AI Tool Privacy Tracker

Does ChatGPT train on my data?

Yes, by default — opt-out available.

ChatGPT's consumer plans (Free, Plus, Pro) train on user prompts, outputs, and uploaded files by default. To opt out, navigate to Settings → Data Controls and disable "Improve the model for everyone." Conversations are retained for 30 days after deletion. Temporary Chat is never used for training. ChatGPT Team, Enterprise, and API plans are explicitly excluded from training under OpenAI's enterprise terms — API users can optionally opt in via Playground feedback. Limited April–September 2025 data is preserved due to the NYT litigation order; OpenAI's standard 30-day retention practices resumed September 26, 2025.

Primary source: OpenAI privacy policy

Does Claude train on my data?

User choice required (since Aug 2025).

As of August 28, 2025, Anthropic shifted Claude's consumer plans (Free, Pro, Max) from "not used for training" to a user-choice model. New users must actively choose during signup whether to share data for training; existing users had until October 8, 2025. Users who opt in have their data retained for up to 5 years; users who decline keep the previous 30-day retention window. Flagged conversations are retained 2–7 years for trust & safety review. Claude for Work, the Claude API, Amazon Bedrock, and Google Vertex AI are all contractually excluded from training under Anthropic's Commercial Terms.

Primary source: Anthropic Aug 2025 update

Does Gemini train on my data?

Yes, by default — opt-out via the "Keep Activity" setting.

Free Gemini and Gemini Advanced (consumer) train on user conversations by default. Per Google's documentation, when Keep Activity (the renamed "Gemini Apps Activity" toggle) is on, "Google uses your activity to provide, develop, and improve its services (including training generative AI models)." To opt out, set Keep Activity to OFF, or use a Temporary Chat, which is never used for training — but even when off, future chats are saved for 72 hours so Gemini can respond and process feedback. Default retention is 18 months, adjustable to 3 months, 36 months, or never. Human-reviewed conversations are kept up to 3 years (disconnected from your Google Account). Vertex AI customer data is contractually excluded from training: "Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction."

Primary source: Gemini Keep Activity controls

Does Perplexity train on my data?

Yes, by default — opt-out for logged-in users only.

Perplexity trains on user queries, prompts, and AI responses by default for Free, Pro, and Max plans. The "AI Data Retention" toggle in Account Settings → Preferences disables this. Logged-out users are trained on by default with no opt-out path — sign in to gain control. Threads are retained until manually deleted. On July 2, 2026 Perplexity replaced its privacy policy with a restructured Privacy Notice that dropped the written descriptions of the training opt-out, the 30-day account-deletion timeline (now "as long as reasonably necessary"), and the promise to notify users of material changes; the toggle and deletion still work in the product, but they are no longer commitments in the policy text. The same rewrite expanded stated collection to the Comet browser, voice input, and health and genetic data. The Sonar API offers Zero Data Retention with prompts and responses never stored. Third-party providers (OpenAI, Anthropic) are contractually prohibited from training on Perplexity's API data. Enterprise file uploads are deleted after 7 days.

Primary source: Perplexity data collection policy

Does DeepSeek train on my data?

Yes, by default — no in-app toggle; opt-out only by emailing privacy@deepseek.com.

DeepSeek's privacy policy (last updated February 10, 2026) states: "we directly collect, process and store your Personal Data in People's Republic of China" — covering prompts, outputs, uploaded files, IP addresses, device info, and account info (the keystroke-pattern language from the 2025 versions no longer appears). There is no in-app training toggle; the policy grants a right to opt out of training "or optimizing our technologies," exercisable by emailing privacy@deepseek.com. Retention is "for as long as necessary to provide our Services," with no fixed window. Italy's Garante imposed a 72-hour ban in January 2025 followed by 13 European jurisdiction probes; government device bans followed in Australia, Taiwan, South Korea, Czech Republic, the Netherlands, Germany, and multiple US federal agencies (Pentagon, NASA, US Navy). The bipartisan "No DeepSeek on Government Devices Act" is pending in the US Senate. A January 2025 database breach exposed over 1 million records. Open-source MIT-licensed weights can be self-hosted, which removes this concern entirely — but that is the self-hosted path, not the consumer chatbot.

Primary source: DeepSeek privacy policy (Feb 2026)

Does Apple Intelligence train on my data?

No — Apple's published policy excludes user interactions from foundation-model training.

Apple's published policy states Apple does not use users' private personal data or user interactions when training its foundation models. The on-device foundation model handles most tasks; for larger requests, Private Cloud Compute extends device security to Apple Silicon servers using a verifiable transparency model — signed binaries are publicly inspectable, there is no SSH or admin access, and researchers can audit via the Virtual Research Environment. PCC is stateless: data is processed only to fulfill the request and returned to the device; it is not stored or made accessible to Apple. Apple collects only request metadata (size, feature, duration), not content. The optional ChatGPT integration is a separate, opt-in boundary that routes through OpenAI's enterprise terms with IP obfuscation — Apple's guarantees do not extend to ChatGPT requests.

Primary source: Intelligence Engine privacy

Does Microsoft Copilot train on my data?

Consumer: yes by default — opt-out available. M365 Copilot business: no, contractually excluded.

First, the disambiguation: Microsoft Copilot is the consumer / Windows / Microsoft 365 assistant — it is distinct from GitHub Copilot (the developer product) which is tracked separately in the coding section. For Copilot Free, Windows Copilot, and copilot.com chat on Microsoft 365 Premium ($19.99/mo; Copilot Pro was retired on August 1, 2026), Microsoft trains by default on signed-in users' conversation activity. Microsoft Support states: "Except for certain categories of users or users who have opted out, Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training." Since the updated Copilot app of August 18, 2026 there are two toggles under Profile icon → Privacy: "Training on conversation activity" and "Training on voice conversations"; Microsoft says opting out excludes future conversation activity from model training, while conversations may still be used for other product improvements, advertising, digital safety, security, and compliance. Signed-out users, and Copilot inside Microsoft 365 apps on Personal / Family / Premium subscriptions, are not used for training. A law firm announced an investigation into the default-on training on August 26, 2026. Conversation activity is retained 18 months by default; user-deletable, but deletion is independent of the training opt-out. On Copilot+ PCs (NPU ≥40 TOPS), Recall and Click to Do run locally on-device with snapshots stored on-device; most Copilot chat still runs in the cloud. Microsoft 365 Copilot ($30/user/mo, enterprise) is contractually excluded from training under the Microsoft Products and Services Data Protection Addendum: "Your data isn't used to train foundation models... the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models." Retention is tenant-controlled via Microsoft Purview. On January 7 2026, Microsoft enabled Anthropic as a default subprocessor for M365 Copilot (used in Researcher, Copilot Studio, Office agents); EU and UK tenants have it disabled by default, processing occurs outside the EU Data Boundary.

Primary source: Microsoft Copilot privacy controls (Aug 2026)

Does Meta AI train on my data?

Yes, by default globally. EU / UK have an opt-out form; US / Australia / most non-GDPR regions do not.

Meta AI — the assistant available in WhatsApp, Instagram, Facebook, Messenger, Threads, and Ray-Ban / Oakley Meta — is opt-in by default for training on adult users' public Facebook and Instagram posts and on all Meta AI conversations. The regional split is load-bearing. EU / EEA users have opt-out via the "Right to Object" form in Privacy Center → "How Meta uses information for generative AI models and features" — Meta resumed EU training on May 27 2025 under GDPR Article 6(1)(f) "legitimate interest" after a one-year pause forced by Irish DPC + noyb pressure. UK opt-out is available after ICO concessions. US, Australia, and most non-GDPR jurisdictions have no general opt-out — Meta confirmed in Australian Senate hearings (Sept 2024) that it scrapes Australian public posts back to 2007 and will offer an opt-out only "if governments force it to." WhatsApp 1:1 and group messages remain end-to-end encrypted and are not used for training unless the user explicitly invokes @Meta AI in chat. On December 16 2025, Meta extended Meta AI conversations into ad personalization in addition to model training (US and most non-EU regions; EU, UK, South Korea carved out). Retention is indefinite unless the user manually deletes; Ray-Ban Meta voice recordings are retained up to 1 year by default. No on-device inference for the Meta AI assistant — WhatsApp "Private Processing" is server-side TEE confidential compute, not local.

Primary source: Meta Privacy Center — How Meta uses information for generative AI

Does Grok train on my data?

Consumer: yes by default — three separate opt-out paths. API: no, by default.

Consumer Grok — on X (Free, Premium $16/mo, Premium+ $40/mo), grok.com, and the Grok mobile app — is opt-in by default for training on both X posts and Grok prompts / outputs. The opt-out lives in three separate places: (1) Grok on X: Settings → Privacy and safety → Data sharing and personalization → Grok & xAI → uncheck "Allow your posts as well as your interactions, inputs, and results with Grok and xAI to be used for training and fine-tuning." (2) Grok mobile app: Settings → Data Controls → uncheck "Improve the model." (3) Grok web at grok.com: Settings → Data → uncheck "Improve the model." EU / EEA users were excluded from X-post training under the September 4 2024 DPC undertaking; the DPC opened a fresh statutory inquiry on April 11 2025. The January 15 2026 X Terms of Service update explicitly classifies Grok prompts and outputs as user "Content" available for AI training. Grok chats are retained indefinitely unless the user deletes them. The xAI API has a materially different posture: "xAI never trains on your API inputs or outputs without your explicit permission," matching the OpenAI and Anthropic API defaults. API retention is 30 days for abuse monitoring; Zero Data Retention is available for enterprise customers via sales@x.ai and on Oracle Cloud Infrastructure since June 17 2025. Track record: "MechaHitler" antisemitic-content failure (July 2025) drew EU Commission and Turkey enforcement; ~370,000 Grok shared chats were indexed on Google in August 2025 because the share feature generated unauthenticated URLs without `noindex`.

