AI Tool Privacy Tracker

Does ChatGPT train on my data?

Yes, by default — opt-out available.

ChatGPT's consumer plans (Free, Plus, Pro) train on user prompts, outputs, and uploaded files by default. To opt out, navigate to Settings → Data Controls and disable "Improve the model for everyone." Conversations are retained for 30 days after deletion. Temporary Chat is never used for training. ChatGPT Team, Enterprise, and API plans are explicitly excluded from training under OpenAI's enterprise terms — API users can optionally opt in via Playground feedback. Limited April–September 2025 data is preserved due to the NYT litigation order; OpenAI's standard 30-day retention practices resumed September 26, 2025. Ads appear only on the Free and Go plans, now in more than 60 countries after a September 23, 2026 expansion to Southeast Asia and Taiwan; ad personalization is a separate control under Settings → Ad Controls, and OpenAI's US Privacy Policy (updated September 10, 2026) says it collects "information about your ads history and interests" for those users.

Primary source: OpenAI privacy policy

Does Claude train on my data?

User choice required (since Aug 2025).

As of August 28, 2025, Anthropic shifted Claude's consumer plans (Free, Pro, Max) from "not used for training" to a user-choice model. New users must actively choose during signup whether to share data for training; existing users had until October 8, 2025. Users who opt in have their data retained for up to 5 years; users who decline keep the previous 30-day retention window. For flagged conversations, inputs and outputs are kept up to 2 years and trust & safety classification scores up to 7 years. Incognito chats are never used for training, even with Model Improvement on. Claude for Work, the Claude API, Amazon Bedrock, and Google Cloud Agent Platform (formerly Vertex AI) are all contractually excluded from training under Anthropic's Commercial Terms.

Primary source: Anthropic Aug 2025 update

Does Gemini train on my data?

Yes, by default — opt-out via the "Keep Activity" setting.

Free Gemini and Google AI Plus / Pro / Ultra (consumer) train on user conversations by default. Per Google's documentation, when Keep Activity (the renamed "Gemini Apps Activity" toggle) is on, "Google uses your activity to provide, develop, and improve its services (including training generative AI models)." To opt out, set Keep Activity to OFF, or use a Temporary Chat, which is never used for training — but even when off, future chats are saved for 72 hours so Gemini can respond and process feedback. Default retention is 18 months, adjustable to 3 months, 36 months, or never. Human-reviewed conversations are kept up to 3 years (disconnected from your Google Account). Gemini Enterprise Agent Platform (formerly Vertex AI) customer data is contractually excluded from training: "Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction."

Primary source: Gemini Keep Activity controls

Does Perplexity train on my data?

Yes, by default — opt-out for logged-in users only.

Perplexity trains on user queries, prompts, and AI responses by default for Free, Pro, and Max plans. The "AI Data Retention" toggle in Account Settings → Preferences disables this. Logged-out users are trained on by default with no opt-out path — sign in to gain control. Threads are retained until manually deleted. On July 2, 2026 Perplexity replaced its privacy policy with a restructured Privacy Notice that dropped the written descriptions of the training opt-out, the 30-day account-deletion timeline (now "as long as reasonably necessary"), and the promise to notify users of material changes; the toggle and deletion still work in the product, but they are no longer commitments in the policy text. The same rewrite expanded stated collection to the Comet browser, voice input, and health and genetic data. The Sonar API offers Zero Data Retention with prompts and responses never stored. Third-party providers (OpenAI, Anthropic) are contractually prohibited from training on Perplexity's API data. Enterprise file uploads are deleted after 7 days.

Primary source: Perplexity data collection policy

Does DeepSeek train on my data?

Yes, by default — no in-app toggle; opt-out only by emailing privacy@deepseek.com.

DeepSeek's privacy policy (last updated February 10, 2026) states: "we directly collect, process and store your Personal Data in People's Republic of China" — covering prompts, outputs, uploaded files, IP addresses, device info, and account info (the keystroke-pattern language from the 2025 versions no longer appears). There is no in-app training toggle; the policy grants a right to opt out of training "or optimizing our technologies," exercisable by emailing privacy@deepseek.com. Retention is "for as long as necessary to provide our Services," with no fixed window. Italy's Garante imposed a 72-hour ban in January 2025 followed by 13 European jurisdiction probes; government device bans followed in Australia, Taiwan, South Korea, Czech Republic, the Netherlands, Germany, and multiple US federal agencies (Pentagon, NASA, US Navy). The bipartisan "No DeepSeek on Government Devices Act" is pending in the US Senate. A January 2025 database breach exposed over 1 million records. Open-source MIT-licensed weights can be self-hosted, which removes this concern entirely — but that is the self-hosted path, not the consumer chatbot.

Primary source: DeepSeek privacy policy (Feb 2026)

Does Apple Intelligence train on my data?

No by default — only Siri interactions, and only if you opt in to "Improve Siri & Apple Intelligence" (since September 2026).

Apple's published policy states Apple does not use users' private personal data or user interactions when training its foundation models, with one opt-in exception: under Apple's policies dated September 14, 2026, users who enable Siri AI and opt in to "Improve Siri & Apple Intelligence" let Apple store their Siri and Dictation interactions, and "Siri audio data, transcripts, and related request data may be used to train Apple's foundation models." That data is tied to rotating device-generated identifiers rather than the Apple Account, may be kept up to two years, and the opt-in can be turned off under Settings → Privacy & Security → Analytics & Improvements. The on-device foundation model handles most tasks; for larger requests, Private Cloud Compute extends device security to Apple Silicon servers using a verifiable transparency model — signed binaries are publicly inspectable, there is no SSH or admin access, and researchers can audit via the Virtual Research Environment. PCC is stateless: data is processed only to fulfill the request and returned to the device; it is not stored or made accessible to Apple. Apple collects only request metadata (size, feature, duration), not content. The optional ChatGPT extension is off by default and is a separate boundary: when used without a ChatGPT account, OpenAI must not store requests or use them to train its models; if you sign in, OpenAI's data policies apply and requests may be used for training. Apple's PCC guarantees do not extend to ChatGPT requests.

Primary source: Intelligence Engine privacy

Does Microsoft Copilot train on my data?

Consumer: yes by default — opt-out available. M365 Copilot business: no, contractually excluded.

First, the disambiguation: Microsoft Copilot is the consumer / Windows / Microsoft 365 assistant — it is distinct from GitHub Copilot (the developer product) which is tracked separately in the coding section. For Copilot Free, Windows Copilot, and copilot.com chat on Microsoft 365 Premium ($19.99/mo; Copilot Pro was retired on August 1, 2026), Microsoft trains by default on signed-in users' conversation activity. Microsoft Support states: "Except for certain categories of users or users who have opted out, Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training." Since the updated Copilot app of August 18, 2026 there are two toggles under Profile icon → Privacy: "Training on conversation activity" and "Training on voice conversations"; Microsoft says opting out excludes future conversation activity from model training, while conversations may still be used for other product improvements, advertising, digital safety, security, and compliance. Signed-out users, signed-in users under 18, and Copilot inside Microsoft 365 apps on Personal / Family / Premium subscriptions, are not used for training. A law firm announced an investigation into the default-on training on August 26, 2026. Conversation activity is retained 18 months by default; user-deletable, but deletion is independent of the training opt-out. On Copilot+ PCs (NPU ≥40 TOPS), Recall and Click to Do run locally on-device with snapshots stored on-device; most Copilot chat still runs in the cloud. Microsoft 365 Copilot ($30/user/mo, enterprise) is contractually excluded from training under the Microsoft Products and Services Data Protection Addendum: "Your data isn't used to train foundation models... the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models." Retention is tenant-controlled via Microsoft Purview. On January 7 2026, Microsoft enabled Anthropic as a default subprocessor for M365 Copilot (used in Researcher, Copilot Studio, Office agents); EU and UK tenants have it disabled by default, processing occurs outside the EU Data Boundary.

Primary source: Microsoft Copilot privacy controls (Aug 2026)

Does Meta AI train on my data?

Yes, by default globally. EU / UK have an opt-out form; US / Australia / most non-GDPR regions do not.

Meta AI — the assistant available in WhatsApp, Instagram, Facebook, Messenger, Threads, and Ray-Ban / Oakley Meta — is opt-in by default for training on adult users' public Facebook and Instagram posts and on all Meta AI conversations. The regional split is load-bearing. EU / EEA users have opt-out via the "Right to Object" form in Privacy Center → "How Meta uses information for generative AI models and features" — Meta resumed EU training on May 27 2025 under GDPR Article 6(1)(f) "legitimate interest" after a one-year pause forced by Irish DPC + noyb pressure. UK opt-out is available after ICO concessions. US, Australia, and most non-GDPR jurisdictions have no general opt-out — Meta confirmed in Australian Senate hearings (Sept 2024) that it scrapes Australian public posts back to 2007 and will offer an opt-out only "if governments force it to." WhatsApp 1:1 and group messages remain end-to-end encrypted and are not used for training unless the user explicitly invokes @Meta AI in chat. On December 16 2025, Meta extended Meta AI conversations into ad personalization in addition to model training (US and most non-EU regions; EU, UK, South Korea carved out). Retention is indefinite unless the user manually deletes; Ray-Ban Meta voice recordings are retained up to 1 year by default. No on-device inference for the Meta AI assistant — WhatsApp "Private Processing" is server-side TEE confidential compute, not local. Since September 2026, Ray-Ban / Oakley Meta glasses owners can turn off "Store visual data from AI experiences" in the Meta AI app, which Meta says keeps glasses images and video out of storage, training and human review; the setting does not cover voice interactions with Meta AI.

Primary source: Meta Privacy Center — How Meta uses information for generative AI

Does Grok train on my data?

Consumer: yes by default — three separate opt-out paths. API: no, by default.

Consumer Grok — on X (Free, Premium $8/mo, Premium+ $40/mo), grok.com, and the Grok mobile app — is opt-in by default for training on both X posts and Grok prompts / outputs. The opt-out lives in three separate places: (1) Grok on X: Settings → Privacy and safety → Data sharing and personalization → Grok & xAI → uncheck "Allow your posts as well as your interactions, inputs, and results with Grok and xAI to be used for training and fine-tuning." (2) Grok mobile app: Settings → Data Controls → uncheck "Improve the model." (3) Grok web at grok.com: Settings → Data → uncheck "Improve the model." EU / EEA users were excluded from X-post training under the September 4 2024 DPC undertaking; the DPC opened a fresh statutory inquiry on April 11 2025. The January 15 2026 X Terms of Service update explicitly classifies Grok prompts and outputs as user "Content" available for AI training. Grok chats are retained indefinitely unless the user deletes them. The xAI API (xAI now signs its pages as SpaceXAI LLC) has a materially different posture: "SpaceXSI never trains on your API inputs or outputs without your explicit permission," matching the OpenAI and Anthropic API defaults. API retention is 30 days for abuse monitoring; Zero Data Retention is a team-level setting that, "where available," a team admin can switch on in the xAI Console (enterprise agreements via sales@x.ai), and it has been offered on Oracle Cloud Infrastructure since June 17 2025. Track record: "MechaHitler" antisemitic-content failure (July 2025) drew EU Commission and Turkey enforcement; ~370,000 Grok shared chats were indexed on Google in August 2025 because the share feature generated unauthenticated URLs without `noindex`. On June 11, 2026 Canada's Privacy Commissioner found the complaint against X Corp. and xAI over Grok-generated sexual deepfakes "well-founded (and not resolved)" (PIPEDA Findings #2026-004).

Primary source: xAI Privacy Policy

Does Cursor train on my code?

Yes, by default for individuals — Privacy Mode opt-out.

