older recordings stay synced until you delete them. If you choose cloud transcription, audio is sent to your selected provider, including when you retry a recording.

Journal audio. The short-lived journal audio of a completed, copied or cancelled dictation is deleted as soon as processing finishes. Audio from a failed dictation is kept for 24 hours so you can retry it; this is on by default and can be turned off. A recording interrupted by a quit or a crash is protected for 14 days so it can be recovered.

Dictionary. Your terms live in a local file in Application Support. If you choose cloud processing, enabled terms can be included as vocabulary hints for transcription or as context for cleanup. With local processing, they stay on this Mac unless you turn on dictionary sync.

Dictionary sync (off until you turn it on). Dictionary sync is part of Pro and stays off on each device until you turn it on there. While it is on, a copy of your dictionary is stored with your Rambleproof account so your devices can share it: your words, their heard-as spellings, your replacements and the suggestions you dismissed. Each entry carries when and how it was added; for an entry Rambleproof learned from your corrections, that includes the internal numbers of the dictations it was learned from, never their text. The copy is encrypted in transit and at rest and is used only for syncing. It is deleted when you turn sync off on your last device, disconnect that device, or delete your account.

Settings under History and Privacy has two delete actions. Delete all history removes every dictation and all saved audio, including this Mac's recordings in the Library. Delete all Rambleproof data is the full reset: history, recordings, dictionary, settings, saved API keys, any license, the login item and, if you choose, the downloaded models. The app returns to its first-launch state. Older recordings in Documents are removed as before: Delete all history removes Documents/Rambleproof/Recordings and the full reset removes Documents/Rambleproof. If iCloud Drive or another service syncs your Documents folder, it can hold recordings from your other Macs, so both remove only the older recordings this Mac's own History points to unless you tick "Also delete older recordings in Documents" when you confirm.

Clipboard and recovery

With Keep a copy after insertion off, Rambleproof restores your previous clipboard after pasting. When a desktop or another control is known not to accept text, your dictation is always copied so you can paste it elsewhere. Secure fields and uncertain destination changes still honor the clipboard preference. An explicit Copy action also leaves the text on the clipboard. These copies may be available to clipboard managers and macOS Universal Clipboard.

While a recovery notice is visible, the app passively checks for Command-V using its existing Accessibility access. If its text still owns the clipboard, that shortcut dismisses the notice; it does not confirm insertion. This observer does not record typed characters or read the destination field. Menu-only Paste uses the notice's ordinary timeout.

Learning from your corrections (on by default)

After inserting text, the app watches the one editable field it inserted into for up to two minutes, to notice when you fix a word it got wrong. To do that it reads the text of that field, locally and in memory only, and discards it when the field loses focus or the two minutes end. Only short pairs of what was inserted and what you typed instead are kept, as suggestions you can review or dismiss. Password and other secure fields are never watched. Turn this off in Settings under History and Privacy.

What the app notes about where you dictate

The name and identifier of the app you dictated into are stored locally with each dictation, so History can show them and the Recordings folder can be named by app. When app-aware formatting is on, the site host of a supported browser is inspected locally to pick a writing style. The host is not stored and never sent to a provider. The app does not read window titles and does not take screenshots.

What leaves your Mac in local mode

Nothing about your dictations is uploaded by account linking. In versions that support it, linking a Mac sends its installation identifier, app version, build, reported plan, preview start and last check-in time to your Rambleproof account. These small updates wait on the Mac while offline and retry later. They contain no audio, transcripts, dictionary entries or names of apps you dictate into. Dictionary sync is separate: a copy of your dictionary is sent only from a device where you turned it on, as described above. Existing installations continue working without linking an account.

Bring-your-own-key cloud mode (off until you turn it on)

When a paid plan enables bring-your-own-key cloud processing, you add your own API key for OpenAI, OpenRouter or Google Gemini. Cloud transcription sends the audio and up to 60 of your enabled dictionary terms as vocabulary hints. Cloud cleanup sends the raw transcript, your formatting preference and up to 120 enabled dictionary terms. Each stage is chosen separately, so you can keep one local and send the other. Keys are stored in macOS Keychain and requests are made by the Mac app, not proxied through a Zena Labs LLC service. Provider terms apply. OpenRouter cleanup is used only on a zero-data-retention route; if none is available, the app falls back to local cleanup. When a cloud request is slow or fails, Rambleproof can use a local fallback.