Primary source: xAI Privacy Policy

Does Cursor train on my code?

Yes, by default for individuals — Privacy Mode opt-out.

For individual accounts Privacy Mode is off by default (Cursor no longer calls this "Share Data"). With it off, Cursor's Data Use page (last updated September 3, 2026) says it "may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models." Toggling Privacy Mode ON prevents training and discards plaintext after each request — cached files are encrypted with client-generated keys that exist on Cursor's servers only for the duration of each request. Enterprise workspaces default to Privacy Mode ON and admins can enforce it; Cursor states it holds zero-data-retention agreements with all model providers (naming SpaceXAI, OpenAI, Anthropic, and Meta, plus Google in the enterprise docs). Models that require provider-side retention, such as Claude Fable 5.1 and Fable 5, are blocked for Privacy Mode and Enterprise users until an admin approves them. On August 29, 2026 Cursor removed its disclosure of how indexing embeddings and metadata are retained, so that detail is now unpublished. Requests go through Cursor's backend even when you bring your own API key; Cursor can also be pointed at local Ollama or LM Studio models.

Primary source: Cursor data use

Does GitHub Copilot train on my code?

Yes, by default for consumer plans — opt-out as of April 24, 2026.

On April 24, 2026, GitHub began using Free, Pro, and Pro+ user interaction data — including code snippets — to train AI models by default. Existing opt-outs are honored. To disable training going forward, go to Settings → Privacy. User Engagement Data is retained for 2 years; Coding Agent session logs persist for the lifetime of the account. Private repository code at rest is NOT used for training, but in-flight interaction data IS. Business and Enterprise plans are explicitly prohibited from being used for training under GitHub's agreements: subscription Prompts and Suggestions are retained 28 days, and User Engagement Data 2 years.

Primary source: April 2026 policy change

Does Devin Desktop (formerly Windsurf / Codeium) train on my code?

Yes for individuals by default — paid plans can opt out, which also enables Zero Data Retention.

Windsurf was rebranded Devin Desktop by Cognition on June 2, 2026, and its legal pages now live on cognition.com and docs.devin.ai. Cognition's privacy policy (March 9, 2026) says User Content is used "to train, fine tune and improve the models that power our Services" unless you opt out. Per the Devin security docs: "If you're on a paid plan, you can opt out at any time on the Data Controls settings page. After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers." No opt-out is documented for the free tier. On Teams only an administrator can exercise the opt-out; Enterprise customers are not trained on without express prior written consent. With ZDR, Customer Data is "not saved to disk or otherwise persistently retained" and is deleted once the output is generated. Cognition offers a hybrid deployment and has placed its self-hosted deployment in maintenance mode.

Primary source: Devin security docs

Does Cline train on my code?

No — Cline operates no model server. Privacy depends on your chosen API provider.

Cline is an open-source VS Code extension that operates no model server of its own. User code is sent only to whichever API provider you configure (Anthropic, OpenAI, AWS Bedrock, Google Gemini, Cerebras, Groq, etc.) and is governed by that provider's terms. Cline's stated principle: "Code never leaves your machine" toward Cline servers. Anonymous telemetry (features used, task completion rates) is collected but can be disabled via the Cline Telemetry setting. Code, file contents, command arguments, and conversation content are explicitly NOT collected by telemetry. For fully on-device use, configure Cline with a local Ollama or LM Studio model.

Primary source: Cline telemetry docs

Does Claude Code train on my code?

Pro/Max account: yes by default — opt-out. API / Console / Enterprise: no, contractually excluded.

Claude Code is Anthropic's CLI for Claude — separate from Claude.ai consumer chat and from Claude for Work. The data-handling posture depends entirely on how the user is billed. A developer running Claude Code from a Claude.ai Pro or Max account inherits the August 28 2025 consumer-terms update, which made training default-on with user-choice opt-out. Anthropic stated explicitly: "These updates apply to users on our Claude Free, Pro, and Max plans... including when they use Claude Code from accounts associated with those plans." Opt-out lives at claude.ai/settings/data-privacy-controls. Retention with training enabled is 5 years; with training disabled, 30 days. A developer running Claude Code via an API key, Anthropic Console, Claude for Enterprise, AWS Bedrock, Google Vertex AI, or Microsoft Foundry is on Anthropic's Commercial Terms Section B: "Anthropic may not train models on Customer Content from Services." Reinforced in the Claude Code data-usage docs: "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms." Bedrock and Vertex users cannot enroll in the Development Partner Program at all. Zero Data Retention is available specifically for Claude Code on Claude for Enterprise per the docs, enabled per-organization by the account team. Architecturally, Claude Code is partial on-device: the binary runs locally (file edits, shell execution, MCP servers, local session log), but inference is cloud-only via the Anthropic API.

Primary source: Claude Code data usage

Does Tabnine train on my code?

No — proprietary models trained only on permissively licensed open-source code.

Tabnine's proprietary completion models are trained only on permissively licensed open-source code (MIT, Apache 2.0). Customer code is never used to train Tabnine's models and is never shared with third parties. The code-privacy page states verbatim: "We never use your code to train any of our models. Code exposed to Tabnine is never stored or shared when using our proprietary models." Tabnine also implements zero code retention — requests are processed in-memory and immediately discarded after the server returns a suggestion. Operational metrics and logs (which contain no code and no PII) are retained roughly one week for support. The architecture scales further at the Enterprise tier, which supports SaaS, VPC, on-premises, and fully air-gapped deployment options where code never leaves the customer network. There is no free or individual plan; the entry tier is the Code Assistant Platform at $39 per user per month (Agentic Platform $59). Tricentis acquired Tabnine, announced July 30, 2026, and the August 28, 2026 privacy-policy edits were cosmetic. Compliance posture: SOC 2 Type II, ISO 27001, GDPR, with IP indemnification for enterprise customers. No documented privacy incidents. Tabnine sits alongside Cline as the rare "good actor" in a coding category that otherwise carries opt-out-by-default training (Cursor individual, Devin Desktop individual) or recent reversal (GitHub Copilot, since April 2026).

Primary source: Tabnine code privacy

Does OpenAI Codex train on my code?

Yes with a ChatGPT Free / Go / Plus / Pro sign-in unless you turn off two separate toggles; no with an API key, Business, Enterprise, or Edu.

Codex — the CLI, IDE extension, desktop app mode, and cloud agent — inherits the terms of whatever account you sign in with. OpenAI's help center (updated August 2026) names it directly: "When you use our services for individuals such as ChatGPT and Codex, we may use your content to train our models." The ChatGPT opt-out (Settings → Data Controls → "Improve the model for everyone") is documented as turning off training "for your ChatGPT conversations and Codex tasks." That is not the whole story: "Codex has separate controls for allowing training on full environments, which you can manage in the Codex Settings. Note that adjusting your settings in the ChatGPT interface or privacy portal will not affect these full-environment Codex settings." OpenAI does not publish the default of that environment control, so treat it as something to check by hand. Retention on consumer plans follows the ChatGPT privacy policy — deleted content is removed within 30 days unless kept for legal or abuse reasons — with no Codex-specific window published. Business, Enterprise, Edu, and API-key use fall under the enterprise privacy page (updated January 8, 2026): "By default, we do not use your business data for training our models." Enterprise admins control retention; API traffic is kept 30 days for abuse monitoring, and /v1/responses is eligible for Zero Data Retention. Architecturally, Codex is partial on-device: the CLI edits files and runs shell commands locally, but per OpenAI's own docs "Local execution does not mean offline or device-only model inference," and cloud tasks run in VM-backed sandboxes on OpenAI infrastructure. A GitHub-token command-injection flaw reported December 16, 2025 was patched February 5, 2026 with no exploitation reported.

Primary source: How your data is used to improve model performance

Does Gemini CLI train on my code?

Depends on the key: yes with a free Gemini API key (no toggle); no with a paid API key, Vertex AI, or a Gemini Code Assist Standard / Enterprise license.

Gemini CLI is Google's open-source (Apache 2.0) terminal agent, and its privacy posture is set entirely by how you authenticate. The picture changed in 2026. Google announced on May 19, 2026 that "Gemini CLI and Gemini Code Assist IDE extensions will stop serving requests for Google AI Pro and Ultra, as well as those using it free of charge using Gemini Code Assist for individuals" from June 18, 2026, steering those users to Antigravity CLI. The old "Gemini Code Assist for individuals" privacy notice, which offered an opt-out checkbox, now serves only a deprecation notice. What remains for individuals is a Gemini API key. On the unpaid tier the Gemini API Terms (effective March 23, 2026) state: "Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products" and "human reviewers may read, annotate, and process your API input and output." There is no opt-out setting; the only off-switch is enabling paid billing, where "Google doesn't use your prompts ... or responses to improve our products" and logs are kept "for a limited period of time" for abuse detection — no number is published. Organization licenses fall under the Gemini for Google Cloud data-governance page (last updated September 3, 2026): "Gemini doesn't use your prompts or its responses as data to train its models." Separately, the CLI sends anonymous usage statistics by default (tool names, model, durations) but "We do not log the content of your prompts or the responses"; set privacy.usageStatisticsEnabled to false to stop it. Track record: a critical advisory (GHSA-wpqr-6v78-jr5g) on April 24, 2026 fixed workspace-trust and tool-allowlist bypasses in headless runs.

