In memory
Audio is captured while the hotkey is active, transcribed locally, then discarded.
Privacy
Privacy model
Presspeech transcribes locally: it has no Presspeech-operated analytics service, accounts, crash reporter, transcript sync, or cloud transcription endpoint. However, the published Windows 0.1.12 prerelease does not disable Hugging Face Hub/Transformers usage telemetry during model downloads; see the model-download entry in the network inventory below. That dependency-generated telemetry is not audio or transcript upload. Hugging Face documents default telemetry from some libraries, each with its own policy, in the Hub 1.29.0 telemetry guidance. The pinned Windows 0.1.12 Hub 1.29.0 client may also look up its agent-harness registry when the local cache is missing or stale and may label model-request metadata from inherited agent markers; details are in the inventory below. The release loader also leaves Hugging Face's default implicit authentication enabled: if HF_TOKEN or HUGGING_FACE_HUB_TOKEN is available in the environment, or a token is saved in the local Hugging Face cache, a model request may include it. It honors inherited HF_ENDPOINT and HUGGINGFACE_CO_STAGING settings, which can change the request destination; if HF_HUB_USER_AGENT_ORIGIN is set, its value is added to request metadata. An available token may therefore accompany a request to that configured endpoint. Both published Windows 0.1.12 and upcoming Windows 0.1.13 use HTTPX 0.28.1 with the Hub client's default trust_env=True; it honors HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, NO_PROXY, SSL_CERT_FILE, and SSL_CERT_DIR. A TLS-inspecting HTTPS proxy whose CA is trusted by the client can read request headers and any 0.1.12 token; a tunnelling proxy sees connection metadata, not request contents. Upcoming 0.1.13 still honors proxy and CA settings but disables account-token authentication. These public models do not require an account token. Hugging Face’s Hub authentication guidance explains that saved or environment-provided tokens are used implicitly by default. Its release source pins hf-xet 1.6.0, which predates the later separate Xet transfer-telemetry implementation; we do not claim that 0.1.12 sends those Xet reports. Upcoming Windows 0.1.13 adds runtime-verified Hub telemetry and implicit-authentication opt-outs, fixes the public endpoint/staging settings, removes the inherited User-Agent origin, and bypasses hf-xet; do not attribute these controls to 0.1.12.
Windows 0.1.12 package vs. launch: downloading the installer and checksum from GitHub does not make a model request; the selected model download starts when Presspeech launches. If you prefer to avoid this possible usage telemetry, are concerned that a token or custom route may be configured, or are unsure, wait for 0.1.13 before launching. If you install 0.1.12 but choose to wait, leave Launch Presspeech unchecked on the installer's final screen. It starts checked by default; clear it before choosing Finish. If a TLS-inspecting HTTPS proxy is configured and its trust is unclear, do not launch 0.1.12 while it is in use; upcoming 0.1.13 still honors proxy and CA settings, though it does not send an account token.
Already used Windows 0.1.12? If a model download ran with a token available and an inherited HF_ENDPOINT or staging setting may have sent it to a destination you do not trust—or an untrusted TLS-inspecting HTTPS proxy could read the request—treat the token as disclosed to that destination or proxy. A proxy that only tunnels HTTPS cannot read the token. Revoke the token and create a replacement at Hugging Face Access Tokens; do not include token values in logs or support requests.
Before installing or launching macOS 0.3.8: its model-download requests may include a Hugging Face token inherited by Presspeech, although the public model needs no token. If a token may be present in the environment that launches Presspeech—or you are unsure—choose macOS 0.3.9 after reviewing its launch decision. The pinned FluidAudio client also honors inherited lowercase https_proxy and http_proxy settings; HTTPS model requests can travel through the configured HTTPS proxy (see its pinned session configuration). A TLS-inspecting proxy trusted by macOS can read any 0.3.8 token it receives; a tunnelling proxy sees connection metadata, not the HTTPS request. If the trust of a TLS-inspecting proxy is unclear, do not launch 0.3.8 while it is in use. From 0.3.9, Presspeech removes inherited account-token authentication but still honors proxy settings. Downloading the macOS ZIP from GitHub does not make a model request; the first download of a missing model starts when the app launches, so you can keep the downloaded app unopened while waiting. Dictation audio and transcripts are not sent in these requests. From macOS 0.3.9, Presspeech removes inherited Hugging Face credentials from its own process before FluidAudio can read them. See the version-specific network inventory.