Model downloads and updates

Downloading a local model or checking for an app update contacts the host that serves the files. Those requests carry no personal data beyond what any web download carries (your IP address and the file you asked for).

The app checks for updates once a day and shows a quiet reminder. Updates download and install only when you choose, then restart the app while keeping your settings and history. Check for Updates is in General and Advanced Settings. You can turn off daily checks under Advanced. The check sends the app version and your macOS version.

Feedback you send from the app (Feedback in the sidebar, or Report a problem on a dictation) leaves your Mac only when you press Send. A report contains your message, the app and macOS versions, your processing settings, your dictation key setup (which keys you chose, whether macOS lets Rambleproof watch them, the app's own recent notices about them and, from version 1.2.3, the name of the app that has, or recently had, secure keyboard entry on, never what you type) and, for a reported dictation, its engine, microphone, target app, timings and, when it was not pasted, which rule or step prevented it. The transcript is included only while the Include the transcript switch is on. You can also attach up to five screenshots, review them and remove them before sending. Attached images are resized and their image metadata is removed. The app never captures your screen automatically. When you report a problem with a saved dictation, its recording is included by default as a compressed copy. You can listen before sending or choose “Don’t include recording” to leave it out. Nothing is uploaded until you press Send. It may include background voices. Attached recordings are held privately with the report for troubleshooting; they are not published or included in analytics. Reports are stored in our Supabase database in the United States, with an Upstash recovery buffer during database outages, and read byZena Labs LLC to fix problems and plan features. An email address is optional and used only to reply to you.

Plans and license checks

The weekly Free cleanup counter itself is kept on the Mac; a linked Mac reports only the counts below. A linked Mac reports its app version, plan and preview start, the date of its first dictation, and for this week and last week how many dictations it made. From version 1.1.1 it also reports, for the same two weeks, how many words those dictations contained and whether the Mac reached the Free weekly AI cleanup limit. These are counts only: never the words themselves, the audio, or which apps you dictated into. They tell us whether people actually use Rambleproof and whether the Free allowance fits how people dictate. Counting works offline; the numbers are sent at most about once a day when the Mac is online. After you choose Get Pro in the app, a linked Mac may send up to three extra reports in the following 15 minutes, so a purchase is noticed sooner. While a linked Mac has no license, the reply to its report can include the license key of a purchase on your own account, so the app can turn Pro on without you pasting the key. From version 1.2.2, while a linked Mac reports a subscription, the reply can include a one-way fingerprint of a subscription key on your own account whose purchase has ended (for example after a refund), never the key itself. If it matches the key on that Mac, the app checks that key with the license service right away instead of at its next 14-day check. The Mac sends nothing new for this. When your account has no active subscription left, the reply can also include another license key of your own account (for example Pro given to you by Rambleproof), so Pro continues without a gap. While a linked Mac is on Free or the Pro preview, opening its main window or Plans & billing (and, from version 1.2.3, opening its menu bar popover or waking the Mac) can send its usual report early, at most once an hour in total, so a purchase made on another Mac or on the website shows up within seconds. New installations of account-enabled versions activate once through a verified account or license key. A saved activation continues to work offline if the account service is unavailable. Older installations keep their existing access.

Pro subscriptions check their license with moelueker.com every two weeks and send only the license key. The response contains entitlement status, not dictation content. If the service cannot be reached, the app allows a 30-day offline grace period. An expired or cancelled entitlement returns to Free and never locks dictation.

Lifetime and gift keys are verified offline with an Ed25519 signature. Those keys are never sent to a license server. A gift key may contain its own expiry date.

This website

We combine the account and usage counts described above into totals for active accounts, dictations, words, repeat use, purchases and acquisition channels. We send these aggregate totals to PostHog for our product dashboard. They contain no account or installation identifiers, email addresses, individual purchase records, audio or dictation text. This does not add reporting to the Mac app.