Primary source: Gemini CLI terms and privacy

Does Kiro train on my code?

Yes by default for Free and for paid plans signed in with GitHub, Google, or AWS Builder ID — opt-out in settings; no for Enterprise or IAM Identity Center sign-ins.

Kiro is AWS's agentic IDE and CLI. Its data-protection page (last updated August 4, 2026) is unusually explicit that the split is by sign-in method, not by price. "Kiro may use certain content from Kiro Free Tier and Kiro individual subscribers for service improvement," where individual subscribers are users "that have a paid Kiro subscription and access it through a social login provider (like GitHub or Google) or through AWS Builder ID." The content covered is "your questions to Kiro, other inputs you provide, and the responses and code that Kiro generates," and the stated purposes include "for model training." A $200-per-month Power subscriber on a GitHub login is therefore trained on by default; a $20 Pro subscriber on IAM Identity Center is not. To opt out in the IDE: Settings → User → Application → Telemetry and Content, then uncheck "Data Sharing and Prompt Logging: Content Collection for Service Improvement" and "Usage Analytics And Performance Metrics." The CLI exposes a telemetry.enabled setting; its default is not published. For Enterprise, "We do not use content from Kiro enterprise users for service improvement," and those users "are automatically opted out of telemetry and content collection." Retention: Free Tier inputs may be stored "for up to 60 days" for abuse detection, OpenAI GPT classifier-flagged traffic "for up to 30 days," and no window is published for service-improvement content. Inference runs in AWS on Bedrock-hosted Claude, OpenAI GPT, and open-weight models; there is no local-model option. Two caveats for buyers: the AWS Service Terms (updated September 1, 2026) carry no Kiro-specific no-training clause, a gap flagged in GitHub issue #2206 since August 2025, and 2026 brought three AWS security bulletins plus a Mindgard-disclosed prompt-injection exfiltration, all patched with no customer data loss reported.

Primary source: Kiro data protection

Does Voibe train on my voice data?

No — on-device mode never transmits audio; cloud mode is zero-retention with no training.

Voibe has two user-selectable modes. In on-device mode (Apple Silicon Macs, M1 or later) audio is transcribed entirely on the Mac by Whisper models running on the Neural Engine, works with no internet, and nothing leaves the machine — so there is no training to opt out of. In zero-retention cloud mode (all Macs and Windows) audio is encrypted in transit and transcribed by Whisper Large Turbo, an open-source model running on zero-retention providers (Groq or Cloudflare); the audio is deleted the moment transcription completes and is never stored, sold, or used to train any model. Formatting is a second hop that sees only the text, never the audio, using GPT-OSS 120B, an open-weight model on Cerebras. No third-party AI lab is in the audio path and users never paste an API key. The speech-to-text API and MCP server launched in August 2026 run on the same pipeline, with transcripts readable for 24 hours and then deleted. Account holders provide an email (for authentication) and non-identifying usage analytics; crash reports exclude dictated content.

Primary source: Voibe AI & privacy

Does Wispr Flow train on my voice data?

Off by default since 2024 backlash — opt-in for training.

After 2024 community backlash, Wispr Flow shifted training to opt-in. Privacy Mode is OFF by default for Free users, meaning audio, transcripts, edits, and optional Context Awareness (screenshots of the active app's screen) are retained indefinitely. Data passed to third-party LLM providers (OpenAI, Meta) is retained for 30 days. Enterprise plans default to Privacy Mode ON with zero data retention by Wispr or any third party — audio is processed and immediately discarded after transcription. A Business Associate Agreement is available for Enterprise; once signed, Privacy Mode locks irreversibly. Transcription always happens in the cloud; even Privacy Mode is "zero-retention cloud," not local processing.

Primary source: Wispr Flow privacy policy

Deep dive: Is Wispr Flow Safe? — full investigation

Does Superwhisper train on my voice data?

No — verbatim from policy.

Superwhisper's privacy policy states explicitly: "Your data is not retained on Superwhisper servers" and "not used for training AI models or any other machine learning purposes." On-device modes (Fast, Nano, Standard Whisper, Parakeet — available on the Free plan and within Pro) process audio entirely locally; nothing is transmitted. Cloud modes (Ultra transcription, Super Mode LLMs — Pro tier) proxy audio through Superwhisper's infrastructure with no retention. One caveat: audio recordings are saved to local disk by default. Opt out in settings if local audio retention is a concern. Note: the privacy policy does not currently distinguish between on-device and cloud modes — verify cloud-mode specifics with the vendor before sensitive use.

Primary source: Superwhisper privacy

Deep dive: Is Superwhisper Safe? — full investigation

Does MacWhisper train on my voice data?

No — primarily on-device, with optional cloud + BYOK paths.

MacWhisper does not train its own models on user audio. The on-device transcription path uses local Whisper models that you can download for offline use; Apple Foundation Models also run on-device for AI features. MacWhisper's optional "Assistant" cloud transcription service and BYOK integrations (OpenAI Whisper API, ElevenLabs) inherit those providers' terms when used. The App Store version's privacy disclosure shows only "Usage Data" and "Product Interaction" as Data Not Linked to You. There is no separate enterprise tier; the data-handling architecture is identical for individuals and bulk-licensing customers.

Primary source: App Store listing

Does Aqua Voice train on my voice data?

Privacy policy does not explicitly address training — opt-out via Privacy Mode.

Aqua Voice's privacy policy does not explicitly state whether stored data is used for AI training. With Privacy Mode disabled, "we may securely store transcript data on our servers"; with Privacy Mode enabled, "transcript data is not collected" though session metadata (timestamps, device type, performance metrics) may still be. Aqua Voice is SOC 2 Type II certified by Advantage Partners. Teams and Enterprise plans support an org-wide Privacy Mode that applies the same protections across an entire organization. No HIPAA Business Associate Agreement is publicly advertised. Audio is cloud-processed; there is no on-device option.

Primary source: Aqua Voice privacy policy

Deep dive: Is Aqua Voice Safe? — full investigation

Does Typeless train on my voice data?

No, per the published privacy policy — but verify the architecture.

Typeless's privacy policy states: "Your data is never used to train these services and is configured for zero retention by the providers." Audio plus contextual information is "processed in real time on our cloud servers and immediately discarded once the result is returned to your device." Free and Pro tiers receive the same data-handling treatment. However, a November 2025 reverse-engineering analysis (covered in our Typeless privacy issues investigation) reported collection beyond what the published policy describes — including URL capture, window-title metadata via the macOS accessibility API, and broad permission requests. Verify the current subprocessor list at trust.typeless.com/subprocessors before relying on Typeless for sensitive content.

Primary source: Typeless privacy policy

Deep dive: Typeless Privacy Issues — full investigation

Does Apple Dictation train on my voice data?

Only if you opt in via "Improve Siri & Dictation."

Apple Dictation only uses your audio to improve its models if you have explicitly enabled "Improve Siri & Dictation" — the default at setup is to be asked. If opted in, audio and transcripts are retained under a rotating random ID for up to 6 months, then dissociated and kept for up to 2 years for improvement; a reviewed subset is retained beyond 2 years. If opted out, recordings are not retained for improvement. On Apple Silicon Macs running modern macOS or iOS, most languages process locally for general text fields (Notes, Mail, Messages). Server-side fallback applies to unsupported languages, search-box dictation, and some third-party Speech Recognition API uses. Apple does not sign a Business Associate Agreement for consumer Dictation, so it is not HIPAA-compliant.

Primary source: Ask Siri & Dictation policy

Does Willow Voice train on my voice data?

No by default — Private Mode is the default; opt-in required for training.

Willow Voice operates with Private Mode as the default for all users. The privacy policy states verbatim: "In private mode, Willow only collects basic technical and account-related data needed to run the app and nothing else. No voice, no dictated text." Training only occurs if the user explicitly opts into Opt-In Mode: "You can allow Willow to collect minimal usage data to help improve our text correction models." This is the inverse of Wispr Flow's pre-2024 posture, which had Privacy Mode off by default until community backlash forced the switch. With Opt-In Mode enabled, anonymized text and usage data are retained "only as long as needed to train and improve the app" — no specific retention window is published. Architecturally, Willow Voice is cloud-first; the privacy policy's reference to local storage applies to the UI display of past transcripts, not to local transcription. The current willowvoice.com pricing page does not advertise an offline transcription mode. The Enterprise tier is marketed as zero data retention with HIPAA and SOC 2 compliance and BAA availability, but the privacy policy itself only references GDPR and SOC 2 — request signed BAA terms in writing before processing PHI. Policy last updated April 30 2025.

Primary source: Willow Voice privacy policy

Does Monologue train on my voice data?

Unknown — the privacy policy does not address training either way.