Already used macOS 0.3.8? The concern is limited to a possible Hugging Face token on a model-download request; dictation audio and transcripts are not included. If a 0.3.8 model download ran with an inherited token and an untrusted TLS-inspecting HTTPS proxy could read the request, treat the token as disclosed to that proxy: revoke it and create a replacement at Hugging Face Access Tokens. A proxy that only tunnels HTTPS cannot read the token. If your local model is working, leave its cache in place. A later download—including an integrity retry or cache reset—may make another request. When you can choose the timing, wait until 0.3.9 is installed before downloading again; it removes inherited Hugging Face credentials from Presspeech's download process. Do not include token values in support reports.
What happens to the audio
Transcript handling
Paste at cursor
The finished text normally goes through the platform clipboard and a synthetic paste shortcut. On macOS, Presspeech falls back to direct Unicode key events if clipboard paste setup fails.
Clipboard persistence
Each recording is bound to the window focused when it began. If focus changes or Presspeech cannot verify the same destination, it avoids automatic paste rather than risking delivery to the wrong window. On macOS, it leaves the transcript on the pasteboard for deliberate manual paste. In macOS 0.3.8 and later, the off-by-default Keep Previous Clipboard for Manual Restore option keeps an eligible complete previous clipboard snapshot only in memory for up to five minutes. A snapshot is limited to 64 MB and 256 representations; no partial snapshot is offered when a limit is exceeded or a representation is unavailable. Consecutive dictations keep the original deadline. It restores only after you choose Restore Previous Clipboard…, verify the paste arrived and confirm, while clipboard ownership still matches. Expiry, another copy, disabling the option or quitting discards the saved snapshot without rewriting the clipboard. The retired automatic timer preference does not enable this retention option. Confirmation is a user decision, not an operating-system acknowledgement. See the recovery guide. Builds containing local-only transcript clipboard writes mark automatic-paste, recovery, recent-transcript and scratchpad copies as current-device-only and transient while keeping them available to local Command-V. They retain every item and representation when restoring a previous clipboard, but republish the snapshot for the current device only because its earlier cross-device scope cannot be recovered. Published Windows 0.1.12 leaves a copied transcript on the current clipboard until something else is copied. Upcoming Windows 0.1.13: unsuccessful or uncertain delivery keeps a recovery copy in process memory until an explicit verified Copy, Discard, or Exit; an already-known missing, unfocused, or elevated target does not replace the previous clipboard item. The keyboard-accessible Delivery Recovery window does not display or implicitly copy the words; a blocked hotkey or another launch only brings the window back. Depending on where delivery became uncertain, text may already be in the field or clipboard. Check the intended field before copying; do not paste an unrelated previous clipboard item. Recording waits for review. Every Presspeech transcript clipboard write—including normal delivery, recovery, and Copy or Cut from Try Dictation—first adds Microsoft's history/cloud exclusion format, so Windows is instructed not to retain or sync the item through Clipboard History or Cloud Clipboard. The current item remains available to Ctrl+V and other local clipboard readers; no transcript contents are written to logs, settings or recovery files.
Operating-system clipboard services
“No transcript sync” describes Presspeech itself, not every service that monitors the general clipboard. On macOS 26 or later, enabled macOS Clipboard History in Spotlight makes earlier copied items searchable; Apple notes that sensitive information may appear there and provides Clipboard → More → Clear History. With Handoff enabled, macOS Universal Clipboard can make general pasteboard content available on nearby Apple devices. macOS 0.3.8 can expose transcript entries to that service. Builds containing local-only transcript clipboard writes use Apple's currentHostOnly option for every transcript write, preventing Universal Clipboard transfer of those entries while preserving local paste. Standard transient, auto-generated, and concealed markers ask cooperating clipboard managers not to archive or visibly expose the entries, but macOS Clipboard History, Third-party clipboard managers that ignore those advisory markers, and other local readers remain separate boundaries. Published Windows 0.1.12 writes can be retained by Windows Clipboard History or synced through its cross-device setting. Upcoming Windows 0.1.13 uses Microsoft's documented clipboard exclusion format to opt every dictation write out of both services. Review local clipboard software and operating-system history settings before sensitive dictation.