For individual accounts Privacy Mode is off by default (Cursor no longer calls this "Share Data"). With it off, Cursor's Data Use page (last updated September 3, 2026) says it "may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models." Toggling Privacy Mode ON prevents training and discards plaintext after each request — cached files are encrypted with client-generated keys that exist on Cursor's servers only for the duration of each request. Enterprise workspaces default to Privacy Mode ON and admins can enforce it; Cursor states it holds zero-data-retention agreements with all model providers (naming SpaceXAI, OpenAI, Anthropic, and Meta, plus Google in the enterprise docs). Models that require provider-side retention, such as Claude Fable 5.1 and Fable 5 (named in Cursor's enterprise privacy docs, not on the Data Use page), are blocked for Privacy Mode and Enterprise users until an admin approves them. On August 29, 2026 Cursor removed its disclosure of how indexing embeddings and metadata are retained, so that detail is now unpublished. Cursor's September 29, 2026 Privacy Policy rewrite (re-dated October 11, 2026) also dropped its statement that it does not sell or share personal data for cross-context behavioral or targeted advertising; its training language is unchanged. Requests go through Cursor's backend even when you bring your own API key; Cursor can also be pointed at local Ollama or LM Studio models.

Primary source: Cursor data use

Does GitHub Copilot train on my code?

Yes, by default for consumer plans — opt-out as of April 24, 2026.

On April 24, 2026, GitHub began using Free, Pro, and Pro+ user interaction data — including code snippets — to train AI models by default. Existing opt-outs are honored. To disable training going forward, go to Settings → Privacy. The $100-per-month Copilot Max individual plan is not named in GitHub's training or opt-out answers, so its default is undocumented. User Engagement Data is retained for 2 years; Coding Agent session logs persist for the lifetime of the account. Private repository code at rest is NOT used for training, but in-flight interaction data IS. Business and Enterprise plans are explicitly prohibited from being used for training under GitHub's agreements: subscription Prompts and Suggestions are retained 28 days, and User Engagement Data 2 years.

Primary source: April 2026 policy change

Does Devin Desktop (formerly Windsurf / Codeium) train on my code?

Yes for individuals by default — paid plans can opt out, which also enables Zero Data Retention.

Windsurf was rebranded Devin Desktop by Cognition on June 2, 2026, and its legal pages now live on cognition.com and docs.devin.ai. Cognition's privacy policy (March 9, 2026) says User Content is used "to train, fine tune and improve the models that power our Services" unless you opt out. Per the Devin security docs: "If you're on a paid plan, you can opt out at any time on the Data Controls settings page. After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers." No opt-out is documented for the free tier. On Teams only an administrator can exercise the opt-out; Enterprise customers are not trained on without express prior written consent. With ZDR, Customer Data is "not saved to disk or otherwise persistently retained" and is deleted once the output is generated. Cognition offers a hybrid deployment and has placed its self-hosted deployment in maintenance mode.

Primary source: Devin security docs

Does Cline train on my code?

No — Cline operates no model server. Privacy depends on your chosen API provider.

Cline is an open-source VS Code extension that operates no model server of its own. User code is sent only to whichever API provider you configure (Anthropic, OpenAI, AWS Bedrock, Google Gemini, Cerebras, Groq, etc.) and is governed by that provider's terms; on that bring-your-own-key path, per Cline's terms, Cline "does not receive or store your input tokens, output tokens, underlying code, or other User Content." Telemetry is a separate matter. Cline's telemetry docs, corrected on October 7, 2026 (PR #14860), now state: "Telemetry is on by default in the VS Code and JetBrains extensions, Cline Desktop and the CLI, whether you sign in to a Cline account or use your own API keys." Each installation has a device identifier, and signed-in events also identify the account and organization. Per the docs, telemetry "doesn't include your code, file contents or prompts, except for requests to the Cline and ClinePass providers," where it "can include the prompt and the model's response." Before the correction the docs called telemetry opt-in and anonymous and said code never left the user's machine; that wording was withdrawn. To turn telemetry off, open Cline's settings → General and clear "Allow error and usage reporting" (CLI: set telemetryOptOut to true); Cline still contacts its servers for sign-in, feature flags, and Cline / ClinePass provider requests. Organization telemetry locks apply only in the VS Code and JetBrains extensions. Track record: on February 17, 2026 a compromised npm publish token was used to publish cline@2.3.0 with an added postinstall script; Cline's post-mortem says the exposure lasted about 8 hours, was limited to the CLI npm package, and "No user data was accessed or exfiltrated." For fully on-device use, configure Cline with a local Ollama or LM Studio model.

Primary source: Cline telemetry docs

Does Claude Code train on my code?

Pro/Max account: yes by default — opt-out. API / Console / Enterprise: no, contractually excluded.

Claude Code is Anthropic's CLI for Claude — separate from Claude.ai consumer chat and from Claude for Work. The data-handling posture depends entirely on how the user is billed. A developer running Claude Code from a Claude.ai Pro or Max account inherits the August 28 2025 consumer-terms update, which made training default-on with user-choice opt-out. Anthropic stated explicitly: "These updates apply to users on our Claude Free, Pro, and Max plans... including when they use Claude Code from accounts associated with those plans." Opt-out lives at claude.ai/settings/data-privacy-controls. Retention with training enabled is 5 years; with training disabled, 30 days. A developer running Claude Code via an API key, Anthropic Console, Claude for Enterprise, AWS Bedrock, Google Vertex AI, or Microsoft Foundry is on Anthropic's Commercial Terms Section B: "Anthropic may not train models on Customer Content from Services." Reinforced in the Claude Code data-usage docs: "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms." Bedrock and Vertex users cannot enroll in the Development Partner Program at all. Zero Data Retention is available specifically for Claude Code on Claude for Enterprise per the docs, enabled per-organization by the account team; Claude for Enterprise organizations that apply Anthropic's HIPAA configuration can also bring Claude Code (local mode) under their BAA without ZDR. Architecturally, Claude Code is partial on-device: the binary runs locally (file edits, shell execution, MCP servers, local session log), but inference is cloud-only via the Anthropic API.

Primary source: Claude Code data usage

Does Tabnine train on my code?

No — proprietary models trained only on permissively licensed open-source code.

Tabnine's proprietary completion models are trained only on permissively licensed open-source code (MIT, Apache 2.0). Tabnine's privacy docs state: "Tabnine has a no-train-no-retain policy" and "Tabnine does not train its models on your code," and that its code completion and Protected chat models "are only trained on open source code with permissive licenses." The same page says that when using Tabnine models, "Tabnine NEVER retains or shares any of your code with third parties." Tabnine also implements zero code retention — requests are processed in-memory and immediately discarded after the server returns a suggestion. Operational metrics and logs (which contain no code and no PII) are retained roughly one week for support. The architecture scales further at the Enterprise tier, which supports SaaS, VPC, on-premises, and fully air-gapped deployment options where code never leaves the customer network. There is no free or individual plan; the Code Assistant Platform was last published at $39 per user per month (Agentic Platform $59) in August 2026. Tricentis acquired Tabnine, announced July 30, 2026. Since about October 2, 2026, tabnine.com redirects to tricentis.com: the pricing page now leads to a Tricentis contact form with no prices, the former code-privacy page redirects to a SafeBase trust center (trust.tabnine.com), and the privacy policy and terms are Tricentis-hosted PDFs. The no-train, no-retain commitments remain published on docs.tabnine.com. Compliance posture: SOC 2 Type II, ISO 27001, GDPR, with IP indemnification for enterprise customers. No documented privacy incidents. Tabnine sits alongside Cline as the rare "good actor" in a coding category that otherwise carries opt-out-by-default training (Cursor individual, Devin Desktop individual) or recent reversal (GitHub Copilot, since April 2026).

Primary source: Tabnine privacy docs

Does OpenAI Codex train on my code?

Yes with a ChatGPT Free / Go / Plus / Pro sign-in unless you turn off two separate toggles; no with an API key, Business, Enterprise, or Edu.

Codex — the CLI, IDE extension, desktop app mode, and cloud agent — inherits the terms of whatever account you sign in with. OpenAI's help center (updated August 2026) names it directly: "When you use our services for individuals such as ChatGPT and Codex, we may use your content to train our models." The ChatGPT opt-out (Settings → Data Controls → "Improve the model for everyone") is documented as turning off training "for your ChatGPT conversations and Codex tasks." That is not the whole story: "Codex has separate controls for allowing training on full environments, which you can manage in the Codex Settings. Note that adjusting your settings in the ChatGPT interface or privacy portal will not affect these full-environment Codex settings." OpenAI does not publish the default of that environment control, so treat it as something to check by hand. Retention on consumer plans follows the ChatGPT privacy policy — deleted content is removed within 30 days unless kept for legal or abuse reasons — with no Codex-specific window published. Business, Enterprise, Edu, and API-key use fall under the enterprise privacy page (updated January 8, 2026): "By default, we do not use your business data for training our models." Enterprise admins control retention; API traffic is kept 30 days for abuse monitoring, and /v1/responses is eligible for Zero Data Retention. Architecturally, Codex is partial on-device: the CLI edits files and runs shell commands locally, but per OpenAI's own docs "Local execution does not mean offline or device-only model inference," and cloud tasks run in VM-backed sandboxes on OpenAI infrastructure. A GitHub-token command-injection flaw reported December 16, 2025 was patched February 5, 2026 with no exploitation reported, and CVE-2026-19591 (published September 1, 2026; CVSS 8.8), in which Codex could run a file-writing Git command without approval from an attacker-prepared repository, was fixed in Codex CLI 0.131.0.

Primary source: How your data is used to improve model performance

Does Gemini CLI train on my code?

Depends on the key: yes with a free Gemini API key (no toggle); no with a paid API key, Vertex AI, or a Gemini Code Assist Standard / Enterprise license.

Gemini CLI is Google's open-source (Apache 2.0) terminal agent, and its privacy posture is set entirely by how you authenticate. The picture changed in 2026. Google announced on May 19, 2026 that "Gemini CLI and Gemini Code Assist IDE extensions will stop serving requests for Google AI Pro and Ultra, as well as those using it free of charge using Gemini Code Assist for individuals" from June 18, 2026, steering those users to Antigravity CLI. The old "Gemini Code Assist for individuals" privacy notice, which offered an opt-out checkbox, now serves only a deprecation notice. What remains for individuals is a Gemini API key. On the unpaid tier the Gemini API Terms (effective March 23, 2026) state: "Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products" and "human reviewers may read, annotate, and process your API input and output." There is no opt-out setting; the only off-switch is enabling paid billing, where "Google doesn't use your prompts ... or responses to improve our products" and logs are kept "for a limited period of time" for abuse detection — no number is published. Organization licenses fall under the Gemini for Google Cloud data-governance page (last updated October 9, 2026): "Gemini doesn't use your prompts or its responses as data to train its models." Google stopped selling new Gemini Code Assist Standard and Enterprise subscriptions on October 9, 2026: existing subscriptions stay supported until contract end, licenses can be added and annual plans renewed until January 31, 2027, and Google is steering organizations to Antigravity in Gemini Enterprise, while paid Gemini API keys remain a supported route. Separately, the CLI sends anonymous usage statistics by default (tool names, model, durations) but "We do not log the content of your prompts or the responses"; set privacy.usageStatisticsEnabled to false to stop it. Track record: a critical advisory (GHSA-wpqr-6v78-jr5g, now CVE-2026-12537) on April 24, 2026 fixed workspace-trust and tool-allowlist bypasses in headless runs, and CVE-2026-13745 (published September 10, 2026), a code-execution flaw triggered by untrusted .env files overriding GEMINI_CLI_HOME, was fixed in the same 0.39.1 release.

Primary source: Gemini CLI terms and privacy

Does Kiro train on my code?