Monologue's published data-privacy page makes a narrow set of claims: "No audio files or transcripts are saved on our servers," "Deep context screenshots are deleted immediately," "Zero LLM data retention," and "Custom modes and dictionaries stay on your device." The page does not explicitly state whether de-identified or aggregated data is used to improve models. Peer cloud dictation products — Wispr Flow, Typeless, Superwhisper, Willow Voice — all explicitly address the training question one way or the other. Monologue's silence is the load-bearing gap. The Notion-hosted privacy policy at modern-ton-234.notion.site is similarly sparse — no list of data categories collected, no subprocessor disclosures, no retention windows beyond the broad "not saved" claim, no SOC 2 / HIPAA / BAA mention. Offline transcription is listed as a feature on both the Free and Pro tiers of monologue.to, but the architecture (cloud-default with offline fallback vs on-device-default) is not documented. For regulated work, request explicit training and subprocessor disclosure in writing before use.

Primary source: Monologue data privacy

Does VoiceInk train on my voice data?

No — 100% on-device. Source code is auditable on GitHub.

VoiceInk is an open-source Mac dictation app under GPL v3.0. The README states verbatim: "100% offline processing ensures your data never leaves your device." The marketing site at tryvoiceink.com describes it as a "privacy-focused dictation app for macOS with local transcription." Transcription runs locally on Apple Silicon via whisper.cpp; there is no VoiceInk-operated server in the inference path, so there is no retention surface and no training path. No telemetry, BYOK cloud feature, or AI-command post-processing service is documented at this verification pass. The source code is auditable on GitHub at Beingpax/VoiceInk with 4,900+ stars, 675+ forks, and 119 releases (latest v1.76 on May 7 2026). Pricing is $39.99 one-time for the Pro license, or free if built from source under GPL v3. Because the codebase is open, the privacy claim is verifiable — the same reason Ollama, Jan, and LM Studio score highly in our Local LLM category.

Primary source: VoiceInk (tryvoiceink.com)

Deep dive: VoiceInk Review — full investigation

Does Dragon (Nuance / Microsoft) train on my voice data?

Depends entirely on which Dragon product. Desktop is offline; cloud tiers are not separately disclosed.

Dragon is now a multi-product line under Microsoft (acquired from Nuance in 2022) with materially different privacy postures across SKUs. Dragon Professional v16 is a locally installed Windows desktop application — audio is processed on the user's machine, voice profiles are stored locally, and nothing is transmitted to Nuance/Microsoft servers in normal desktop dictation operation. There is no training path because there is no upload. Dragon Anywhere (the iOS/Android mobile product) is cloud-based — audio is transmitted to Nuance/Microsoft for recognition. Microsoft's general Privacy Statement reserves the right to use customer data to develop and train AI models (with opt-out paths surfaced through Copilot privacy controls), and the Dragon-specific product pages do not separately disclose AI-training carve-outs for Dragon Anywhere at the consumer tier. Treat that cell as unverified until Microsoft publishes a Dragon-specific commitment. Dragon Medical One, Professional Anywhere, and Dragon Copilot are enterprise cloud products marketed as HIPAA-compliant when a BAA is in place. The umbrella Microsoft Products and Services Data Protection Addendum excludes Customer Data from foundation-model training, which is the contractual basis healthcare buyers rely on — but Dragon-specific commitments are still primarily contract-level rather than published product commitments. Track record context: the 2017 NotPetya attack disrupted Nuance's hosted services (including Dragon Medical) for weeks. Development on the desktop line has largely stalled since the Microsoft acquisition (v17 ≈ v16); the Mac version was discontinued in 2018 and Dragon Home in 2023. Non-medical Nuance product pages now redirect to Microsoft's health-solutions hub, creating a discovery gap that itself is a buyer risk when trying to verify privacy commitments.

Primary source: Dragon Medical One (Microsoft)

Deep dive: Dragon pricing — full breakdown

Does Spokenly train on my voice data?

No by Spokenly — but the answer depends on which of three modes you use.

Spokenly is a Mac and iOS dictation app from named solo developer Vadim Akhmerov (disclosed via the App Store, not the privacy policy) with three architectural modes that produce three different privacy postures. Local Only Mode runs OpenAI Whisper Large-v3 and NVIDIA Parakeet locally on Apple Silicon with no network calls during transcription — nothing is transmitted, so there is no training path. BYOK cloud mode routes audio to whichever provider you supply API keys for (OpenAI, Deepgram, Groq, Anthropic, or Google); Spokenly does not train on it, but the chosen provider's terms govern training and retention. Pro managed cloud ($9.99/mo) forwards audio to third-party transcription services — the privacy policy last updated July 7, 2026 names eleven: OpenAI, Deepgram, Soniox, Cartesia, ElevenLabs, Groq, Mistral AI, xAI, OpenRouter, fal.ai, and Cerebras. The policy's load-bearing claim is that Spokenly's backend "does not store these recordings," applied across all modes; on training it says only that Spokenly prefers "options that do not use customer data for model training where available," a hedged preference rather than a guarantee. Three structural caveats apply regardless of mode: no SOC 2 / HIPAA BAA / ISO 27001 / GDPR / CCPA attestations (disqualifying for regulated work), no disclosed corporate entity or jurisdiction (only admin@spokenly.app as contact), and an iOS keyboard caveat where the developer's own App Store reply recommends switching to online models for keyboard reliability — which defeats the on-device benefit. App Store rating is 4.4/5 from 56 ratings.

Primary source: Spokenly privacy policy (updated 2026-07-07)

Deep dive: Is Spokenly Safe? — full investigation

Does Handy train on my voice data?

No — there is no Handy server to send audio to, and the MIT source proves it.

Handy is a free, MIT-licensed push-to-talk dictation app for macOS, Windows, and Linux maintained by CJ Pais. Its privacy claim is one sentence on handy.computer and in the README: "Your voice stays on your computer. Get transcriptions without sending audio to the cloud." There is no privacy policy document at all — handy.computer/privacy returned HTTP 404 on September 10, 2026 — so the claim is backed by architecture and source rather than by a policy. Audio passes through bundled Silero voice-activity detection and a locally downloaded speech model (Whisper, Parakeet, and other families); no cloud transcription endpoint exists in the codebase, so there is no retention surface and no training path. The one default network call is a signed update check against GitHub releases, toggleable in Settings. Two items to re-check each release: the README roadmap still lists "Opt-in Analytics" ("Privacy-first approach with clear opt-in") as unshipped through v0.9.6 (August 24, 2026), and our July 2026 source audit found an optional bring-your-own-key LLM post-processing path that sends transcript text, never audio, to a provider you configure — it is off by default and not documented in the README. The repository has 31,300+ stars and 2,800+ forks with no CVEs or advisories. What Handy lacks is anything a procurement team can file: no legal entity, no DPA, no BAA, no SOC 2. For an individual who wants on-device dictation at $0, that is a fair trade; for regulated work it means you are relying on your own audit.

Primary source: Handy GitHub repo (MIT)

Deep dive: Is Handy Safe? — full investigation

Does OpenWhispr train on my voice data?

No, in writing across all three modes — but which mode you use decides who else sees your audio.

OpenWhispr is an MIT-licensed desktop client (7,900+ GitHub stars) from Gizmo Labs Inc., a Delaware corporation, that grew a hosted product in 2026. The privacy policy (last updated August 12, 2026) describes three paths. Local mode runs Whisper or NVIDIA Parakeet on-device and "no audio is transmitted anywhere." BYOK sends audio directly to the provider whose key you supply, under that provider's terms; the policy discloses that "API keys you enter for third-party providers are currently stored in plaintext in your local app data directory." OpenWhispr Cloud sends audio to OpenWhispr's API, where it is "processed in real time, and discarded" — the "0% Data Retention" claim — and forwards it to subprocessors named in DPA Annex 3: OpenAI OpCo, LLC, Parasail, Inc., and Groq, Inc. The no-training commitment is contractual, not just marketing: the Terms of Service (effective July 23, 2026) state "We will not use Customer Content — audio, transcriptions, notes, or AI agent prompts — to train any artificial intelligence or machine learning model," and DPA v1.2 (updated August 21, 2026) repeats it for voice audio, transcriptions, notes, prompts, and AI-agent conversations. Synced notes are deleted within 30 days of account deletion. The DPA lists a SOC 2 Type 2 report (May 1–July 31, 2026), ISO/IEC 27001:2022 valid through July 27, 2027, and HIPAA / GDPR attestations; the auditor is not named on the trust center. A BAA is available for Business ($13.33/user/mo billed annually) and above, and the DPA says covered entities must not process PHI through the cloud without one. Free is $0 with 2,000 cloud words/week; Pro is $6.67/user/mo billed $80/yr.

Primary source: OpenWhispr privacy policy (updated 2026-08-12)

Deep dive: Is OpenWhispr Safe? — full investigation

Does FluidVoice train on my voice data?

No — audio and text stay on the Mac; the only thing sent to the vendor by default is anonymous usage metadata.