This site uses PostHog and Google Analytics 4 to understand visits and public-page interactions. They use first-party analytics cookies; PostHog also uses browser storage. Advertising personalization and Google signals are disabled. Where we use opt-in, it stays off until you choose “Accept analytics”. In other supported US regions it runs by default, and you can turn it off in Analytics preferences. Unknown locations use opt-in. Sign-in uses secure cookies to keep your own account available. Visiting a referral link sets a first-party referral cookie for up to 30 days to attribute a later signup; it is not used for cross-site advertising. If your browser sends Do Not Track or Global Privacy Control, our optional website analytics do not run.

Page measurements record the page, referring site, country code and any campaign tags in the link you arrived on (such as utm_source=youtube). While analytics is allowed, the browser also remembers that first campaign tag and referring site name, and sends it with a sign-up, a download-link request or a waitlist entry, so we can see which channels bring people. No other page history is kept with your account. The IP address is not recorded in our server-side analytics events. Our PostHog events contain no email addresses, license keys, audio or dictation text. Download, form and demo events record outcomes rather than the submitted content. Account and billing records are stored separately in Supabase. PostHog processes site measurements in the United States. Google Analytics receives public page views, campaign sources, demo outcomes and installer-link clicks, plus browser/device information and approximate location. Google processes this information on its infrastructure. We do not send account identifiers, email addresses, audio, dictation text or private-page URLs to Google Analytics.

When analytics is enabled, PostHog uses first-party cookies and browser storage to recognize returning visits and record clicks, scrolling and navigation on public pages. Both services’ analytics cookies last up to 180 days. Your choice is saved for up to 180 days in this browser. “Necessary only” turns off optional browser and website event analytics. Inputs and demo text are masked; audio, account pages, payment pages, console logs and network request bodies are not recorded. You can decline or withdraw permission at any time using Analytics preferences at the bottom of a public page. Basic measurements include visible page time, scroll depth, demo attempts and download-flow outcomes, never the content you type or dictate.

With website analytics enabled, we also send unexpected public-page errors to PostHog. We replace error messages with fixed categories and keep only application code locations, never the message, content you entered or a request body. Private account pages and HoverSpeech pages are excluded from browser error capture. Our server separately records anonymous service outcomes and error categories to find broken downloads, account updates, checkout and demo requests. These contain no request address, account identifier, cookies, submitted content or private URL. Do Not Track and Global Privacy Control stop this request reporting too. These measurements do not automatically collect Mac crashes or failed dictations; in-app problem reports still require you to press Send.

For the optional live demo, your clip is sent to a speech service for transcription (Deepgram, or Gladia or OpenAI as a fallback) and its transcript to a cleanup model (Google Gemini, or OpenRouter as a fallback). The site does not intentionally persist either. Providers process the data under their terms. Built-in examples require no microphone.

To download, you sign in to a free account with Google or with a code sent to your email (see Accounts below). Each installer handed to a signed-in account is recorded with the date and release, so we know who downloaded and when. It does not prove that the transfer completed or that you used the app. Downloads through the earlier six-digit download codes were recorded the same way; Upstash held those codes for up to 10 minutes.

Not on a Mac? You can ask us to email a download link instead. Resend delivers it. We keep the address, your optional product-email choice and when the link was first opened. The link works for 7 days; opening it on a Mac records a verified download like the one above.

Clicking that you want Rambleproof on Windows (or another platform) stores the platform, the date, your answer to whether you would pay for Pro there if you give one, and the first campaign tag described above. No email and no IP address is kept with it; this browser remembers the vote so it is not asked for again. The waitlist keeps your email, the platform, that answer and the date you joined, so we can measure demand and write to you when it launches. Ask through the contact form and we remove you.

If you are signed in and open the download page on Windows or Linux, we note that platform and when we last saw it with your account, even if you do not join the waitlist, so we know how many people want those versions. It is read from your browser's user agent; nothing else about your device is kept.

In-app feedback reports are held in Upstash until our database has them, then removed from Upstash. Marketing choices made before accounts existed remain on the earlier Upstash list until you unsubscribe.