Yes by default for Free and for paid plans signed in with GitHub, Google, or AWS Builder ID — opt-out in settings; no for Enterprise or IAM Identity Center sign-ins.

Kiro is AWS's agentic IDE and CLI. Its data-protection page (updated October 8, 2026) is unusually explicit that the split is by sign-in method, not by price. "Kiro may use certain content from Kiro Free Tier and Kiro individual subscribers for service improvement," where individual subscribers are users "that have a paid Kiro subscription and access it through a social login provider (like GitHub or Google) or through AWS Builder ID." The content covered is "your questions to Kiro, other inputs you provide, and the responses and code that Kiro generates," and the stated purposes include "for model training." A $200-per-month Power subscriber on a GitHub login is therefore trained on by default; a $20 Pro subscriber on IAM Identity Center is not. To opt out in the IDE: Settings → User → Application → Telemetry and Content, then uncheck "Data Sharing and Prompt Logging: Content Collection for Service Improvement" and "Usage Analytics And Performance Metrics." In the CLI, open Preferences and toggle off "Telemetry" and "Share Kiro content with AWS"; in Kiro Web, go to Settings → Agent and toggle off "Allow AWS to use your Kiro Web content for service improvement." The AWS Service Terms (last updated October 1, 2026) make this contractual: Section 50.3 lets AWS "use and store AI Content" from Kiro Free Tier and individual subscribers to develop and improve the service and, for non-personal data, AWS and affiliate AI technologies, and to store it outside the region where you use Kiro. For Enterprise, "We do not use content from Kiro enterprise users for service improvement," and those users "are automatically opted out of telemetry and content collection." Retention: Free Tier inputs may be stored "for up to 60 days" for abuse detection, OpenAI GPT classifier-flagged traffic "for up to 30 days," all Claude Fable 5.1 (Preview) traffic for up to 30 days for automated abuse detection with possible human review of flagged traffic by AWS, and no window is published for service-improvement content. Free Tier and individual-subscriber content is stored in US East (N. Virginia). Inference runs in AWS on Bedrock-hosted Claude, OpenAI GPT, and open-weight models; there is no local-model option. Section 50.3 does not cover enterprise or IAM Identity Center users, so their exclusion from training now has contractual footing as well as the FAQ. Track record: 2026 brought a run of AWS security bulletins for Kiro, including CVE-2026-89332 (September 11, 2026; a workspace settings change could redirect the Powers registry; fixed in 0.8.135, with AWS advising credential rotation) and CVE-2026-95985 (September 24, 2026; global-configuration writes from untrusted workspaces; fixed in 1.0.242), plus a Mindgard-disclosed prompt-injection exfiltration, all patched with no customer data loss reported. GitHub issue #2206 on the AWS terms was closed as stale / not planned on September 15, 2026.

Primary source: Kiro data protection

Does Voibe train on my voice data?

No — on-device mode never transmits audio; cloud mode is zero-retention with no training.

Voibe has two user-selectable modes. In on-device mode (Apple Silicon Macs, M1 or later) audio is transcribed entirely on the Mac by Whisper models running on the Neural Engine, works with no internet, and nothing leaves the machine — so there is no training to opt out of. In zero-retention cloud mode (all Macs and Windows) audio is encrypted in transit and transcribed by Whisper Large Turbo, an open-source model running on zero-retention providers (Groq or Cloudflare); the audio is deleted the moment transcription completes and is never stored, sold, or used to train any model. Formatting is a second hop that sees only the text, never the audio, using GPT-OSS 120B, an open-weight model on Cerebras. No third-party AI lab is in the audio path and users never paste an API key. The speech-to-text API and MCP server launched in August 2026 run on the same pipeline, with transcripts readable for 24 hours and then deleted. Account holders provide an email (for authentication) and non-identifying usage analytics; crash reports exclude dictated content.

Primary source: Voibe AI & privacy

Does Wispr Flow train on my voice data?

Yes by default on Free and Pro: model improvement is on unless you turn it off.

Wispr's help center (Security and privacy overview, updated October 2026) states: "Improve the model for everyone is on by default for Free and Pro, with the choice shown during onboarding, and you can turn it off; it is off for Enterprise and administrators cannot re-enable it," and that the setting "does apply to Notetaker as well as dictation." Wispr's privacy policy (last updated August 19, 2026) instead describes training as something users "opt to share" — the vendor's own documents conflict, so we treat Free and Pro as opt-out. On Growth and Enterprise, per wisprflow.ai/privacy, "model training is off by default and locked." Retention: dictation data has no fixed window ("only for as long as necessary"), and content passed to third-party LLM providers "is not used to train their models and is generally deleted within 30 days." Notetaker transcripts and summaries are stored in Wispr's US cloud with "no customer setting to opt out of that storage," and uploaded meeting audio is kept 7 days, then deleted. Compliance: the Trust Center now holds A-LIGN's SOC 2 Type II report and an ISO/IEC 27001:2022 certificate (issued after Wispr invalidated its earlier certifications in March 2026), but per the help center Notetaker "was not assessed" in either audit, while wisprflow.ai/privacy says the SOC 2 Type II covers every product. A Business Associate Agreement enables HIPAA support "for dictation, on any plan"; accepting one "turns off Notetaker and Scratchpad." Transcription always happens in the cloud; there is no local processing mode.

Primary source: Security and privacy overview (help center)

Deep dive: Is Wispr Flow Safe? — full investigation

Does Superwhisper train on my voice data?

No — verbatim from policy.

Superwhisper's privacy policy states explicitly: "Your data is not retained on Superwhisper servers" and "not used for training AI models or any other machine learning purposes." On-device modes (Fast, Nano, Standard Whisper, Parakeet — available on the Free plan and within Pro) process audio entirely locally; nothing is transmitted. Cloud modes (Ultra transcription, Super Mode LLMs — Pro tier) proxy audio through Superwhisper's infrastructure with no retention. One caveat: audio recordings are saved to local disk by default. Opt out in settings if local audio retention is a concern. The privacy policy (still dated June 19, 2024) does not distinguish between on-device and cloud modes, but the Terms (updated June 2026) state that "your data is not used to train, fine-tune, or improve AI models" and that "cloud models process your content transiently on a zero-retention basis." Superwhisper's trust center lists a SOC 2 Type II report dated March 3, 2026 and a bridge letter dated September 17, 2026. Verify the MSA / DPA scope with the vendor before regulated use.

Primary source: Superwhisper privacy

Deep dive: Is Superwhisper Safe? — full investigation

Does MacWhisper train on my voice data?

No — primarily on-device, with optional cloud + BYOK paths.

MacWhisper does not train its own models on user audio. The on-device transcription path uses local Whisper models that you can download for offline use; Apple Foundation Models also run on-device for AI features. MacWhisper's optional "Assistant" cloud transcription service and BYOK integrations inherit those providers' terms when used: audio goes to OpenAI or ElevenLabs for cloud transcription, and transcript text goes to OpenAI, Anthropic, Google Gemini (added in v5.1, September 17, 2026) or SpaceXAI/Grok for summaries and chat. Local LLMs via Ollama or LM Studio stay on-device, and transcripts can be indexed by Spotlight on-device (indexing can be disabled in Settings). The App Store version's privacy disclosure shows only "Usage Data" and "Product Interaction" as Data Not Linked to You. There is no separate enterprise tier; the data-handling architecture is identical for individuals and bulk-licensing customers.

Primary source: App Store listing

Does Aqua Voice train on my voice data?

Opt-out: transcripts may be stored to improve the product unless Privacy Mode is on.

Aqua Voice's privacy policy (effective July 29, 2026) states that with Privacy Mode disabled, "we may securely store transcript data on our servers to the extent necessary to improve the product"; with Privacy Mode enabled, "transcript data is not collected" though session metadata (timestamps, device type, performance metrics) may still be. Aqua Voice holds SOC 2 Type II (Advantage Partners, March 2026) and, per its July 14, 2026 announcement, ISO/IEC 27001:2022 certification. On September 23, 2026 Aqua announced it is "GDPR and HIPAA compliant" and asks customers to contact its team before using protected health information so it can confirm covered plans and "discuss BAA terms" — a vendor statement, not a published BAA. The separate Team plan no longer appears on the pricing page; Business ($19/seat/mo annual or $24 month-to-month, minimum 2 seats) adds Zero Data Retention, SSO, and SCIM. Audio is cloud-processed; there is no on-device option.

Primary source: Aqua Voice privacy policy

Deep dive: Is Aqua Voice Safe? — full investigation

Does Typeless train on my voice data?

No, per the published privacy policy — but verify the architecture.

Typeless's privacy policy states: "Your data is never used to train these services and is configured for zero retention by the providers." Audio plus contextual information is "processed in real time on our cloud servers and immediately discarded once the result is returned to your device." Free and Pro tiers receive the same data-handling treatment; the pricing page now also lists an Enterprise tier with SSO, SCIM, audit logs, and "enforced HIPAA controls and BAA availability." However, a November 2025 reverse-engineering analysis (covered in our Typeless privacy issues investigation) reported collection beyond what the published policy describes — including URL capture, window-title metadata via the macOS accessibility API, and broad permission requests. Verify the current subprocessor list at trust.typeless.com/subprocessors before relying on Typeless for sensitive content.

Primary source: Typeless privacy policy

Deep dive: Typeless Privacy Issues — full investigation

Does Apple Dictation train on my voice data?

Only if you opt in — via "Improve Siri & Dictation" or the new "Improve Siri & Apple Intelligence."

Apple Dictation only uses your audio to improve its models if you opt in. Under Apple's policies dated September 14, 2026 there are two opt-ins. "Improve Siri and Dictation" stores audio and transcripts, a sample of which Apple employees may review. The new "Improve Siri & Apple Intelligence," shown when Siri AI is enabled, lets Apple "store all of your interactions with Siri and Dictation, including the audio data and transcripts," and use them to "train Apple's foundation models, which power Apple Intelligence." If opted in, data is tied to a random, device-generated identifier that "rotates multiple times per hour" (the earlier six-month identifier is gone) and kept for up to 2 years; a reviewed subset is retained beyond 2 years. If you do not opt in, server-processed dictation "will not be stored." On Apple Silicon Macs running modern macOS or iOS, most languages process locally for general text fields (Notes, Mail, Messages). Server-side fallback applies to unsupported languages, search-box dictation, and some third-party Speech Recognition API uses. Apple does not sign a Business Associate Agreement for consumer Dictation, so it is not HIPAA-compliant.

Primary source: Ask Siri & Dictation policy

Does Willow Voice train on my voice data?

No by default — Private Mode is the default; opt-in required for training.

Willow Voice operates with Private Mode as the default for all users. The privacy policy (last updated August 5, 2026) states: "In Private Mode, Willow collects only the account, technical, and operational information needed to provide and maintain the service. Willow may process voice audio transiently to return a transcription, but Willow and its service providers do not retain that audio or use it for model training." Training only occurs if the user opts into "Help Improve Willow," which lets Willow retain recognized dictated text and limited usage information to improve its text-correction models; per the policy, "Willow may retain anonymized recognized text, but not audio," and service providers are "subject to Zero Data Retention and no-model-training controls." No specific retention window is published for the opt-in path. Dictation transcript history and recordings are stored locally on the device. The policy now also covers note-taking and meeting features, including Google Calendar/Contacts pass-through. Architecturally, Willow Voice is cloud-first, but willowvoice.com now markets an offline mode: "Dictate without an internet connection, powered entirely by your device." Plans: Free (the weaker Frontier Mini model), Pro ($15/mo, $12/mo annual), Business ($35/mo, $28/mo annual, with "Enforced privacy mode (zero data retention)," SOC 2 Type II and "Enforced HIPAA compliance"), and custom Enterprise (SSO/SAML, MSA & DPA). Willow's security page states it "supports HIPAA-regulated teams with enterprise controls, privacy safeguards, and Business Associate Agreements"; the privacy policy does not describe BAA mechanics, so obtain a signed BAA in writing before processing PHI. The same page labels Willow "End-to-End Encrypted" while describing TLS in transit plus encryption at rest.