FluidVoice is a free macOS dictation app whose app source is GPLv3 (since February 23, 2026; Apache 2.0 before that) at github.com/altic-dev/FluidVoice, with 11,400+ stars and releases through v1.6.9 on August 18, 2026. The README is the governing privacy text because no formal policy document exists: "Your voice, audio, and transcribed text never leave your machine unless you explicitly opt in to a cloud AI provider." Every speech model — Whisper, Parakeet, Nemotron, Cohere Transcribe, Apple Speech — is a local download, and the enhancement runtime Fluid Intelligence (the Fluid-1 model, about 3.5 GB) also runs offline. That runtime is the one closed component: "We're keeping Fluid Intelligence private for now so we can sustainably offer the core dictation experience for free." You can verify it sends nothing; you cannot audit what it changes. Two defaults matter. First, "Detailed anonymous analytics are enabled by default" and can be disabled at Settings → Share Detailed Anonymous Analytics; the payload is a random installation ID, activity date, app version, macOS platform label, and daily feature and model usage totals — the README states voice, audio, transcripts, prompts, and clipboard content are not collected, and no retention window for that metadata is published. Second, optional cloud enhancement can send transcript text to OpenAI, Groq, or a custom provider with your own key (stored in the macOS Keychain), under that provider's terms. Requirements: macOS 15 or later; Apple Silicon for everything except Whisper on Intel. There is no legal entity, DPA, BAA, or compliance attestation published, and no documented incidents.

Primary source: FluidVoice GitHub repo (GPLv3)

Deep dive: Is FluidVoice Safe? — full investigation

Does VoiceDash train on my voice data?

No, per its policy and DPA — but every dictation goes to OpenAI, and the retention story has an unverified piece.

VoiceDash is a cloud-only dictation app for Mac and Windows from Jumpstart Ventures FZE in Dubai Silicon Oasis (the entity is named in the DPA, not the privacy policy), founded February 2025. The privacy policy, which carries no effective date, states: "Your voice recordings are transmitted to OpenAI for the sole purpose of real-time transcription and response generation," "VoiceDash does not store your voice files or transcriptions on our servers" (the exception is content you save to Notes), and "Your voice data is strictly excluded from our machine learning training sets. Your input does not influence the development of VoiceDash AI models." The Data Processing Addendum effective May 26, 2026 adds that data is "processed transiently, structurally excluded from AI model training loops," commits to TLS 1.3 in transit and AES-256 at rest, and names nine subprocessors: OpenAI, Groq, Cloudflare, Hetzner, Sentry, Metabase, CustomerIO, RevenueCat, and Apple — Groq does not appear in the privacy policy. Downstream, OpenAI's API data-usage page confirms API inputs are not used for training by default and that abuse-monitoring logs are retained up to 30 days unless a Zero Data Retention arrangement is approved. The homepage advertises "Zero Data Retention processing through its OpenAI partnership," and the founder told AppSumo buyers a formal BAA had been signed with OpenAI, but neither claim appears in the policy or DPA, so treat both as unverified. No SOC 2, ISO 27001, or HIPAA attestation is published and the DPA contains no BAA language. Pricing: Free (1,000 words/mo), Pro $15/mo or $12/mo billed yearly, Teams $29/mo or $24/mo billed yearly for up to five members. AppSumo rating 4.42/5 from 234 reviews; no documented incidents.

Primary source: VoiceDash privacy policy

Deep dive: Is VoiceDash Safe? — full investigation

Does Paraspeech train on my voice data?

Not stated — the policy names its cloud processors but says nothing about training; local mode on Apple Silicon avoids the question entirely.

Paraspeech is a macOS 14+ dictation app (with an iOS Voice Keyboard) from Burlis Management GmbH, Philippstrasse 27, 52349 Dueren, Germany, priced at $14.99/mo, $99/yr, or a local-models-only Lifetime license. It has two data paths. In local mode on Apple Silicon, docs state "When the active speech-recognition backend is local, speech audio is transcribed on your Mac," and "Supported local modes can run offline after setup"; the privacy policy (last updated July 23, 2026) adds that "the last audio file is stored locally on the user's device until replaced by a new recording or deleted by the user." In cloud mode, "When a user selects or is eligible for cloud transcription, Paraspeech may transmit selected audio and related request metadata to Deepgram for cloud transcription," and the opt-in Cloud Cleanup rewrite sends "selected transcript text, prompt text, rewrite instructions, and related request metadata" to Groq and Cerebras. "Eligible for" covers Intel Macs, which "use cloud models with a subscription" and have no local option. The policy contains no statement on AI training in either direction, and cloud retention "depends on the applicable provider and processing terms" — no audio or transcript window is published. Analytics vendors are PostHog, Cloudflare Web Analytics, Ahrefs, Simple Analytics, and Dub.co; hosting is Hetzner, Supabase, and Apple; raw journey events are cleared after 90 days. No SOC 2, ISO 27001, HIPAA, or BAA is offered at any tier, including the custom Enterprise plan. The iOS app's App Store privacy label (v1.0.4) lists Audio Data under "Data Linked to You." No documented incidents.

Primary source: Paraspeech privacy policy (updated 2026-07-23)

Deep dive: Is Paraspeech Safe? — full investigation

Does Voicy train on my voice data?

No, per the homepage — but the commitment does not appear in either governing policy.

Voicy's homepage states: "We do not use your recordings to train an AI model or for any other purpose." That sentence does not appear in Voicy's Data Handling and Security Policy (version 1.3, last updated July 31, 2025) or in its undated privacy policy; neither document contains the word "train." What the policies do commit to is deletion: "No audio recordings are stored by Voicy or Groq - all audio data is permanently deleted immediately after processing" and "All transcribed content is immediately deleted after delivery to the user." Every dictation is relayed through Voicy's Heroku-hosted servers to Groq, which runs the open-source Whisper V3 model; the privacy policy adds that Voicy has "enabled their Zero Data Retention settings" at Groq and does not use Groq's batch or fine-tuning endpoints. Account data is stored on the user's device rather than in a central database, and Mixpanel analytics can be disabled. Two gaps remain as of September 10, 2026: the privacy policy now says servers are "hosted in the EU and US" while the security policy still says all processing is US-based, and the security policy predates the 2026 iOS and Android apps. Voicy is cloud-only at every tier, including Voicy for Teams ($6.79/user/mo, 3+ users), which carries no separate data terms. No SOC 2, ISO 27001, or HIPAA BAA is published; the operating entity is Pishi LLC FZ (UAE).

Primary source: Voicy Data Handling and Security Policy

Deep dive: Is Voicy Safe? — full investigation

Does Blip AI train on my voice data?

Not published — the policy is silent on training, and the policy page could not be re-verified on September 10, 2026.

Blip AI's privacy page at blipai.app/privacy returned a Vercel security checkpoint (HTTP 429) to every automated request on September 10, 2026, so the statements below rest on our June 5, 2026 investigation, which read the policy directly, plus the App Store and AppSumo listings fetched today. Per that investigation, the policy states that voice audio is deleted immediately after transcription, typically within seconds; that transcribed text is not stored on Blip AI's servers and is only delivered to your device; that anonymized usage statistics are retained for up to two years; and that Blip AI is HIPAA compliant with a Business Associate Agreement available on request. The policy does not make an explicit commitment that dictation is not used to train models, and it does not name its subprocessors, even though the product is GPT-powered and therefore routes audio or text through at least one third-party model provider. The AppSumo listing adds: "Your audio isn't stored, and your text stays completely private to you." The App Store listing (developer Ayush Bansal, version 1.0.5 released July 19, rated 2.0 of 5 from 2 ratings) carries the privacy label "The developer does not collect any data from this app," which conflicts with the usage statistics the policy describes. No SOC 2 Type II, ISO 27001, or named auditor backs the HIPAA claim. Blip AI is cloud-only on macOS (12+, Apple Silicon), Windows, and Android; AppSumo team tiers (7 or 15 members) carry no separate data terms. Treat the training posture as not published until the live policy can be read.

Primary source: App Store listing (privacy label)

Deep dive: Is Blip AI Safe? — full investigation

Does WisprType train on my voice data?

No in local mode by architecture — the policy never mentions training, and BYOK cloud mode inherits the provider's terms.

WisprType's privacy policy (effective April 29, 2026) does not contain the word "train." What it does state is structural: "By default, all speech-to-text processing happens entirely on your device using WhisperKit," and the Smart Typing cleanup step "runs a local Llama 3.2 3B model entirely on your device via Apple's MLX framework." Audio recordings "are processed in real time and are not retained after transcription completes, unless you explicitly save them." Transcript history, dictionary, snippets, settings, and any API keys live in a local SQLite database under ~/Library/Application Support/com.wisprtype.app/ and are "never transmitted to our servers." In local mode, WisprType has no server-side copy of your speech, so there is nothing for the vendor to train on. Cloud mode is opt-in: "Cloud providers are never used unless you explicitly configure them by entering an API key and selecting cloud mode in Settings," and the supported providers are OpenAI, Groq, and Deepgram; in that mode, your audio and, for Smart Typing, your raw transcript text go to the provider under your own API agreement, so training and retention follow that provider's terms, not WisprType's. Two caveats keep this personal-grade. First, the policy describes PostHog telemetry as "disabled by default," but our July 2026 hands-on test of v1.1.0, still the current build as of September 10, 2026, found it enabled on a fresh install; check Settings → Privacy. Second, no legal entity, terms of service, business tier, SOC 2, or BAA is published, so there is no party to contract with for regulated use. The app is free during early access and requires macOS 12+ on Apple Silicon.

Primary source: WisprType privacy policy (effective 2026-04-29)

Deep dive: Is WisprType Safe? — full investigation

Does DictaFlow train on my voice data?

No, per the homepage and App Store label — the privacy policy itself is silent on training and names OpenAI, Deepgram, and Groq as processors.