Remote Mac sessions are a separate boundary. Apple's Screen Sharing guide documents Edit → Use Shared Clipboard for transferring copied text between Macs and says Universal Clipboard is unavailable during an active Screen Sharing session. Presspeech's current-device-only transcript writes are not a tested guarantee against Screen Sharing's separate shared-clipboard feature. Turn that feature off if you do not intend to transfer dictated text to the remote Mac; use a disposable field to check remote paste behavior before relying on it.
Windows remote sessions are another boundary. Presspeech uses a redirected clipboard for Microsoft Remote Desktop and Moonlight's client-side clipboard-typing shortcut for Moonlight. Either route can deliver dictated text to the remote host even though Presspeech has no cloud transcription or transcript-sync service. RDP text transfer depends on client and host clipboard-redirection settings. The Windows Clipboard History and Cloud Clipboard exclusions are not a documented guarantee about either remote route; qualify remote behavior separately. Use only a trusted, disposable remote field for a first test, and turn off remote clipboard redirection when you do not intend to make local clipboard text available to an RDP session.
No transcript logs
Logs include operational status, error categories, timings, and counts. Presspeech does not write transcript, audio, or dictionary/correction contents to the log. macOS 0.3.8 and Windows 0.1.12 can log exact audio-device labels; builds containing microphone log minimisation omit those labels from app-authored microphone events. Some operating-system or library errors elsewhere in the local log can still contain private names or paths, so review any excerpt before sharing it.
Five call types, fully listed
Network calls
This is the complete network surface of Presspeech itself and its install/update path. Operating-system clipboard sync and third-party clipboard managers are separate services described above.
Windows in-app updater proxy boundary: its automatic or manual GitHub release check and user-approved installer/checksum downloads use Python urllib.request. Python's proxy handler honors inherited https_proxy/HTTPS_PROXY and no_proxy/NO_PROXY settings, or Windows Internet Settings when no environment proxy is set. A proxy that only tunnels HTTPS sees connection metadata, not the request path or headers. A TLS-inspecting proxy trusted by this client can read or change GitHub responses. The updater checks HTTPS redirect hosts, GitHub's reported immutable state, published sizes, and SHA-256 values, but does not independently verify the GitHub release attestation: a malicious trusted TLS-inspecting proxy that rewrites both release metadata and asset bytes can defeat those consistency checks. No dictation audio or transcript is sent. This urllib route is separate from the model client's HTTPX proxy and CA settings, and browser/Homebrew downloads use their own proxy configuration.
macOS proxy preflight: The pinned FluidAudio client logs a malformed inherited https_proxy or http_proxy URL verbatim and ignores it. In macOS 0.3.8 this may put proxy credentials in a library log or make a model request without the proxy the user expected. The macOS 0.3.9 implementation refuses to start if either setting lacks a parsable host and port, reporting only the variable name. Correct or remove malformed proxy settings before relaunching. Valid settings remain active; this does not establish trust in a proxy or protect request headers from a trusted TLS-inspecting proxy.
Presspeech does not collect or store your IP address. As with any network connection, the destination service can see the source IP address and request timing, and network intermediaries may also observe connection metadata. A fixed User-Agent and the absence of an app-added identifier do not make a request anonymous; GitHub describes IP addresses and request times as service-usage information in its privacy statement.