Primary source: Willow Voice privacy policy

Does Monologue train on my voice data?

No, per the privacy policy — but saved Notes and meeting notes are stored in your account.

Monologue's privacy policy, now linked from the monologue.to footer (monologue.to/privacy, effective October 31, 2025, from Every Media, Inc.), lists things the company will not do with your data, including: "Train any artificial intelligence models using your PII, audio, or transcripts," store audio or transcripts on its servers, or use transcripts to improve the service, the last two "unless you specifically use the toggle switch to activate this functionality." It names its third-party AI providers as Groq, Fireworks, and OpenRouter, and its analytics and monitoring vendors as PostHog, Sentry, and New Relic. Local audio files and transcripts in the app "will be deleted after 14 days." The data-privacy page adds that "Monologue does not save audio or transcripts from Dictation on its servers" and that AI providers process Dictation with zero data retention. Notes are the exception: "When you record a Note, Monologue stores the Note's audio, transcript, and summary in your account." Pro ($15/month or $144/year) now includes bot-free meeting notes — on Mac, Monologue records microphone and system audio together "without adding a bot to the call" — and those meeting notes are stored in the account as Notes. Offline transcription on Mac using local models is marketed, but the default architecture is cloud. There is no SOC 2, HIPAA, or BAA posture, so request written terms before regulated use.

Primary source: Monologue privacy policy

Does VoiceInk train on my voice data?

No — on-device by default; optional BYOK cloud is opt-in.

VoiceInk is an open-source dictation app under GPL v3.0. Its privacy policy (last updated September 27, 2026, now covering the macOS app, the iOS app, and the website documentation assistant) states: "No data leaves your computer unless you explicitly choose to enable optional cloud services." By default, transcription runs locally on Apple Silicon via whisper.cpp (macOS 14.4 or later); VoiceInk operates no transcription server, so the default path has no server-side retention surface and no training path. Optional bring-your-own-key cloud services are documented: Groq, OpenAI, Anthropic, Gemini (Google), Mistral, Cerebras, Deepgram, ElevenLabs, Speechmatics, Soniox, OpenRouter, Ollama (runs locally), and custom OpenAI-compatible endpoints. When you enable one, audio (cloud transcription) or text (AI Enhancement) goes to that provider under its terms. Locally, transcriptions are "Kept indefinitely by default" with optional automatic deletion. The website documentation assistant uses Cloudflare AI Search / Workers AI with AI Gateway prompt and response logging disabled. The source code is auditable on GitHub at Beingpax/VoiceInk (6,800+ stars, 950+ forks; latest release v2.21 on September 28, 2026). Pricing is one-time: Solo $25, Personal $39, Extended $49, or free if built from source under GPL v3. Because the codebase is open, the privacy claim is verifiable — the same reason Ollama, Jan, and LM Studio score highly in our Local LLM category.

Primary source: VoiceInk (tryvoiceink.com)

Deep dive: VoiceInk Review — full investigation

Does Dragon (Nuance / Microsoft) train on my voice data?

Depends entirely on which Dragon product. Desktop is offline; cloud tiers are not separately disclosed.

Dragon is now a multi-product line under Microsoft (acquired from Nuance in 2022) with materially different privacy postures across SKUs. Dragon Professional v16 is a locally installed Windows desktop application — audio is processed on the user's machine, voice profiles are stored locally, and nothing is transmitted to Nuance/Microsoft servers in normal desktop dictation operation. There is no training path because there is no upload. Dragon Anywhere (the iOS/Android mobile product) is cloud-based — audio is transmitted to Nuance/Microsoft for recognition. Microsoft's general Privacy Statement reserves the right to use customer data to develop and train AI models (with opt-out paths surfaced through Copilot privacy controls), and the Dragon-specific product pages do not separately disclose AI-training carve-outs for Dragon Anywhere at the consumer tier. Treat that cell as unverified until Microsoft publishes a Dragon-specific commitment. Dragon Medical One, Professional Anywhere, and Dragon Copilot are enterprise cloud products marketed as HIPAA-compliant when a BAA is in place. The umbrella Microsoft Products and Services Data Protection Addendum excludes Customer Data from foundation-model training, which is the contractual basis healthcare buyers rely on — but Dragon-specific commitments are still primarily contract-level rather than published product commitments. Track record context: the 2017 NotPetya attack disrupted Nuance's hosted services (including Dragon Medical) for weeks. Development on the desktop line has largely stalled since the Microsoft acquisition (v17 ≈ v16); the Mac version was discontinued in 2018 and Dragon Home in 2023. Non-medical Nuance product pages now redirect to Microsoft's health-solutions hub, creating a discovery gap that itself is a buyer risk when trying to verify privacy commitments.

Primary source: Dragon Medical One (Microsoft)

Deep dive: Dragon pricing — full breakdown

Does Spokenly train on my voice data?

No by Spokenly — but the answer depends on which of three modes you use.

Spokenly is a dictation app for macOS, Windows, Linux, and iOS from named solo developer Vadim Akhmerov (disclosed via the App Store, not the privacy policy) with three architectural modes that produce three different privacy postures. Local Only Mode runs OpenAI Whisper Large-v3 and NVIDIA Parakeet locally on Apple Silicon with no network calls during transcription — nothing is transmitted, so there is no training path. The privacy policy (last updated October 12, 2026) adds a caveat to local mode: "When a Mode uses AI Instructions, your transcription and any optional context for that Mode may be sent to AI services for text processing, even if transcription itself runs locally." BYOK cloud mode sends audio and text directly from the device to whichever provider you supply API keys for, and per the policy that data "never passes through Spokenly's servers"; Spokenly does not train on it, but the chosen provider's terms govern training and retention. Pro managed cloud ($9.99/mo or $99.99/yr) forwards audio to third-party transcription services — the October 2026 policy names fourteen: OpenAI, Deepgram, Soniox, Cartesia, ElevenLabs, Groq, Mistral AI, xAI, Microsoft Azure, Google Cloud, AssemblyAI, OpenRouter, fal.ai, and Cerebras, and notes that OpenRouter may route requests onward. The policy's load-bearing claim is that Spokenly's backend "does not store these recordings"; on training it says only that Spokenly prefers "options that do not use customer data for model training where available," a hedged preference rather than a guarantee. One exception to "not stored": Spokenly's new ChatGPT and Claude plugins keep an encoded copy of the audio, the transcript, and file details on its backend, each expiring "no later than one hour after it is stored." The policy also says analytics are linked to your account when you are signed in, while the App Store label still says "Data Not Linked to You." Three structural caveats apply regardless of mode: no SOC 2 / HIPAA BAA / ISO 27001 / GDPR / CCPA attestations (disqualifying for regulated work), no disclosed corporate entity or jurisdiction (only admin@spokenly.app as contact), and an iOS keyboard caveat where the developer's own App Store reply recommends switching to online models for keyboard reliability — which defeats the on-device benefit. App Store rating is 4.3/5 from 61 ratings (v1.13.0, October 2026). Spokenly also sells a one-time Local+ license ($19) and a Team plan (multi-seat Pro at 30% off) with no BAA or attestation.

Primary source: Spokenly privacy policy (updated 2026-10-12)

Deep dive: Is Spokenly Safe? — full investigation

Does Handy train on my voice data?

No — there is no Handy server to send audio to, and the MIT source proves it.

Handy is a free, MIT-licensed push-to-talk dictation app for macOS, Windows, and Linux maintained by CJ Pais. Its privacy claim is one sentence on handy.computer and in the README: "Your voice stays on your computer. Get transcriptions without sending audio to the cloud." Handy published its first privacy policy, effective September 18, 2026, at handy.computer/privacy (the page returned HTTP 404 on September 10). It states: "During ordinary transcription, Handy does not send your microphone audio or transcription content to the Handy maintainers or to Handy servers," and "Handy does not contain advertising, behavioral analytics, or user-tracking telemetry." It has no training clause, which is moot because no vendor server receives audio or text. Audio passes through bundled Silero voice-activity detection and a locally downloaded speech model (Whisper, Parakeet, and other families). Default network calls are an update check against GitHub Releases ("enabled by default and can be disabled in Handy's settings") and model downloads from Hugging Face, with blob.handy.computer, delivered via Cloudflare, as the fallback. Optional cloud post-processing is "disabled unless you configure and invoke it"; when used, transcript text, never audio, goes directly to the provider you pick (OpenAI, Anthropic, OpenRouter, Groq, Cerebras, Z.AI, AWS Bedrock, or a custom endpoint), and "Handy's maintainers do not receive or proxy this content." By default Handy keeps a limited number of recent history entries and their audio recordings locally, without separate application-level encryption. The README's "Opt-in Analytics" roadmap item was removed on September 18, 2026. The repository has 33,600+ stars and 3,100+ forks with no CVEs or advisories through v0.9.8 (October 3, 2026). What Handy lacks is a legal entity — a privacy policy now exists, but there is no DPA, BAA, or SOC 2. For an individual who wants on-device dictation at $0, that is a fair trade; for regulated work it means you are relying on your own audit.

Primary source: Handy privacy policy (effective 2026-09-18)

Deep dive: Is Handy Safe? — full investigation

Does OpenWhispr train on my voice data?

No, in writing across all three modes — but which mode you use decides who else sees your audio.

OpenWhispr is an MIT-licensed desktop client (9,300+ GitHub stars) from Gizmo Labs Inc., a Delaware corporation, that grew a hosted product in 2026. The privacy policy (last updated October 12, 2026) describes three paths. Local mode runs Whisper or NVIDIA Parakeet on-device and "no audio is transmitted anywhere"; the desktop app now keeps dictation audio locally for 30 days by default (adjustable up to 90 days, or off), and "Retained audio is never synced to OpenWhispr Cloud." BYOK sends audio directly to the provider whose key you supply, under that provider's terms; API keys are now "encrypted on your device (AES-256)" with the key held in the OS credential store, and are saved unencrypted only where no store exists, as on some Linux setups. OpenWhispr Cloud sends audio to OpenWhispr's API, or straight to a speech-to-text provider for live transcription, where it is "processed in real time, and not stored by us" — the "0% Data Retention" claim — with subprocessors OpenAI OpCo, LLC, Parasail, Inc., Groq, Inc., and Deepgram (live speech-to-text; listed in the policy but not yet in DPA v1.4 Annex 3). Note text stored in the cloud is sent to OpenAI for search indexing, and per-request service logs are recorded whatever your settings. The no-training commitment is contractual, not just marketing: the Terms of Service (last updated September 11, 2026) state "We will not use Customer Content — audio, transcriptions, notes, or AI agent prompts — to train any artificial intelligence or machine learning model," and DPA v1.4 (updated October 12, 2026) bars training of any model, "whether OpenWhispr's own or a third party's," and does not permit subprocessors to do so. On account deletion, the policy says synced content is deleted straight away, and within 30 days at the latest. The DPA lists a SOC 2 Type 2 report (May 1–July 31, 2026), ISO/IEC 27001:2022 certificate KCISM202607012 issued by KVQA Certification Services (valid to July 27, 2027), and HIPAA / GDPR attestations — vendor statements; the SOC 2 auditor is not named. A BAA is available for Business ($13.33/user/mo billed annually) and above, and the DPA says covered entities must not process PHI through the cloud without one. Free is $0 with 2,000 cloud words/week; Pro is $6.67/user/mo billed $80/yr.

Primary source: OpenWhispr privacy policy (updated 2026-10-12)

Deep dive: Is OpenWhispr Safe? — full investigation

Does FluidVoice train on my voice data?