DictaFlow's homepage states "your audio is never used to train models," and its App Store privacy label places Audio Data under "Data Not Linked to You." The privacy policy, last updated August 14, 2026 and operated by SmartBids.ai Corp., a Canadian corporation, contains no training clause; its closest commitment is that DictaFlow does "not sell personal information or use dictated audio or text for targeted advertising." The same policy names "OpenAI, Deepgram, and Groq for transcription and related AI processing" (the July 2026 version we reviewed named NVIDIA; that reference is gone), Apple, Google, and Microsoft for sign-in, Google Cloud for hosting, and Stripe for payments. On retention: "We do not permanently retain audio recordings on our servers after processing in the ordinary course" and "Audio is ordinarily discarded after processing," while transcription text "may be retained when needed to provide features you choose, synchronize supported devices, recover a requested result, investigate a support issue, or comply with law." No retention window in days is published. DictaFlow offers local processing with optional cloud cleanup and describes itself as never fully offline. The policy states the standard service is "not intended for medical dictation, clinical documentation, patient care, diagnosis, treatment, or any use involving protected health information (PHI)." DictaFlow Medical Pro ($39/user/mo for 1–4 seats, $29/user/mo for 5+) is a separate build with a published subprocessor list (Deepgram, OpenAI, Groq on allowlisted routes; Railway/Firebase, Resend/Postmark, Stripe), a Medical privacy policy dated July 24, 2026, and a customer-executed BAA as a prerequisite. No SOC 2 or ISO 27001 is published for either product. Consumer pricing: Free with 2,000 words per month, Pro $7/mo or $69/yr.

Primary source: DictaFlow privacy policy (updated 2026-08-14)

Deep dive: Is DictaFlow Safe? — full investigation

Does Otter.ai train on my voice data?

Yes, by default on de-identified data — opt-out in account settings.

Otter trains automatically on de-identified user data. Recordings and transcripts are not manually reviewed by humans unless the customer gives explicit consent for support troubleshooting; training data is encrypted. Opt-out is by request (privacy@otter.ai or the trust-center form) rather than an in-app toggle, per the June 16, 2026 privacy policy. Four suits filed in the Northern District of California in August–September 2025 (lead: Brewer v. Otter.ai) — alleging Otter "deceptively and surreptitiously" recorded private conversations and used meeting data to train AI models without all-participant consent, under the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, and California Invasion of Privacy Act — were consolidated on October 22, 2025 as In re Otter.AI Privacy Litigation, No. 5:25-cv-06911-EKL, before Judge Eumi K. Lee. On August 13, 2026, Judge Lee granted the motion to dismiss in part and denied it in part: the Wiretap Act, CIPA § 631, both Illinois BIPA voiceprint claims, unjust enrichment, and UCL claims survive, on the reasoning that Otter plausibly "independently collects, retains, and uses communications for its own commercial purposes" — including training — and so may be a third-party eavesdropper rather than the host's tool; CFAA, CDAFA, Washington Privacy Act, and most intrusion claims were dismissed with leave to amend, and the case proceeds toward discovery and class certification. The visible "Otter.ai" bot creates consent issues in the 12 US states with two-party consent laws. Conversations are stored until manually deleted; trash holds for 30 days then auto-purges. Otter holds SOC 2 Type 2.

Primary source: Otter privacy & security

Does Fireflies.ai train on my voice data?

No, per the March 2026 privacy policy — the live litigation is about voiceprint consent, not training.

Fireflies' privacy policy (last updated March 6, 2026) states: "We do not use personal information for AI model training and we contractually prohibit our vendors from using this information for their own model training," and its Zero Data Retention section says meeting content is not used for training by third-party processors; earlier versions of this tracker recorded a default-on training posture, which the current policy text supersedes. Cruz v. Fireflies.AI Corp., No. 3:25-cv-03399 (C.D. Ill., filed December 2025), a class action under Illinois' Biometric Information Privacy Act (BIPA) alleging Fireflies captured all meeting participants' voiceprints without written consent, was terminated in March 2026 and refiled in the Northern District of Illinois; two related N.D. Ill. suits — Fricker v. Fireflies.AI Corp., No. 1:26-cv-02675, and Martinez v. Fireflies.AI Corp., No. 1:26-cv-03512 — were consolidated before Judge Steven C. Seeger with Fricker as the lead case and Werman Salas P.C. as interim class counsel; no ruling on the merits as of September 2026. The visible "Fireflies.ai Notetaker" bot creates consent complications in two-party consent jurisdictions. Audio, video recordings, transcripts, speaker identification, and meeting metadata are stored until manual deletion; voice characteristics used to separate speakers are processed by service providers and, per the policy, never stored on Fireflies' own servers. Account deletion is processed within 30 days. Fireflies is GDPR compliant.

Primary source: Fireflies privacy policy

Does Granola train on my meeting data?

Yes, by default for consumer — Enterprise plans have training off by default.

Granola uses de-identified user data to train internal AI models supporting its services by default. The opt-out is in account settings and is not surfaced prominently — and it exists only for Granola users; other meeting participants have no notice and no opt-out path. Enterprise users have training off by default. Third-party LLM providers (OpenAI, Anthropic) are contractually prohibited from training on Granola data. That training default is now the subject of litigation: Chamberlain v. Granola, Inc., No. 3:26-cv-07926 (N.D. Cal., filed July 30, 2026) is a putative class action alleging Granola intercepts and records virtual-meeting participants without their knowledge or consent and uses their communications to train its AI models by default, claiming violations of the federal Wiretap Act (ECPA), California Invasion of Privacy Act §§ 631–632, CDAFA, common-law intrusion upon seclusion, the UCL, and unjust enrichment. Because Granola captures system audio rather than joining meetings as a visible bot, participants who aren't Granola users get no indication recording is happening — the complaint quotes Granola's own marketing that "other people in the room won't know." Earlier, on April 2 2026, The Verge reported that Granola makes meeting notes accessible to anyone with the share link by default and opts users into internal AI training in default settings, contradicting the app's "private by default" marketing. Architecturally, audio is transcribed in real time on macOS/Windows and not stored, but audio is sent to cloud transcription providers (Deepgram, AssemblyAI) and summarization uses cloud LLMs (OpenAI, Anthropic). Transcripts and notes are stored in a US-hosted AWS Virtual Private Cloud, encrypted at rest and in transit, backed up daily. iOS uses temporarily cached audio.

Primary source: Granola privacy policy

Deep dive: The Granola lawsuit, explained — full analysis

Does Zoom AI Companion train on my meeting data?

No — contractual prohibition on training across customer content.

Zoom AI Companion does not train Zoom's or third-party AI models on customer audio, video, chat, screen sharing, attachments, or other communications-like content. The commitment is contractual rather than an opt-out — it is stated directly in both the Zoom Privacy Statement and the AI Companion Security & Privacy page. The architecture itself is the honest qualifier: AI Companion uses a federated approach that routes prompts through Zoom-hosted models plus third-party subprocessors (OpenAI, Anthropic, and Perplexity for web search). Customer content is processed to deliver features, retained for a period, and shareable inside the org account (hosts and admins can access transcripts and summaries from any meeting they organize or join). Enterprise admins can elect the Zoom-hosted Models Only (ZMO) deployment, which keeps processing inside Zoom infrastructure and removes external subprocessors from the path. BAA is available for specific HIPAA-regulated configurations. Track record context: in August 2023, Zoom quietly added ToS language that would have permitted training on customer content; after The Verge coverage and public outcry, Zoom walked it back and committed to no training without consent, later hardening that to an absolute prohibition. No known breaches of AI Companion content. The Feb 2 2026 Privacy Statement update expanded the definition of "Customer Content" to cover content created using Zoom products beyond meetings, webinars, and messages — the no-training commitment continued to apply, and a further July 27 2026 revision (messaging-campaign data, EU/UK representatives, transfer mechanisms) left it unchanged.

Primary source: Zoom AI whitepaper — data governance & privacy

Does Fathom train on my meeting recordings?

Yes, by default on de-identified meeting content for Fathom's own models — with an in-app opt-out; its third-party AI vendors may not.

Fathom's privacy policy (last updated August 16, 2026) states: "Based on how you configure your account settings, we may use and create de-identified data generated from Meeting Content Information to improve our Service by training, improving, and customizing our in-house artificial intelligence models. You can opt out from this use of your data in your account settings." The help-center article "Is Fathom secure?" confirms the default is on — "Fathom uses de-identified customer data to improve the accuracy of our proprietary AI models" — and that individuals opt out under Settings while organizations on Team Edition can opt out every user from Organization Settings. The same policy draws a line for outside vendors: "We do not authorize third parties (e.g., OpenAI, Anthropic, Google, etc) to use your personal information or Meeting Content Information to train their artificial intelligence models," and the help center names Anthropic, OpenAI and Google as the AI sub-processors. Fathom collects audio and video recordings, transcripts, speaker identification, calendar data, attendee names and emails, and voiceprints in its iOS app; all data is stored in the United States. There is no published retention window for active accounts — data is kept "as long as necessary" — but on account deletion recording data is removed and backups purge after a further 7 days. Pricing: Free, Premium $20/mo ($16 annual), Team $19/$15, Business $34/$25, Enterprise custom; a HIPAA BAA and custom retention appear only on Enterprise. Fathom states SOC 2 Type II, HIPAA and GDPR compliance and no ISO 27001. As of September 10, 2026 no lawsuit or regulator action names Fathom; the 2026 wiretap wave targets Otter, Fireflies and Granola.