| When | Destination | Purpose | User control |
|---|---|---|---|
| Model download | Normally huggingface.co and its subdomains, plus Hugging Face model-storage/CDN hosts under hf.co. Both macOS 0.3.8 and 0.3.9 use the pinned FluidAudio client, which reads inherited lowercase https_proxy and http_proxy settings; an HTTPS model request can be routed through a configured HTTPS proxy. Published Windows 0.1.12 can instead use inherited HF_ENDPOINT or HUGGINGFACE_CO_STAGING routing. Both Windows 0.1.12 and upcoming 0.1.13 honor inherited HTTPX proxy variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY); upcoming 0.1.13 does not clear these settings. Its pinned Hub client may also request /api/agent-harnesses from the configured endpoint when its local registry cache is missing or stale. |
The macOS FluidAudio Parakeet TDT v3 CoreML model is about 500-600 MB. The 0.3.8 release starts its first download on launch; in macOS 0.3.9 and later, clean installs must choose Download Model in Setup or choose Set Up Later to defer. Existing installs keep automatic startup. With previously recorded download permission, an integrity failure or user-triggered cache reset can also redownload it; otherwise a clean install asks first. From macOS 0.3.10, Settings → Dictation → Speech Model also offers the optional Parakeet Ultra model, about 630 MB from the FluidInference/parakeet-ultra-coreml Hugging Face repository. It downloads only after you choose it and confirm Download and Switch. FluidAudio fetches the repository’s current files; before loading, Presspeech checks each one against SHA-256 hashes pinned to a reviewed commit and downloads a mismatch once more. If a switch to Ultra still fails, Presspeech returns to the previous model. Parakeet TDT v3 remains the default, and its cache stays on disk for switching back. Windows downloads its selected local model; fresh systems use multilingual Parakeet (about 2.5 GB) when CUDA is usable or English-only Whisper base.en (about 141 MiB) on CPU. Published Windows 0.1.12 starts the selected download on first launch; upcoming 0.1.13 checks the default-model cache locally and asks before fetching missing first-run Parakeet or CPU base.en files. No dictation audio or transcript is sent. Under default routing, Hugging Face observes and can count the requested model/revision fetch; Windows requests also identify bundled library/runtime versions in User-Agent fields. Published Windows 0.1.12 does not disable Hugging Face Hub/Transformers default usage telemetry, which these libraries may send; Transformers also includes a random per-process session identifier in model-request metadata. The exact Hub/Transformers telemetry event fields are defined by the bundled libraries and are not independently enumerated here. In pinned Hub 1.29.0, building model-request headers may trigger a best-effort GET to the configured Hub endpoint’s /api/agent-harnesses when its local registry cache is missing or stale; the response is cached locally. If inherited agent-related environment markers match, the model request User-Agent may include an agent/<id> label. See the pinned Hub header builder and agent detection source. Upcoming Windows 0.1.13 disables Hub telemetry before imports and rejects rendered headers that contain an agent label; these controls are not in published 0.1.12. Published Windows 0.1.12 also leaves implicit authentication enabled: when HF_TOKEN or HUGGING_FACE_HUB_TOKEN is available in the environment, or a token is saved in the local Hugging Face cache, a model request may include it. Published Windows 0.1.12 honors inherited HF_ENDPOINT and HUGGINGFACE_CO_STAGING settings, which can change the request destination; a locally available token may accompany a request to that configured endpoint. If HF_HUB_USER_AGENT_ORIGIN is set, the bundled client adds its value to User-Agent metadata. These models do not require an account token. The release source pins hf-xet 1.6.0, whose upstream source predates the separate Xet client-transfer telemetry documented later; 0.1.12 is not claimed to send those Xet reports. macOS 0.3.8 can attach an inherited HF_TOKEN, HUGGING_FACE_HUB_TOKEN, or HUGGINGFACEHUB_API_TOKEN to a model request. From 0.3.9, Presspeech removes those credentials from its own process before FluidAudio can read them, making the public model fetch unauthenticated without changing the user's shell or token store. The macOS client still honors proxy settings in both versions: a tunnelling proxy sees connection metadata but not request headers, while a TLS-inspecting HTTPS proxy trusted by macOS could read any token sent by 0.3.8. Upcoming Windows 0.1.13 fixes the public Hub endpoint and clears staging and inherited User-Agent-origin settings before its model libraries import, disables Hugging Face Hub telemetry, bypasses the separate hf-xet transfer client, disables implicit authentication and inherited User-Agent origin data, passes no account token, and uses the fixed non-unique request-session value telemetry-off instead of Transformers' random identifier. The packaged runtime checks the bundled Hub's cached HF_HUB_DISABLE_XET setting. Hub uses regular HTTP downloads instead, so Hugging Face still observes the requested model and revision; bypassing hf-xet also prevents transfer telemetry in versions that implement it. Both Windows 0.1.12 and upcoming 0.1.13 use pinned HTTPX 0.28.1 with the Hub client's default trust_env=True, which also honors SSL_CERT_FILE and SSL_CERT_DIR CA overrides. A proxy that only tunnels HTTPS sees connection metadata, not request contents; a TLS-inspecting HTTPS proxy whose CA is trusted by the client can read request headers and any token sent by published Windows 0.1.12. Upcoming 0.1.13 disables account-token authentication but still honors these proxy and CA settings. Published Windows 0.1.12 does not independently verify model-file contents against SHA-256. Upcoming Windows 0.1.13 verifies every allowed required and present optional inference file before model loading by checking it against its pinned SHA-256 manifest. On Windows, Presspeech rehashes the reviewed files on every load rather than trusting a metadata-only verification record; mismatches fail closed. This may lengthen model preparation. The proxy can still observe request metadata or block a download. |