No — audio and text stay on the Mac; the only thing sent to the vendor by default is anonymous usage metadata.

FluidVoice is a free macOS dictation app whose app source is GPLv3 (since February 23, 2026; Apache 2.0 before that) at github.com/altic-dev/FluidVoice, with 12,000+ stars and releases through v1.6.11 on October 12, 2026, which added FluidMeet local meeting recording with on-device captions and speaker labels. The README is the governing privacy text because no formal policy document exists: "Your voice, audio, and transcribed text never leave your machine unless you explicitly opt in to a cloud AI provider." Every speech model — Whisper, Parakeet, Nemotron, Cohere Transcribe, Apple Speech — is a local download, and the enhancement runtime Fluid Intelligence (the Fluid-1 model, about 3.5 GB) also runs offline. That runtime is the one closed component: "We're keeping Fluid Intelligence private for now so we can sustainably offer the core dictation experience for free." You can verify it sends nothing; you cannot audit what it changes. Two defaults matter. First, FluidVoice records one anonymous activity signal per day (random installation ID, activity date, app version, macOS platform label) and uploads the week's batch even when detailed analytics are off — the README says "when disabled, only the weekly activity batch is sent." "Detailed anonymous analytics are enabled by default" and add daily feature and model usage totals, onboarding progress, and model-download outcomes; they can be disabled at Settings → Share Detailed Anonymous Analytics. The README states voice, audio, transcripts, prompts, and clipboard content are not collected, and no retention window for that metadata is published. Second, optional cloud enhancement can send transcript text to OpenAI, Groq, or a custom provider with your own key (stored in the macOS Keychain), under that provider's terms. Requirements: macOS 15 or later; Apple Silicon for everything except Whisper on Intel. There is no legal entity, DPA, BAA, or compliance attestation published, and no documented incidents. Download only from GitHub Releases or fluidvoice.com / altic.dev; on October 3, 2026 the developers warned that fluidvoice.org is not official.

Primary source: FluidVoice GitHub repo (GPLv3)

Deep dive: Is FluidVoice Safe? — full investigation

Does VoiceDash train on my voice data?

Not for VoiceDash's "own general-purpose" models, per its October 2026 policy — a narrower promise than before, and every dictation still goes to OpenAI.

VoiceDash is a cloud-only dictation app for Mac and Windows from Jumpstart Ventures FZE in Dubai Silicon Oasis (the entity is named in the DPA, not the privacy policy), founded February 2025. The privacy policy, dated for the first time (Last Updated October 5, 2026), states that VoiceDash "may transmit your voice input and the related content … to OpenAI through its API services," that "Voice recordings and transient transcription data are not intended to be retained permanently by VoiceDash" (no window is given), and that "VoiceDash does not use your voice recordings or transcriptions to train or improve VoiceDash's own general-purpose AI models." Both replace stronger undated wording: previously VoiceDash "does not store your voice files or transcriptions on our servers," and "Your voice data is strictly excluded from our machine learning training sets." The new training clause does not address personalized, specialized, or third-party models. The October 5 policy also covers recorded meetings and an optional read-only Google Calendar connection, under which attendee names and emails may be used for speaker-renaming suggestions and stored with the meeting session; Notes and meeting sessions persist until deleted. The Data Processing Addendum effective May 26, 2026 adds that data is "processed transiently, structurally excluded from AI model training loops," commits to TLS 1.3 in transit and AES-256 at rest, and names nine subprocessors: OpenAI, Groq, Cloudflare, Hetzner, Sentry, Metabase, CustomerIO, RevenueCat, and Apple — Groq does not appear in the privacy policy, which names only OpenAI and Google. Downstream, OpenAI's API data-usage page confirms API inputs are not used for training by default and that abuse-monitoring logs are retained up to 30 days unless a Zero Data Retention arrangement is approved. The homepage advertises "Zero Data Retention processing through its OpenAI partnership," and the founder told AppSumo buyers a formal BAA had been signed with OpenAI, but neither claim appears in the policy or DPA, so treat both as unverified. No SOC 2, ISO 27001, or HIPAA attestation is published and the DPA contains no BAA language. Pricing: Free (1,000 words/mo), Pro $15/mo or $12/mo billed yearly, Teams $29/mo or $24/mo billed yearly for up to five members. AppSumo rating 4.42/5 from 234 reviews; no documented incidents.

Primary source: VoiceDash privacy policy (updated 2026-10-05)

Deep dive: Is VoiceDash Safe? — full investigation

Does Paraspeech train on my voice data?

Not guaranteed in cloud mode — the policy now says it makes no no-training guarantee for Deepgram; local mode with Privacy Mode on avoids the question.

Paraspeech is a macOS 14+ dictation app (with an iOS Voice Keyboard) from Burlis Management GmbH, Philippstrasse 27, 52349 Dueren, Germany, priced at $14.99/mo, $99/yr, or a local-models-only Lifetime license. It has two data paths. In local mode on Apple Silicon, docs state "When the active speech-recognition backend is local, speech audio is transcribed on your Mac," and "Supported local modes can run offline after setup"; the privacy policy (last updated October 4, 2026) adds that "the last audio file is stored locally on the user's device until replaced by a new recording or deleted by the user." Local is not automatic, though: the docs say "Cloud Cleanup is the default for eligible cloud access" and "Eligible dictation can temporarily use cloud processing online when a local model is not ready"; Privacy Mode "blocks cloud transcription and cloud rewriting for dictation" but not Meeting Mode's automatic cloud summary. In cloud mode, "When a user selects or is eligible for cloud transcription, Paraspeech may transmit selected audio and related request metadata to Deepgram for cloud transcription," and the Cloud Cleanup rewrite sends "selected transcript text, prompt text, rewrite instructions, and related request metadata" to Groq and Cerebras. "Eligible for" covers Intel Macs, which "use cloud models with a subscription" and have no local option. On training, the October 4 policy says Deepgram's model-improvement program "can retain submitted audio and transcripts unless the applicable account or request is excluded," and that "This disclosure does not make a zero-retention or no-training guarantee for Deepgram"; it does not say whether Paraspeech's account is excluded, and it contains no Paraspeech-side training clause beyond the optional transcript-feedback feature. Provider retention is now published: Groq up to 30 days for reliability or abuse investigations, and Cerebras "does not retain user prompts or model outputs." A new Meeting Mode sends the meeting transcript and speaker and timing information through Paraspeech's servers to OpenAI for summaries ("meeting audio is not sent for summary generation"); the policy says "We disable response storage and prompt caching," and OpenAI abuse-monitoring logs may retain content for up to 30 days. Analytics vendors are PostHog, Cloudflare Web Analytics, Ahrefs, Simple Analytics, and Dub.co, plus Sentry and Apple Ads install attribution on iOS; hosting is Hetzner, Supabase, and Apple; raw journey events are cleared after 90 days. No SOC 2, ISO 27001, HIPAA, or BAA is offered at any tier, including the custom Enterprise plan. The iOS app's App Store privacy label (v1.0.4) lists Audio Data under "Data Linked to You." No documented incidents.

Primary source: Paraspeech privacy policy (updated 2026-10-04)

Deep dive: Is Paraspeech Safe? — full investigation

Does Voicy train on my voice data?

No, per the homepage — but the commitment does not appear in either governing policy.

Voicy's homepage states: "We do not use your recordings to train an AI model or for any other purpose." That sentence does not appear in Voicy's Data Handling and Security Policy (version 1.3, last updated July 31, 2025) or in its undated privacy policy; neither document contains the word "train." What the policies do commit to is deletion: "No audio recordings are stored by Voicy or Groq - all audio data is permanently deleted immediately after processing" and "All transcribed content is immediately deleted after delivery to the user." Every dictation is relayed through Voicy's Heroku-hosted servers to Groq, which runs the open-source Whisper V3 model; the privacy policy adds that Voicy has "enabled their Zero Data Retention settings" at Groq and does not use Groq's batch or fine-tuning endpoints. Account data is stored on the user's device rather than in a central database, and Mixpanel analytics can be disabled. Two gaps remain as of October 13, 2026: the privacy policy now says servers are "hosted in the EU and US" while the security policy still says all processing is US-based, and the security policy predates the 2026 iOS and Android apps. Voicy is cloud-only at every tier, including Voicy for Teams ($6.79/user/mo, 3+ users), which carries no separate data terms. No SOC 2, ISO 27001, or HIPAA BAA is published; the operating entity is Pishi LLC FZ (UAE).

Primary source: Voicy Data Handling and Security Policy

Deep dive: Is Voicy Safe? — full investigation

Does Blip AI train on my voice data?

Yes, in de-identified form, unless you email to opt out — the live policy and Terms say so, and a sample of voice recordings may be kept.

Correction logged October 13, 2026: on that date we read Blip AI's live privacy policy for the first time since our June 5, 2026 investigation (the page had returned a Vercel security checkpoint in September), along with its Terms of Service, and both contradict what this entry previously said. The Terms (last updated February 9, 2026) grant Blip AI "a limited, royalty-free license to use anonymized, de-identified transcription data and usage patterns for the purpose of improving transcription quality, accuracy, and our underlying AI models," and the privacy policy lists "To use fully anonymized, de-identified transcription data to train and improve our AI models" as a purpose. The only opt-out is by email: "You may opt out of contributing to quality improvement at any time by emailing privacy@blipai.app"; no in-app toggle is described. The policy also says "A small sample of voice recordings may be retained for quality assurance and AI improvement — always anonymized, never linked to your identity," while its own retention table says voice audio is "Deleted immediately after transcription (seconds)"; anonymized usage statistics are kept up to 2 years and anonymized aggregates "may be retained indefinitely." The policy page is dated March 29, 2025, which predates the product's October 2025 launch, so the date cannot be used to tell when this text was written. The Terms name the providers as "Azure, OpenAI, Groq" and the operator as BLIPLABS PRIVATE LIMITED, governed by the laws of India (Courts of Delhi), while the policy says "Blip AI is based in the United States." The live policy contains no HIPAA or BAA language, unlike our June 2026 reading, and no SOC 2, ISO 27001, or named auditor is published. The App Store listing (seller Ayush Bansal, version 1.0.5, 2 ratings) still carries the label "The developer does not collect any data from this app," which conflicts with the policy. Cloud ("Blip Cloud") is the default on Mac, Windows, Linux, iPhone, and Android; the homepage says an on-device Whisper model can be downloaded for offline dictation, which we could not verify (the Models page returned 404). Pricing: Free (2,000 words/month), Pro $12/month billed yearly ($144/yr), Team $10/user/month billed yearly; the AppSumo deal is sold out.

Primary source: Blip AI terms of service (updated 2026-02-09)

Deep dive: Is Blip AI Safe? — full investigation

Does WisprType train on my voice data?

No in local mode by architecture — the policy never mentions training, and BYOK cloud mode inherits the provider's terms.

WisprType's privacy policy (effective April 29, 2026) does not contain the word "train." What it does state is structural: "By default, all speech-to-text processing happens entirely on your device using WhisperKit," and the Smart Typing cleanup step "runs a local Llama 3.2 3B model entirely on your device via Apple's MLX framework." Audio recordings "are processed in real time and are not retained after transcription completes, unless you explicitly save them." Transcript history, dictionary, snippets, settings, and any API keys live in a local SQLite database under ~/Library/Application Support/com.wisprtype.app/ and are "never transmitted to our servers." In local mode, WisprType has no server-side copy of your speech, so there is nothing for the vendor to train on. Cloud mode is opt-in: "Cloud providers are never used unless you explicitly configure them by entering an API key and selecting cloud mode in Settings," and the supported providers are OpenAI, Groq, and Deepgram; in that mode, your audio and, for Smart Typing, your raw transcript text go to the provider under your own API agreement, so training and retention follow that provider's terms, not WisprType's. Two caveats keep this personal-grade. First, the policy describes PostHog telemetry as "disabled by default," but our July 2026 hands-on test of v1.1.0, still the current build as of October 13, 2026, found it enabled on a fresh install; check Settings → Privacy. Second, no legal entity, terms of service, business tier, SOC 2, or BAA is published, so there is no party to contract with for regulated use. The homepage now describes the app as "Free forever"; it requires macOS 12+ on Apple Silicon.