Primary source: Fathom privacy policy (Aug 16 2026)

Does tl;dv train on my meeting recordings?

No — the policy excludes Customer Content from training by tl;dv and its AI providers; the 2026 concern is a six-month Firestore exposure, not training.

tl;dv's privacy policy (last updated September 9, 2026; Tldx Solutions GmbH, Aachen, Germany) states that Customer Content — meeting recordings, transcripts, notes and files — is not used "to train, fine-tune, or improve foundation models, large language models, or other generative AI models," and that third-party AI providers process it "solely to provide the requested functionality" without training their general-purpose models. The security page repeats: "No customer data is used to train the AI." Named processors are Anthropic and Google Vertex AI for AI features and AssemblyAI and ElevenLabs for transcription; hosting is on Google Cloud, Hetzner and Wasabi, primarily in Germany and Finland, with AI processing selectable in the US or EU. Retention: free users' recordings are deleted after 3 months; paid users' data is kept until account deletion; logs 10 days; data on non-client meeting participants up to 5 years or until a deletion request. Certifications stated: SOC 2, ISO 27001, PCI DSS, GDPR; no HIPAA. The track-record issue is security, not policy. Researcher bobdahacker reported on January 28, 2026 that a missing tenant-isolation rule on the Firestore "meetings" collection let any authenticated account enumerate 181,874 meeting records across 84,312 users — creator emails, conference IDs, recording status, timestamps — including roughly 1,000 joinable live calls; follow-ups through July 22 went unresolved and the write-up was published August 4, 2026. tl;dv told GIGAZINE on August 13, 2026 that these were "two separate vulnerabilities," that no audio, transcripts, AI notes, passwords or billing data were reachable, that the second vector was patched within 24 hours of discovery, and that Firebase has been removed from its infrastructure. No lawsuit or regulator action names tl;dv. The tldv.io pricing page returned 404 on September 10, 2026, so prices are not recorded here.

Primary source: tl;dv privacy policy (Sept 9 2026)

Does Read AI train on my meeting recordings?

Not unless you opt in — model improvement is off by default, and Workspace-API data is excluded from generalized training.

Read AI's privacy page states: "Contributing to model improvement is off by default. You decide - and can change your mind any time." The privacy policy (last updated June 29, 2026) implements this as a Customer Experience Program you "opt-in or opt-out" of in account settings, and adds: "We do not, and do not permit third party AI tools to, use user data collected via Google Workspace APIs to develop, improve, or train generalized/non-personalized AI and/or ML models." The policy does not name its third-party AI providers. What Read collects is broader than a typical notetaker: meeting audio and video, transcripts, and — when Google integrations are connected — Gmail message bodies and metadata, Google Calendar events and guest lists, and Google Chat messages. Audio and video are stored "in no case for longer than 2 years"; users can delete reports they own, and any participant who types "opt out" in chat has the meeting's data "immediately and permanently deleted." Read announces itself at the start of every meeting and requires host approval before joining. Since March 26, 2026 it also offers a botless Google Meet mode built on the Meet Media API, free for all customers, plus desktop and mobile apps that record "locally or to the cloud without a bot"; transcription and analysis still run in Read's US-hosted cloud. Pricing: Free, Pro $19.75/mo ($15 annual), Enterprise $29.75/$22.50, Enterprise+ $39.75/$29.75; HIPAA support, SAML/SCIM and a custom retention policy are Enterprise+ only. Read states an annual SOC 2 Type II audit, HIPAA technical safeguards with a BAA on request, and AES-256 / TLS 1.2+ encryption; its support-center security articles and trust portal could not be fetched, so the audit report is unverified. As of September 10, 2026 no lawsuit or regulator action names Read AI.

Primary source: Read AI privacy policy (June 29 2026)

Does Notta train on my recordings and transcripts?

Not published — Notta's policy excludes only Google Workspace API data from training and says nothing about its own models on your audio.

Notta's privacy policy (effective September 2, 2025; contracting entity Notta PTE. LTD. in Singapore, or Notta 株式会社 for Japan users) contains one sentence about model training, and it is scoped to a single data source: "Google Workspace APIs are not used to develop, improve, or train generalized/non-personalized AI and/or ML models." Nothing in the policy, the terms of service (effective September 2, 2026) or the security page states whether audio you upload or record, or the transcripts Notta generates, are used to train Notta's own models. The policy lists "To analyze and improve our Services" as a purpose, and the terms grant Notta a licence to "access, process, copy, export, and display Customer Data" for service purposes. Secondary blogs describe an opt-out setting or a support-request opt-out; no Notta page fetched on September 10, 2026 shows one, so that claim is unverified. Retention is also not published in the policy: a Notta help-center search snippet (the article itself returned 403) says transcription data is stored indefinitely unless the user, workspace or account deletes it, and that automatic file deletion (1–365 days) is an Enterprise-only setting. Notta collects audio, video, voice and text inputs, account, device, IP, location and usage data; it hosts on AWS with no region stated, and encrypts with TLS 1.2 in transit and AES-256 at rest. The security page states SOC 2 Type II through an independent audit, ISO 27001, GDPR and CCPA compliance, and that Notta "follow[s] HIPAA guidelines"; no BAA is offered on any fetched page. Notta Desktop (public beta, macOS 13+ / Windows 10+) records without a bot but transcribes in the cloud. Pricing: Free 120 min/mo, Pro $13.61/mo ($8.17 annual), Business $27.78/$16.67, Enterprise custom from 51 seats. No lawsuit, breach or regulator action names Notta.

Primary source: Notta privacy policy (effective Sept 2 2025)

Does Google train on my Meet "Take notes for me" transcripts?

Not on Workspace accounts, by contract; on personal Google AI Pro / Ultra accounts the exclusion is not published.

The answer splits by account type. For work and school accounts, the Google Workspace generative-AI privacy hub (updated August 14, 2026) states: "Workspace does not use customer data for training models without customer's prior permission or instruction" and "Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission." Meet is listed among the covered apps, prompts are customer data under the Cloud Data Processing Addendum, Gemini in Meet is covered by the Google Business Associate Agreement, and admins can disable Gemini in Meet, require participant consent, and set retention ("90 days to indefinite, as determined by admins"). The notes document "is saved in the meeting organizer's Google Drive in the 'Google Meet' folder" and "follow[s] the Meet retention policy that your organization has configured." For personal accounts, Google opened "Take notes for me" to Google AI Pro and Ultra subscribers on June 29, 2026. No Google page fetched says whether those transcripts are exempt from training. The Gemini Apps Privacy Hub (updated August 10, 2026) says Gemini Apps Activity — including audio and Gemini Live video — is used to "provide, develop, and improve its services (including training generative AI models)," that "a subset of chats are reviewed by human reviewers," and that activity auto-deletes after 18 months by default; whether Meet notes are logged as Gemini Apps Activity is unverified. In both cases Meet notifies every participant that notes are being taken. Track record: Thele v. Google LLC, No. 5:25-cv-09704 (N.D. Cal., Judge Noël Wise), filed November 11, 2025, alleges Google switched Gemini "smart features" on by default across Gmail, Chat and Meet on or about October 10, 2025, in violation of CIPA and the Stored Communications Act. On July 7, 2026 the court dismissed the first amended complaint for lack of concrete harm with leave to amend; a Second Amended Complaint was filed August 18, 2026, and Google stipulated on August 20 to extend its response deadline. No merits ruling exists.

Primary source: Workspace generative-AI privacy hub (Aug 14 2026)

Does Abridge train on my patient conversations?

Yes, on de-identified data — and since August 2026 the exact terms are in your health system's BAA, not a public policy.

Abridge is an ambient clinical scribe sold only to health systems; there is no individual plan. Its archived privacy policy (effective December 1, 2022) stated: "We use de-identified data for research and development of new products or tools, to refine our algorithms and machine learning applications, and to improve the Services." The policy last updated August 27, 2026 drops that sentence and says Customer Data "is governed exclusively by the terms of our agreements with those customers, including our Business Associate Agreements (BAAs)." On June 11, 2026, Abridge and Nvidia announced a clinical-conversation model trained on de-identified doctor–patient conversations from Abridge's platform of roughly 100 health systems. The training term is negotiable at the contract level — Kaiser Permanente told The Markup (June 16, 2026) it does not allow its data to be used for training — but no clinician- or patient-level opt-out is published. Abridge does not publish an audio-retention window; customer FAQs cite 30 days (CPCMG) and 14 days (Kaiser) for audio and transcripts, with the finalized note living in the EHR. Litigation targets Abridge deployments rather than Abridge: Saucedo v. Sharp HealthCare (San Diego Superior Court, filed November 26, 2025) alleges recording without all-party consent under California's CIPA and that the tool inserted "consented" statements into charts; Washington et al. v. Sutter Health and MemorialCare (N.D. Cal., filed April 8, 2026) alleges CIPA, CMIA, UCL, and federal Wiretap Act violations. Abridge holds SOC 2 Type 1 and 2 and TX-RAMP, states it is HIPAA-aligned, and signs BAAs. For comparison, Microsoft's Dragon Copilot puts its no-training commitment in the Microsoft Products and Services DPA, a published document.

Primary source: Abridge privacy policy (Aug 27, 2026)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Freed train on my clinical notes?