Accounts, billing and email choices

Supabase Auth verifies email codes and Google sign-in for your account. We retain your verified email, linked installation details, purchase references, license keys and email choices to provide account access and support, and the copy of your dictionary while dictionary sync is on. Stripe processes payments; we do not store card numbers. Resend delivers verification and account emails.

When you press Link this Mac on the website, we keep a fingerprint of a one-time link with your account, never the link itself. It works once, within five minutes, and is deleted after it expires, at the latest when the next Mac is linked this way. For each Mac newly linked to your account, that way or with the code the app shows, we email you a security notice, at most three an hour: which kind of Mac it was (such as MacBook Air, with its macOS version, when the app sends them) and when, with a link to your Macs, where you can disconnect it. It is sent whatever your email choices are, but not to an address that bounced or complained, and the email is kept with its delivery record.

For Teams, we also keep the organization name, membership roles, seat assignments, invitations and administrative activity. Team owners and admins can see members' email addresses, assigned access, latest reported app version and the day it was last reported, whether a member has linked a Mac, and whether each member dictated this week. Once at least three members have dictated in a week, they also see the team's total number of words and dictations for that week, added up from the weekly counts described above, which include yours; with fewer, only how many members dictated. They never see one person's own count. A team's invite link lets anyone who opens it and signs in join that team while it has a free seat; we keep how many people joined with it and record each join in the team's activity. Billing details are limited to owners and admins with billing permission. A team can keep a team dictionary: the list of words and replacements its owners and admins enter is stored encrypted with the team and sent to the linked Macs of members who hold a seat. Nothing from a member's own dictionary goes to the team. Joining a team does not give it access to your audio, dictations or personal dictionary, or subscribe you to marketing. Leaving a team does not delete your personal purchases or local files.

Downloading or signing in does not subscribe you to optional email. Getting-started emails and product news or offers each have a separate choice. Getting-started email is limited to one welcome and one reminder before the 14-day Pro preview ends. Optional emails include an unsubscribe link and one-click unsubscribe support. Change choices at any time in email preferences. Verification, purchase and necessary security messages are separate from marketing. Bounces and complaints suppress optional delivery.

We keep account and support records while needed to operate your account, resolve feedback and meet applicable obligations. You can delete your account yourself in your account settings or in the iPhone apps; it is deleted at once on every device, and purchase records are kept for accounting without your name or email. Minimal suppression and consent records may be retained to honor your choices. Delete all data in the Mac app resets local files and the app link; it does not delete your website account or purchases.

Cloudflare Turnstile helps protect browser email and download requests from bots. It processes browser and network signals for that check. It is not used inside local dictation or the app's background reporting.

Contact messages are delivered to the Zena Labs inbox through Resend. The message, your email and optionally your name are used so we can read and answer what you sent, and for nothing else.

The site is hosted on Vercel, which keeps standard server logs (IP address, time, requested path) for a limited time to operate the service.

Our analytics, when enabled for the visit, count installer requests and verification outcomes using a random identifier for one download attempt. The separate verified downloader list holds your email as described above. Neither source proves a completed installation. Vercel keeps standard operational server logs separately.

Rambleproof checks this site once a day for updates. That check is counted, with the app version the app reports and a country code. These are update requests, not a count of unique people or dictations. Every check shares one identifier, so individual installs are not distinguished and nothing links one day’s check to the next.

Your choices and rights

You can ask to access, correct or delete personal data we hold, object to its use, or withdraw marketing consent. Use the contact form. These choices do not affect the lawfulness of processing that already happened, and mandatory rights in your country still apply.

Permissions the app asks for

• Microphone, to hear you while a dictation you started is active, including hands-free mode. Otherwise the microphone is off.
• Accessibility (called Device Control and Data Access on macOS 27), to insert text at your cursor, to check that the focused field is not a password field, and, while learning from corrections is on, to read the one field it just inserted into. Rambleproof refuses to insert into secure fields.
• Documents folder access, which macOS may ask for when Rambleproof reads a recording that a version before 1.2.2 saved in Documents: when you play or export one, or delete your data. New recordings are saved in the Library and need no extra permission.

Who we are

Rambleproof is made by Zena Labs LLC. Questions about this page: contact us.

Last updated: 15 October 2026.