Primary source: WisprType privacy policy (effective 2026-04-29)

Deep dive: Is WisprType Safe? — full investigation

Does DictaFlow train on my voice data?

No, per its marketing pages and App Store label — the privacy policy itself is silent on training and names OpenAI, Deepgram, and Groq as processors.

DictaFlow's lawyers page (dictaflow.io/legal.html) states "Dictated content is not used to train AI models" — the homepage no longer carries a training statement as of October 13, 2026 — and its App Store privacy label places Audio Data under "Data Not Linked to You." The privacy policy, last updated August 14, 2026 and operated by SmartBids.ai Corp., a Canadian corporation, contains no training clause; its closest commitment is that DictaFlow does "not sell personal information or use dictated audio or text for targeted advertising." The same policy names "OpenAI, Deepgram, and Groq for transcription and related AI processing" (the July 2026 version we reviewed named NVIDIA; that reference is gone), Apple, Google, and Microsoft for sign-in, Google Cloud for hosting, and Stripe for payments. On retention: "We do not permanently retain audio recordings on our servers after processing in the ordinary course" and "Audio is ordinarily discarded after processing," while transcription text "may be retained when needed to provide features you choose, synchronize supported devices, recover a requested result, investigate a support issue, or comply with law." No retention window in days is published. Pro includes "unlimited offline dictation" after a manual model download, but cloud is the default on Windows, AI cleanup and Email mode always use the cloud, and the vendor's facts page (last reviewed October 11, 2026) says the product is never "fully offline." The policy states the standard service is "not intended for medical dictation, clinical documentation, patient care, diagnosis, treatment, or any use involving protected health information (PHI)." DictaFlow Medical Pro ($39/user/mo for 1–4 seats, $29/user/mo for 5+) is a separate build with a published subprocessor list (Deepgram, OpenAI, Groq on allowlisted routes; Railway/Firebase, Resend/Postmark, Stripe), a Medical privacy policy dated July 24, 2026, and a customer-executed BAA as a prerequisite. No SOC 2 or ISO 27001 is published for either product. Consumer pricing: Free with 2,000 cloud words per 30 days; Pro $9/mo or $84/yr (App Store $8.99/mo or $79.99/yr).

Primary source: DictaFlow privacy policy (updated 2026-08-14)

Deep dive: Is DictaFlow Safe? — full investigation

Does Otter.ai train on my voice data?

Yes, by default on de-identified data — opt-out in account settings.

Otter trains automatically on de-identified user data. Recordings and transcripts are not manually reviewed by humans unless the customer gives explicit consent for support troubleshooting; training data is encrypted. Opt-out is by request (privacy@otter.ai or the trust-center form) rather than an in-app toggle, per the June 16, 2026 privacy policy. Four suits filed in the Northern District of California in August–September 2025 (lead: Brewer v. Otter.ai) — alleging Otter "deceptively and surreptitiously" recorded private conversations and used meeting data to train AI models without all-participant consent, under the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, and California Invasion of Privacy Act — were consolidated on October 22, 2025 as In re Otter.AI Privacy Litigation, No. 5:25-cv-06911-EKL, before Judge Eumi K. Lee. On August 13, 2026, Judge Lee granted the motion to dismiss in part and denied it in part: the Wiretap Act, CIPA § 631, both Illinois BIPA voiceprint claims, unjust enrichment, and UCL claims survive, on the reasoning that Otter plausibly "independently collects, retains, and uses communications for its own commercial purposes" — including training — and so may be a third-party eavesdropper rather than the host's tool; CFAA, CDAFA, Washington Privacy Act, and most intrusion claims were dismissed with leave to amend, and the case proceeds toward discovery and class certification. The visible "Otter.ai" bot creates consent issues in the 12 US states with two-party consent laws. Conversations are stored until manually deleted; trash holds for 30 days then auto-purges. Otter holds SOC 2 Type 2.

Primary source: Otter privacy & security

Deep dive: Is Otter Safe? — full investigation

Does Fireflies.ai train on my voice data?

No, per the September 2026 privacy policy — the live litigation is about voiceprint consent, not training.

Fireflies' privacy policy (last updated September 28, 2026) states: "We do not use personal information for AI model training and we contractually prohibit our vendors from using this information for their own model training," and its Zero Data Retention section says meeting content is not used for training by third-party processors; earlier versions of this tracker recorded a default-on training posture, which the current policy text supersedes. Cruz v. Fireflies.AI Corp., No. 3:25-cv-03399 (C.D. Ill., filed December 2025), a class action under Illinois' Biometric Information Privacy Act (BIPA) alleging Fireflies captured all meeting participants' voiceprints without written consent, was terminated in March 2026 and refiled in the Northern District of Illinois; two related N.D. Ill. suits — Fricker v. Fireflies.AI Corp., No. 1:26-cv-02675, and Martinez v. Fireflies.AI Corp., No. 1:26-cv-03512 — were consolidated before Judge Steven C. Seeger with Fricker as the lead case and Werman Salas P.C. as interim class counsel; Fireflies moved to dismiss for lack of jurisdiction and failure to state a claim on July 15, 2026 (fully briefed August 26), discovery is stayed pending the ruling, and no ruling had issued as of October 13, 2026. The visible "Fireflies.ai Notetaker" bot creates consent complications in two-party consent jurisdictions. Audio, video recordings, transcripts, speaker identification, and meeting metadata are stored until manual deletion; voice characteristics used to separate speakers are processed by service providers and, per the policy, never stored on Fireflies' own servers. Account deletion is processed within 30 days. Fireflies is GDPR compliant.

Primary source: Fireflies privacy policy

Deep dive: Is Fireflies Safe? — full investigation

Does Granola train on my meeting data?

Yes, by default for consumer — Enterprise plans have training off by default.

Granola uses de-identified user data to train internal AI models supporting its services by default. The opt-out exists only for Granola users; other meeting participants have no notice and no opt-out path. Enterprise users have training off by default. Third-party LLM providers (OpenAI, Anthropic) are contractually prohibited from training on Granola data. That training default is now the subject of litigation: Chamberlain v. Granola, Inc., No. 3:26-cv-07926 (N.D. Cal., filed July 30, 2026) is a putative class action alleging Granola intercepts and records virtual-meeting participants without their knowledge or consent and uses their communications to train its AI models by default, claiming violations of the federal Wiretap Act (ECPA), California Invasion of Privacy Act §§ 631–632, CDAFA, common-law intrusion upon seclusion, the UCL, and unjust enrichment. Because Granola captures system audio rather than joining meetings as a visible bot, participants who aren't Granola users get no indication recording is happening — the complaint quotes Granola's own marketing that "other people in the room won't know." The parties have twice stipulated to extend Granola, Inc.'s response deadline (August 20 and September 28, 2026); on October 6 they stipulated to the filing of a first amended complaint, and Granola opposed the plaintiff's motion to reset the initial case-management deadlines on October 9. As of October 13, 2026 Granola had filed no answer or motion to dismiss and there was no ruling. To opt out, turn off "Use my data to improve models for everyone" under Settings → Preferences → Data & sharing; on Business each user must do this individually, the opt-out covers future training only, and the toggle is not yet in the Android app. Architecturally, audio is cached only during the meeting and deleted once transcription completes, but it is sent to cloud transcription providers (Deepgram, AssemblyAI) and summarization uses cloud LLMs (OpenAI, Anthropic). Transcripts and notes are stored in a US-hosted AWS Virtual Private Cloud, encrypted at rest and in transit, backed up daily, and kept indefinitely unless a retention policy is set.

Primary source: Granola privacy policy

Deep dive: The Granola lawsuit, explained — full analysis

Does Zoom AI Companion train on my meeting data?

No — contractual prohibition on training across customer content.

Zoom AI Companion does not train Zoom's or third-party AI models on customer audio, video, chat, screen sharing, attachments, or other communications-like content. The commitment is contractual rather than an opt-out — it is stated directly in both the Zoom Privacy Statement and the AI Companion Security & Privacy page. The architecture itself is the honest qualifier: AI Companion uses a federated approach that routes prompts through Zoom-hosted models plus third-party models from Anthropic, OpenAI and Google (Gemini), with Perplexity for web search, ElevenLabs for Clips avatars and Azure Speech Translation for live translation (per Zoom's models whitepaper, checked October 13, 2026). Customer content is processed to deliver features, retained for a period, and shareable inside the org account (hosts and admins can access transcripts and summaries from any meeting they organize or join). Enterprise admins can elect the Zoom-hosted Models Only (ZMO) deployment, which keeps processing inside Zoom infrastructure and removes external subprocessors from the path. BAA is available for specific HIPAA-regulated configurations. Track record context: in August 2023, Zoom quietly added ToS language that would have permitted training on customer content; after The Verge coverage and public outcry, Zoom walked it back and committed to no training without consent, later hardening that to an absolute prohibition. No known breaches of AI Companion content. On September 25, 2026, Sheldon v. Zoom Communications, Inc., No. 3:26-cv-10962 (N.D. Cal.), was filed as a putative class action under the Illinois Biometric Information Privacy Act, alleging (per ClaimDepot's summary of the complaint) that AI Companion and ZoomMate capture Illinois meeting participants' voiceprints without written consent or a public retention policy; it is a biometric-consent claim, not a training claim, and no response had been filed as of October 13, 2026. The Feb 2 2026 Privacy Statement update expanded the definition of "Customer Content" to cover content created using Zoom products beyond meetings, webinars, and messages — the no-training commitment continued to apply, and later revisions on July 27 and September 17, 2026 (the latter clarifying that the statement does not cover sales of business contact data through Zoom Common Room) left it unchanged.

Primary source: Zoom AI whitepaper — data governance & privacy

Does Fathom train on my meeting recordings?

Yes, by default on de-identified meeting content for Fathom's own models — with an in-app opt-out; its third-party AI vendors may not.

Fathom's privacy policy (last updated August 16, 2026) states: "Based on how you configure your account settings, we may use and create de-identified data generated from Meeting Content Information to improve our Service by training, improving, and customizing our in-house artificial intelligence models. You can opt out from this use of your data in your account settings." The help-center article "Is Fathom secure?" confirms the default is on — "Fathom uses de-identified customer data to improve the accuracy of our proprietary AI models" — and that individuals opt out under Settings while organizations on Team Edition can opt out every user from Organization Settings. The same policy draws a line for outside vendors: "We do not authorize third parties (e.g., OpenAI, Anthropic, Google, etc) to use your personal information or Meeting Content Information to train their artificial intelligence models," and the help center names Anthropic, OpenAI and Google as the AI sub-processors. Fathom collects audio and video recordings, transcripts, speaker identification, calendar data, attendee names and emails, and voiceprints in its iOS app; all data is stored in the United States. There is no published retention window for active accounts — data is kept "as long as necessary" — but on account deletion recording data is removed and backups purge after a further 7 days. Pricing: Free, Premium $20/mo ($16 annual), Team $19/$15, Business $34/$25, Enterprise custom; a HIPAA BAA and custom retention appear only on Enterprise. Fathom states SOC 2 Type II, HIPAA and GDPR compliance and no ISO 27001. As of September 10, 2026 no lawsuit or regulator action names Fathom; the 2026 wiretap wave targets Otter, Fireflies and Granola.