Yes, on de-identified notes, gated by a Platform setting whose default Freed does not publish — check it on day one.

Freed is a self-serve AI scribe for individual clinicians (Starter $39/mo for 40 notes, Core $79/mo, Premier $104/mo on annual billing; 7-day trial; Groups on custom pricing). Its security page states: "AI is only trained on de-identified notes." The Platform Terms of Use (last updated August 13, 2026) are more specific: Freed may use De-identified Data "to train the AI/ML models to improve the Platform, including but not limited to improving the Platform accuracy, efficiency and quality of speech recognition and Output, with your consent provided via Platform settings," and will "link your De-identified Data with your customer ID and use it to customize and train our Platform based on your specific styles and requirements." The same Terms give Freed "the right in our sole discretion to use De-identified Data and to disclose such De-identified Data to third parties." Freed states "Protected health information is never used for AI training purposes." Whether the consent setting is on or off at sign-up is not published. On retention, Freed states "Patient recordings are saved only until the note has been completed, then automatically deleted," with a settings option to "delete the Patient Recordings immediately once they are processed"; notes follow a user-chosen 30-day auto-delete or term-of-agreement window. Data is hosted on Microsoft Azure in the United States. Freed holds SOC 2 Type 1 and 2, states it is HIPAA- and HITECH-aligned, and signs BAAs (the BAA is Schedule A of the Terms). No breaches, lawsuits, or regulator actions naming Freed were found as of September 2026.

Primary source: Freed Platform Terms of Use (Aug 13, 2026)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Heidi Health train on my consultation data?

No, per Heidi's July 2026 statement — though the privacy policy still reserves de-identified and aggregate use.

Heidi Health is an Australian AI scribe with a free tier (unlimited transcription), a Clinician plan with a 14-day trial, and Teams and Enterprise contracts; the pricing page shows no dollar amounts. Heidi's support article "How Heidi protects your data" (July 23, 2026) states: "Heidi does not use consultation data, session transcriptions, or generated notes to train its AI model in any way." The privacy and security FAQ adds: "We don't use any of your sensitive health information for model training. We only use your data for the purpose it was collected." Two qualifications: the privacy policy (page dated October 2024) still lets Heidi "de-identify and/or aggregate your personal information, including your health information" for platform development, and for the Ask Heidi evidence feature it says "Queries may be reviewed and used in de-identified form to improve the platform, but PHI will not be used for model training." No opt-out is published for that de-identified query review. On retention, the FAQ states "Heidi does not store audio recordings of patient consultations" and that notes and transcripts are configurable "between 1 day and 'never delete'," with never delete as the default. Health information is stored in the user's own jurisdiction (Australia, UK, US, EU, Canada); US data is "locally hosted within the United States." Heidi lists ISO 27001, ISO 42001, and SOC 2 Type 2, states it is HIPAA-aligned, and says "We make a BAA available to every covered entity we work with." It raised a $65M Series B in 2026. No breaches, lawsuits, or regulator actions naming Heidi were found as of September 2026.

Primary source: How Heidi protects your data (Jul 23, 2026)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Nabla train on my encounter audio?

Not by default — only on de-identified audio you choose to submit as feedback, which Nabla then keeps indefinitely.

Nabla is a French-founded ambient scribe hosted on Google Cloud, with U.S. client data in U.S. regions and non-U.S. data in EU (Belgium) data centers; Azure handles speech-to-text in U.S. regions. Its trust center states: "By default, we don't store audio." and "We retain clinical notes for a short period of time (14 days), which is configurable by client based on geographic region requirements" — the shortest published note window among the clinical scribes in this tracker. The only training path Nabla documents is optional feedback. Its help center says: "All audio is anonymized immediately upon sharing and original audio replaces PHI with a 'beep' sound," "Only the de-identified file is stored," and "Audio is stored in our Feedback database indefinitely." The companion Feedback article states that feedback is used for training Nabla and for troubleshooting; that article returned 404 on September 10, 2026, so the wording is per its search-index text and marked unverified. The public privacy policy (May 16, 2023) covers website visitors only and says nothing about clinical audio. Nabla lists SOC 2 Type II (November 2024–October 2025 period), ISO 27001 (September 2025), and TX-RAMP Level 2 (January 2026), states it is HIPAA- and GDPR-aligned, and lists BAA terms among its trust-center documents; BAA availability on self-serve plans is not published, and Nabla publishes no prices. University of Iowa Health Care's patient FAQ states "Nabla does not retain the audio recording." No breaches, lawsuits, or regulator actions naming Nabla were found as of September 2026; a January 2026 Verite News story questioned patient-consent practice at an LCMC Health deployment (page not retrievable, unverified).

Primary source: Nabla Trust Center

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Suki train on my dictation and visit data?

Yes, on de-identified data, under a Terms-of-Service license with no published opt-out.

Suki is an ambient scribe and dictation assistant sold to practices and health systems; no self-serve pricing page was found (the /pricing and /security URLs return 404). Suki's developer security documentation states: "Any data that is used for ML training and improving the product is de-identified." It describes the method: "For audio, we use a de-identification algorithm that breaks audio into chunks and isolates them such that the original audio cannot be re-constructed," and "We de-identify the transcript by removing all PII." The Terms of Service make the permission contractual: Suki may access Customer Data "for the purpose of using the Customer Data for system tuning, grammar tuning, training of acoustic models and other models, tools and algorithms," and "Suki owns all rights in and to any aggregated, non-identifiable data it develops or creates." The privacy policy (last updated May 16, 2025) does not mention model training, and no opt-out toggle or contractual opt-out is published — a customer that wants one must negotiate it. Retention is published: audio and transcripts are "permanently deleted after 30 days," and clinical notes are retained for the duration of the service contract. Data is hosted on Google Cloud in the United States with AES-256 at rest and TLS 1.2 in transit. Suki's homepage states it is "SOC2 Type 2 certified, and HIPAA compliant"; the developer docs add "We sign Business Associate Agreements (BAA) for patient data handling with our customers." No breaches, lawsuits, or regulator actions naming Suki were found as of September 2026.

Primary source: Suki developer docs — Security & Compliance

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does DeepScribe train on my patient data?

Yes — its Terms of Use license customer data to machine learning for product improvement and de-identified data "for any legal purpose," with no published opt-out or retention window.

DeepScribe is an enterprise ambient scribe with no self-serve plan (the site offers "Request a demo" only). Its Terms of Use (updated October 17, 2024) grant DeepScribe the right to "use, store, host, perform, display and create derivative works from the Customer Data, including by combining Customer Data with data from third party sources and utilizing machine learning and artificial intelligence applications, for the purposes of (a) providing the DeepScribe Services ... (b) complying with applicable laws and regulations; and (c) operating, analyzing and improving DeepScribe's products and services." A separate clause lets DeepScribe "retain, share, and use the De-Identified Data for any legal purpose including without limitation for purposes of operating, analyzing, improving or marketing the DeepScribe Services." That is broader than the de-identified-only wording at Freed, Suki, or Abridge, and because de-identified data falls outside PHI, a standard BAA does not narrow it — a health system must do that in the master agreement. The privacy policy (no date visible on the page) says only that data is used to "improve the Services" and is retained "for as long as it remains necessary for the identified purpose or as required by law"; no audio or transcript deletion window is published anywhere. Data is processed on servers "located in the United States"; subprocessors are not named. The homepage shows SOC 2 and HIPAA badges, the security-practices page says DeepScribe holds "relevant certifications" without naming them, and the BAA is incorporated as Exhibit A of the Terms and "shall control" over the Terms on PHI. No breaches, lawsuits, or regulator actions naming DeepScribe were found as of September 2026.

Primary source: DeepScribe Terms of Use (Oct 17, 2024)

Deep dive: Best AI medical scribe tools for doctors — full comparison

Does Ollama train on my data?

No — Ollama operates no model server.

Ollama is a local runtime: there is no Ollama-operated model server to send prompts or completions to. Models run entirely on local hardware. Ollama exposes an OpenAI-compatible local REST API on localhost:11434; nothing leaves the user's machine in default operation. There is no vendor server, so there is no retention surface and no training path. Ollama is open-source under the MIT license with over 100,000 GitHub stars; the codebase is transparent and there are no documented incidents. Caveat: users who deliberately expose the local API beyond localhost create their own attack surface — that is a deployment choice, not an Ollama default.

Primary source: Ollama GitHub repo

Does LM Studio train on my data?

No — inference runs locally; no chat data leaves the device.

LM Studio runs models locally on the user's hardware with an optional OpenAI-compatible local server. Inference happens entirely on-device; there are no LM Studio servers in the inference path. The optional LM Link feature uses end-to-end encrypted Tailscale mesh VPNs to connect a user's own devices for remote inference — chats remain local even when accessed from another linked device. LM Link shares only device-list metadata (not chats) with LM Studio's backend for device discovery. The application is closed-source but transparent about data flows on the LM Link product page; no documented incidents.

Primary source: LM Studio

Does Jan train on my data?

No — Jan operates no model server.

Jan is an open-source local LLM runtime under Apache 2.0. Models run locally; there is no Jan-operated model server, so there is nothing to train on and no retention surface. Optional cloud-provider integrations are explicitly opt-in — when enabled, the chosen provider's terms apply for that specific feature. In default operation, nothing leaves the device. The codebase is auditable on GitHub with an active community roadmap; no documented incidents.

Primary source: Jan