Most voice tools tell you what they promise not to do. This page tells you what they cannot do, given how the engine is built. Read it carefully. Verify it yourself.
Audio doesn't leave your Mac for transcription. Whisper.cpp runs locally on Apple Silicon via Metal. The text transcript is what reaches the reasoning step when you invoke a cloud tool. Your voice profile (a LoRA adapter trained on your own usage) sits on your disk and never syncs. Defensible Mode (the user-facing toggle, on by default in v1.1+) gates the cloud reasoning and telemetry layers on top of that.
Audio captured from microphone. Held in memory only.
Whisper.cpp on Metal. Audio is processed and discarded. The transcript stays in memory.
Optional LoRA adapter improves accuracy on your voice over time. Trained in batches when your Mac is idle. Never synced.
Transcript plus selected screen context is sent to OpenAI Realtime. Audio is not sent. Per OpenAI's API data policy, content is not used for training and is retained 30 days for abuse monitoring.
Response text is sent to ElevenLabs. Audio is returned and played locally. No input audio is transmitted.
Because audio doesn't egress for ASR, biometric-data regimes (Illinois BIPA, GDPR Art. 9, Japan APPI, Korea PIPA) don't fire in the listening step. The transcript is personal data and is handled accordingly: retained on the user's device, transmitted only on opt-in, with deletion and access requests honored. A formal privacy policy ships before the Day-14 gate.
Open Little Snitch and watch outbound connections during a push-to-talk session.
Run Wireshark on the loopback and Wi-Fi interfaces. Filter by On αlpha's process ID.
Pull up the Activity Monitor network tab and confirm the bytes-out count stays flat during the listen step.
When you invoke a cloud tool, you will see traffic to api.openai.com and api.elevenlabs.io. That is the reasoning and synthesis layer, not the listening layer.
Settings → Defensible Mode → Forget my voice. Resets the LoRA adapter, deletes training shards, and clears the manifest. The Whisper base model stays (it's not personalized). The reset is logged in the manifest with a timestamp — not for our records, for yours.