Primary source: Fathom privacy policy (Aug 16 2026)

Deep dive: Is Fathom Safe? — full investigation

Does tl;dv train on my meeting recordings?

No — the policy excludes Customer Content from training by tl;dv and its AI providers; the 2026 concern is a six-month Firestore exposure, not training.

tl;dv's privacy policy (last updated September 9, 2026; Tldx Solutions GmbH, Aachen, Germany) states that Customer Content — meeting recordings, transcripts, notes and files — is not used "to train, fine-tune, or improve foundation models, large language models, or other generative AI models," and that third-party AI providers process it "solely to provide the requested functionality" without training their general-purpose models. The security page repeats: "No customer data is used to train the AI." Named processors are Anthropic and Google Vertex AI for AI features and AssemblyAI and ElevenLabs for transcription; hosting is on Google Cloud, Hetzner and Wasabi, primarily in Germany and Finland, with AI processing selectable in the US or EU. Retention: free users' recordings are deleted after 3 months; paid users' data is kept until account deletion; logs 10 days; data on non-client meeting participants up to 5 years or until a deletion request. Certifications stated: SOC 2, ISO 27001, PCI DSS, GDPR; no HIPAA. The track-record issue is security, not policy. Researcher bobdahacker reported on January 28, 2026 that a missing tenant-isolation rule on the Firestore "meetings" collection let any authenticated account enumerate 181,874 meeting records across 84,312 users — creator emails, conference IDs, recording status, timestamps — including roughly 1,000 joinable live calls; follow-ups through July 22 went unresolved and the write-up was published August 4, 2026. tl;dv told GIGAZINE on August 13, 2026 that these were "two separate vulnerabilities," that no audio, transcripts, AI notes, passwords or billing data were reachable, that the second vector was patched within 24 hours of discovery, and that Firebase has been removed from its infrastructure. As of October 13, 2026 no lawsuit or regulator action names tl;dv. Pricing moved to tldv.io/app/pricing, which on October 13, 2026 showed EUR prices: Pro €29 per seat per month (€18 on annual billing) and Business €39 (€29 annual); no Enterprise price is shown.

Primary source: tl;dv privacy policy (Sept 9 2026)

Does Read AI train on my meeting recordings?

Not unless you opt in — model improvement is off by default, and Workspace-API data is excluded from generalized training.

Read AI's privacy page states: "Contributing to model improvement is off by default. You decide - and can change your mind any time." The privacy policy (last updated June 29, 2026) implements this as a Customer Experience Program you "opt-in or opt-out" of in account settings, and adds: "We do not, and do not permit third party AI tools to, use user data collected via Google Workspace APIs to develop, improve, or train generalized/non-personalized AI and/or ML models." The policy does not name its third-party AI providers. What Read collects is broader than a typical notetaker: meeting audio and video, transcripts, and — when Google integrations are connected — Gmail message bodies and metadata, Google Calendar events and guest lists, and Google Chat messages. Audio and video are stored "in no case for longer than 2 years"; users can delete reports they own, and any participant who types "opt out" in chat has the meeting's data "immediately and permanently deleted." Read announces itself at the start of every meeting and requires host approval before joining. Since March 26, 2026 it also offers a botless Google Meet mode built on the Meet Media API, free for all customers, plus desktop and mobile apps that record "locally or to the cloud without a bot"; transcription and analysis still run in Read's US-hosted cloud. Pricing: Free, Pro $19.75/mo ($15 annual), Enterprise $29.75/$22.50, Enterprise+ $39.75/$29.75; HIPAA support, SAML/SCIM and a custom retention policy are Enterprise+ only. Read states an annual SOC 2 Type II audit, HIPAA technical safeguards with a BAA on request, and AES-256 / TLS 1.2+ encryption; its support-center security articles and trust portal could not be fetched, so the audit report is unverified. As of October 26, 2026 no lawsuit or regulator action names Read AI.

Primary source: Read AI privacy policy (June 29 2026)

Deep dive: Is Read AI Safe? — full investigation

Why does Read AI keep joining my meetings?

Because someone else invited to the meeting has Read connected — it can join even if that person doesn't attend.

Read AI's Account & Privacy Center answers this directly: "If someone else invited to the meeting has Read connected, it may still join—even if they don't actually attend the meeting." Deleting your own account doesn't stop it, because the invitation comes from a colleague's calendar. The help center says the meeting chat shows who invited Read. University of Memphis IT described the loop in October 2024: Read "records all content and emails summaries to the participants"; to see the full notes, users created their own Read AI account; "Read AI then attempts to join all Teams meetings of the new user. Through this method, Read AI is able to quickly propagate throughout an organization." Read's current help center says report access is set by the report owner. Anyone in the call can type "opt out" in chat to remove Read and delete the meeting's data, or "Read stop" to remove it and keep the report so far; the host can also remove it like any participant. Read can't delete another user's reports at a third party's request, corporate IT included, so a company-wide fix means asking colleagues to disconnect it or blocking it at the Zoom, Teams or Google Meet admin level, as Memphis, Case Western Reserve, CUNY, UC Riverside, Morgan State and Eastern Washington have done.

Primary source: Read AI Account & Privacy Center

Deep dive: Is Read AI Safe? — how the bot spreads

Does Notta train on my recordings and transcripts?

Not published — Notta's policy excludes only Google Workspace API data from training and says nothing about its own models on your audio.

Notta's privacy policy (effective September 2, 2025; contracting entity Notta PTE. LTD. in Singapore, or Notta 株式会社 for Japan users) contains one sentence about model training, and it is scoped to a single data source: "Google Workspace APIs are not used to develop, improve, or train generalized/non-personalized AI and/or ML models." Nothing in the policy, the terms of service (effective September 2, 2026) or the security page states whether audio you upload or record, or the transcripts Notta generates, are used to train Notta's own models. The policy lists "To analyze and improve our Services" as a purpose, and the terms grant Notta a licence to "access, process, copy, export, and display Customer Data" for service purposes. Secondary blogs describe an opt-out setting or a support-request opt-out; no Notta page fetched on September 10, 2026 shows one, so that claim is unverified. Retention is also not published in the policy: a Notta help-center search snippet (the article itself returned 403) says transcription data is stored indefinitely unless the user, workspace or account deletes it, and that automatic file deletion (1–365 days) is an Enterprise-only setting. Notta collects audio, video, voice and text inputs, account, device, IP, location and usage data; it hosts on AWS with no region stated, and encrypts with TLS 1.2 in transit and AES-256 at rest. The security page states SOC 2 Type II through an independent audit, ISO 27001, GDPR and CCPA compliance, and that Notta "follow[s] HIPAA guidelines"; no BAA is offered on any fetched page. Notta Desktop (public beta, macOS 13+ / Windows 10+) records without a bot but transcribes in the cloud. Pricing: Free 120 min/mo, Pro $13.61/mo ($8.17 annual), Business $27.78/$16.67, Enterprise custom from 51 seats. As of October 13, 2026 no lawsuit, breach or regulator action names Notta.

Primary source: Notta privacy policy (effective Sept 2 2025)

Does Google train on my Meet "Take notes for me" transcripts?

Not on Workspace accounts, by contract; on personal Google AI Pro / Ultra accounts the exclusion is not published.

The answer splits by account type. For work and school accounts, the Google Workspace generative-AI privacy hub (updated August 14, 2026) states: "Workspace does not use customer data for training models without customer's prior permission or instruction" and "Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission." Meet is listed among the covered apps, prompts are customer data under the Cloud Data Processing Addendum, Gemini in Meet is covered by the Google Business Associate Agreement, and admins can disable Gemini in Meet, require participant consent, and set retention ("90 days to indefinite, as determined by admins"). The notes document "is saved in the meeting organizer's Google Drive in the 'Google Meet' folder" and "follow[s] the Meet retention policy that your organization has configured." For personal accounts, Google opened "Take notes for me" to Google AI Pro and Ultra subscribers on June 29, 2026. No Google page fetched says whether those transcripts are exempt from training. The Gemini Apps Privacy Hub (updated August 10, 2026) says Gemini Apps Activity — including audio and Gemini Live video — is used to "provide, develop, and improve its services (including training generative AI models)," that "a subset of chats are reviewed by human reviewers," and that activity auto-deletes after 18 months by default; whether Meet notes are logged as Gemini Apps Activity is unverified. In both cases Meet notifies every participant that notes are being taken. Track record: Thele v. Google LLC, No. 5:25-cv-09704 (N.D. Cal., Judge Noël Wise), filed November 11, 2025, alleges Google switched Gemini "smart features" on by default across Gmail, Chat and Meet on or about October 10, 2025, in violation of CIPA and the Stored Communications Act. On July 7, 2026 the court dismissed the first amended complaint for lack of concrete harm with leave to amend; a Second Amended Complaint was filed August 18, 2026, and Google stipulated on August 20 to extend its response deadline. No merits ruling exists.

Primary source: Workspace generative-AI privacy hub (Aug 14 2026)

Does Voibe Work train on my meetings, and where are the notes stored?

No training. Audio is deleted after processing; transcripts and summaries are saved on your computer, not Voibe's servers.

Voibe Work is Voibe's meeting-notes plan (launched September 2026, Mac and Windows). It captures the meeting from your computer in Zoom, Microsoft Teams, Google Meet, Webex, Slack huddles or any other app, with no bot joining the call, and can record in-person meetings through the computer's microphone. Per Voibe's homepage, meeting audio "is processed by open-source models on zero-retention cloud providers and deleted as soon as processing completes," and meetings and notes are "never used to train any AI model, ours or anyone else's." The finished transcript and summary are stored on your device rather than in a vendor cloud, and "chat with your meetings" runs on the same zero-retention cloud without storing your questions. Meeting notes are not an on-device or offline feature: processing needs an internet connection (Voibe's on-device mode applies to dictation on Apple Silicon Macs only). Because no bot announces itself, Voibe reminds you at recording start to tell everyone you're taking notes; you remain responsible for the recording-consent rules that apply to your meetings and location. A BAA is available on request.

Primary source: getvoibe.com (Voibe Work)

Does Abridge train on my patient conversations?

Yes, on de-identified data — and since August 2026 the exact terms are in your health system's BAA, not a public policy.

Abridge is an ambient clinical scribe sold only to health systems; there is no individual plan. Its archived privacy policy (effective December 1, 2022) stated: "We use de-identified data for research and development of new products or tools, to refine our algorithms and machine learning applications, and to improve the Services." The policy last updated August 27, 2026 drops that sentence and says Customer Data "is governed exclusively by the terms of our agreements with those customers, including our Business Associate Agreements (BAAs)." On June 11, 2026, Abridge and Nvidia announced a clinical-conversation model trained on de-identified doctor–patient conversations from Abridge's platform of roughly 100 health systems. The training term is negotiable at the contract level — Kaiser Permanente told The Markup (June 16, 2026) it does not allow its data to be used for training — but no clinician- or patient-level opt-out is published. Abridge does not publish an audio-retention window; customer FAQs cite 30 days (CPCMG) and 14 days (Kaiser) for audio and transcripts, with the finalized note living in the EHR. Litigation targets Abridge deployments rather than Abridge: Saucedo v. Sharp HealthCare (San Diego Superior Court, filed November 26, 2025) alleges recording without all-party consent under California's CIPA and that the tool inserted "consented" statements into charts; Washington et al. v. Sutter Health, No. 4:26-cv-03012-HSG (N.D. Cal., filed April 7, 2026) alleges CIPA, CMIA, UCL, and federal Wiretap Act violations; the MemorialCare defendants were severed on August 4, 2026, the second amended complaint names Sutter Health only, and Sutter's motions to dismiss were taken under submission on October 6, 2026 with a written order pending. Abridge's trust center lists Google Cloud and OpenAI among its data service vendors. Abridge holds SOC 2 Type 1 and 2 and TX-RAMP, states it is HIPAA-aligned, and signs BAAs. For comparison, Microsoft's Dragon Copilot puts its no-training commitment in the Microsoft Products and Services DPA, a published document.