First-run controls vary by release: macOS 0.3.8 and Windows 0.1.12 start a missing-model download automatically. A clean install of macOS 0.3.9 or later asks you to choose Download Model or Set Up Later to defer. This applies when the model cache is missing or incomplete; a complete preinstalled cache loads offline without granting permission for a later download. If that cache fails verification, reset it to reach the choice. Upcoming Windows 0.1.13 asks before fetching missing files for either first-run default; cached models load without a prompt. Existing macOS installs keep automatic startup. The optional macOS Parakeet Ultra model (0.3.10 and later) downloads only after you choose it in Settings and confirm; switching back to Parakeet TDT v3 needs no download. The machine-readable inventory lists these controls per release and model. |
| Periodic update check | api.github.com/repos/rcourtman/presspeech/releases/latest (macOS); api.github.com/repos/rcourtman/presspeech/releases?per_page=100 and bounded numbered pages of that same endpoint when needed (Windows). The Windows in-app check can use a configured proxy for HTTPS URLs. |
macOS checks every six hours. Published Windows 0.1.12 checks at startup when 24 hours have passed since its last successful check; a failed check can repeat on each restart. Upcoming Windows 0.1.13 records an automatic attempt before contacting GitHub, so failed attempts also defer automatic retries for 24 hours. Manual tray checks remain available. Both apps ignore release responses not marked immutable, only notify, and use fixed platform User-Agents (presspeech-update-check and presspeech-windows-update-check) with no app-added version, device, settings, transcript, or usage identifier. GitHub or a configured proxy can observe connection metadata; GitHub sees the proxy's address when one is used. See the Windows updater proxy boundary above. |
Disable update notifications from Settings. |
| User-triggered support guide | github.com/rcourtman/presspeech/blob/main/SUPPORT.md |
Report a Problem and Suggest an Improvement open the public support guide in the default browser; neither action submits a report or attaches diagnostics. The user may choose to follow a separate public issue link from that guide when GitHub accepts submissions. Presspeech adds no version, device, settings, transcript, diagnostics, or usage data to the guide URL; the browser and GitHub handle their normal request and account metadata. | Only runs after the user chooses one of the feedback actions. |
| User-triggered compatibility guide | rcourtman.github.io/presspeech/app-compatibility.html |
In macOS 0.3.8, upcoming Windows 0.1.13, or builds containing the new action, Test App Compatibility opens the fixed public privacy-safe target-app guide. Presspeech adds no version, device, settings, transcript, diagnostics, or usage data to the URL; the browser and destination host handle normal request metadata. | Only runs after the user chooses Test App Compatibility. |
| User-triggered install/update | github.com/rcourtman/presspeech/releases/download/..., formulae.brew.sh, github.com/rcourtman/homebrew-presspeech, Homebrew's own update endpoints (github.com / api.github.com). Windows in-app installer and checksum downloads can use a configured proxy for HTTPS URLs. |
macOS uses the signed, notarised archive directly or through Homebrew; each immutable GitHub release also publishes a SHA-256 sidecar. Windows downloads from an immutable release only after user approval, then verifies the published size and SHA-256 before offering to launch it. These in-app checks rely on the GitHub metadata received over HTTPS and do not independently establish publisher identity against a trusted TLS-inspecting proxy. GitHub CLI users can separately verify either platform's signed release attestation. | Only runs when the user installs or updates. |
Machine-readable version: privacy/network-calls.json. Schema 1 lists model-download choices by release and missing model. Its can_defer flag covers only that model's first-run path, not later integrity retries, cache resets, or startup on existing installs.
Sandbox surface
Permissions and entitlements
The notarised macOS app uses two hardened-runtime entitlements: audio input and microphone. macOS also requires user-granted Accessibility and Input Monitoring permissions for the hotkey and paste workflow. Input Monitoring is a broad system grant that can expose typed keys. Presspeech's event tap requests keyboard events only to detect the configured hotkey and Escape to cancel an active recording; it does not inspect mouse or trackpad events, and other keys pass through without their values being saved, logged, or sent. See Apple's Input Monitoring guide before deciding.
The macOS app does not add JIT, unsigned executable memory, library-validation, network-client, contacts, calendar, location, camera, or file-provider entitlements.