Primary source: Abridge privacy policy (Aug 27, 2026)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Freed train on my clinical notes?

Yes, on de-identified notes, gated by a Platform setting whose default Freed does not publish — check it on day one.

Freed is a self-serve AI scribe for individual clinicians (Starter $39/mo annual or $59 monthly for 40 notes, Core $79/mo, Premier $104/mo annual or $119 monthly; 7-day trial; Groups on custom pricing). Its security page states: "AI is only trained on de-identified notes." The Platform Terms of Use (last updated August 13, 2026) are more specific: Freed may use De-identified Data "to train the AI/ML models to improve the Platform, including but not limited to improving the Platform accuracy, efficiency and quality of speech recognition and Output, with your consent provided via Platform settings," and will "link your De-identified Data with your customer ID and use it to customize and train our Platform based on your specific styles and requirements." The same Terms give Freed "the right in our sole discretion to use De-identified Data and to disclose such De-identified Data to third parties." Freed states "Protected health information is never used for AI training purposes." Whether the consent setting is on or off at sign-up is not published. On retention, Freed states "Patient recordings are saved only until the note has been completed, then automatically deleted," with a settings option to "delete the Patient Recordings immediately once they are processed"; notes follow a user-chosen 30-day auto-delete or term-of-agreement window. Data is hosted on Microsoft Azure in the United States. Freed holds SOC 2 Type 1 and 2, states it is HIPAA- and HITECH-aligned, and signs BAAs (the BAA is Schedule A of the Terms). No breaches, lawsuits, or regulator actions naming Freed were found as of October 13, 2026.

Primary source: Freed Platform Terms of Use (Aug 13, 2026)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Heidi Health train on my consultation data?

On the free plan, yes — since September 29, 2026 Heidi may train on de-identified free-plan content; paid individual plans and organisation customers are excluded.

Heidi Health is an Australian AI scribe with a free tier, a Clinician plan with a 14-day trial (Standard or Max seats), and Teams and Enterprise contracts; the pricing page shows no dollar amounts. Heidi's Privacy Policy and Heidi Scribe Terms of Use, both dated September 29, 2026, replace all earlier regional policies and split training by plan. For paid individual plans: "We do not use Content from paid individual plans, or De-identified Information derived from that Content, to train, fine-tune or otherwise improve any AI model." For organisation customers: "No customer data (including outputs) is used as an input to train, fine-tune or otherwise improve any AI model, whether operated by Heidi or by any third party." For the free plan, Terms §4.3 says users "agree that we may create De-identified Information from your Content ... and use it to develop, train, test and improve our models," applying to free-plan Content from the date the new Terms take effect for that user; the only published way to avoid it is a paid plan. The policy also says Health Information is not used "as an input to train, develop or improve any AI model." US free-plan users now see clearly labelled sponsored content, selected from de-identified, segment-level usage topics; Heidi says sponsors never receive identity, queries, notes, transcripts or Health Information. The older support article "How Heidi protects your data" (July 23, 2026) still says "Heidi does not use consultation data, session transcriptions, or generated notes to train its AI model in any way"; the September 29 Terms are the later and more specific document. On retention, audio "is used to create your transcript and is deleted as soon as processing is complete, unless you enable a feature that saves recordings"; organisation auto-deletion runs 1 to 90 days, and individual session data is kept "As configured by you, or until you delete it" (the compliance FAQ describes never delete as the default). Heidi II, announced September 28, 2026 and not offered in the UK or EU, adds agents, memory, computer use and connectors. Health information is stored in the user's own jurisdiction (Australia, UK, US, EU, Canada). Heidi lists ISO 27001, ISO 42001, and SOC 2 Type 2, states it is HIPAA-aligned, and says "We make a BAA available to every covered entity we work with." Heidi says it has raised US$436.6M. No breaches, lawsuits, or regulator actions naming Heidi were found as of October 13, 2026.

Primary source: Heidi Scribe Terms of Use (Sept 29, 2026)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Nabla train on my encounter audio?

Not by default — only on de-identified audio you choose to submit as feedback, which Nabla then keeps indefinitely.

Nabla is a French-founded ambient scribe hosted on Google Cloud, with U.S. client data in U.S. regions and non-U.S. data in EU (Belgium) data centers; Azure handles speech-to-text in U.S. regions. Its trust center states: "By default, we don't store audio." and "We retain clinical notes for a short period of time (14 days), which is configurable by client based on geographic region requirements" — the shortest published note window among the clinical scribes in this tracker. The only training path Nabla documents is optional feedback. Its help center says: "All audio is anonymized immediately upon sharing and original audio replaces PHI with a 'beep' sound," "Only the de-identified file is stored," and "Audio is stored in our Feedback database indefinitely." The companion Feedback article states that feedback is used for training Nabla and for troubleshooting; that article returned 404 on September 10, 2026, so the wording is per its search-index text and marked unverified. The public privacy policy (May 16, 2023) covers website visitors only and says nothing about clinical audio. Nabla lists SOC 2 Type II (November 2024–October 2025 period), ISO 27001 (September 2025), and TX-RAMP Level 2 (January 2026), states it is HIPAA- and GDPR-aligned, and lists BAA terms among its trust-center documents; BAA availability on self-serve plans is not published, and Nabla publishes no prices. University of Iowa Health Care's patient FAQ states "Nabla does not retain the audio recording." No breaches, lawsuits, or regulator actions naming Nabla were found as of October 13, 2026; a January 2026 Verite News story questioned patient-consent practice at an LCMC Health deployment (page not retrievable, unverified).

Primary source: Nabla Trust Center

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Suki train on my dictation and visit data?

Yes, on de-identified data, under a Terms-of-Service license with no published opt-out.

Suki is an ambient scribe and dictation assistant sold to practices and health systems; no self-serve pricing page was found (the /pricing and /security URLs return 404). Suki's developer security documentation states: "Any data that is used for ML training and improving the product is de-identified." It describes the method: "For audio, we use a de-identification algorithm that breaks audio into chunks and isolates them such that the original audio cannot be re-constructed," and "We de-identify the transcript by removing all PII." The Terms of Service make the permission contractual: Suki may access Customer Data "for the purpose of using the Customer Data for system tuning, grammar tuning, training of acoustic models and other models, tools and algorithms," and "Suki owns all rights in and to any aggregated, non-identifiable data it develops or creates." The privacy policy (last updated May 16, 2025) does not mention model training, and no opt-out toggle or contractual opt-out is published — a customer that wants one must negotiate it. Retention is published: audio and transcripts are "permanently deleted after 30 days," and clinical notes are retained for the duration of the service contract. Data is hosted on Google Cloud in the United States with AES-256 at rest and TLS 1.2 in transit. Suki's homepage states it is "SOC2 Type 2 certified, and HIPAA compliant"; the developer docs add "We sign Business Associate Agreements (BAA) for patient data handling with our customers." The developer docs also state: "Suki does not create or retain any voice signatures." No breaches, lawsuits, or regulator actions naming Suki were found as of October 13, 2026.

Primary source: Suki developer docs — Security FAQ (Sept 29, 2026)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does DeepScribe train on my patient data?

Yes — its Terms of Use license customer data to machine learning for product improvement and de-identified data "for any legal purpose," with no published opt-out or retention window.

DeepScribe is an enterprise ambient scribe with no self-serve plan (the site offers "Request a demo" only). Its Terms of Use (updated October 17, 2024) grant DeepScribe the right to "use, store, host, perform, display and create derivative works from the Customer Data, including by combining Customer Data with data from third party sources and utilizing machine learning and artificial intelligence applications, for the purposes of (a) providing the DeepScribe Services ... (b) complying with applicable laws and regulations; and (c) operating, analyzing and improving DeepScribe's products and services." A separate clause lets DeepScribe "retain, share, and use the De-Identified Data for any legal purpose including without limitation for purposes of operating, analyzing, improving or marketing the DeepScribe Services." That is broader than the de-identified-only wording at Freed, Suki, or Abridge, and because de-identified data falls outside PHI, a standard BAA does not narrow it — a health system must do that in the master agreement. The privacy policy (no date visible on the page) says only that data is used to "improve the Services" and is retained "for as long as it remains necessary for the identified purpose or as required by law"; no audio or transcript deletion window is published anywhere. Data is processed on servers "located in the United States"; subprocessors are not named. The homepage shows SOC 2 and HIPAA badges, the security-practices page says DeepScribe holds "relevant certifications" without naming them, and the BAA is incorporated as Exhibit A of the Terms and "shall control" over the Terms on PHI. No breaches, lawsuits, or regulator actions naming DeepScribe were found as of October 13, 2026.

Primary source: DeepScribe Terms of Use (Oct 17, 2024)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Ollama train on my data?

No — Ollama operates no model server.

Ollama is a local runtime: there is no Ollama-operated model server to send prompts or completions to. Models run entirely on local hardware. Ollama exposes an OpenAI-compatible local REST API on localhost:11434; nothing leaves the user's machine in default operation. There is no vendor server, so there is no retention surface and no training path. Ollama is open-source under the MIT license with over 180,000 GitHub stars; the codebase is transparent and there are no documented breaches. Optional Ollama Cloud models are hosted "primarily in the United States" with possible routing to Europe, and the pricing FAQ says "Prompt or response data is never logged or trained on." Security caveat: 2026 brought three CVEs — CVE-2026-7482 (May 4; GGUF heap out-of-bounds read, fixed 0.17.1), CVE-2026-102697 (September 29; agent-mode shell-approval bypass via prompt injection, fixed 0.31.2), and CVE-2026-103663 (October 8; unauthenticated /api/pull path traversal that can lead to root code execution in default Docker images, fixed 0.35.0). The default localhost binding limits exposure, but anyone running the Docker image or exposing the API beyond localhost should update to v0.35.0 or later.

Primary source: Ollama GitHub repo

Does LM Studio train on my data?

No — inference runs locally; no chat data leaves the device.

LM Studio runs models locally on the user's hardware with an optional OpenAI-compatible local server. Inference happens entirely on-device; there are no LM Studio servers in the inference path. The optional LM Link feature uses end-to-end encrypted Tailscale mesh VPNs to connect a user's own devices for remote inference — chats remain local even when accessed from another linked device. LM Link shares only device-list metadata (not chats) with LM Studio's backend for device discovery. The application is closed-source but transparent about data flows on the LM Link product page and the June 2026 app privacy policy, which states the app "does not include telemetry or user-specific tracking" — a claim that conflicts with opt-out analytics calls (app version, OS, GPU, model names; no content) observed by a third-party traffic audit in April 2026. No documented incidents as of October 13, 2026.

Primary source: LM Studio

Does Jan train on my data?

No — Jan operates no model server.

Jan is an open-source local LLM runtime under Apache 2.0. Models run locally; there is no Jan-operated model server, so there is nothing to train on and no retention surface. Optional cloud-provider integrations are explicitly opt-in — when enabled, the chosen provider's terms apply for that specific feature. In default operation, no chat content leaves the device. Product analytics (active users and retention, tied to a random ID) are opt-in, chosen at first launch, and processed by PostHog EU. The codebase is auditable at github.com/janhq/jan (44,900+ stars); no documented incidents. Jan v0.8.5 (October 8, 2026) fixed GHSA-x6p8-7cp8-c3p6, under which the Local API Server, when bound to 0.0.0.0, accepted any Host header; it now enforces a Trusted Hosts allowlist.

Primary source: Jan