Most people who use voice dictation never think about where their voice actually goes. The marketing tells you the software is "private" or "secure" and you mostly trust it. For medical conversations, financial writing, and personal correspondence, this trust deserves more scrutiny. Here is what actually happens when you dictate into different products.
The cloud vs local distinction
Voice recognition can run in two fundamentally different places: on a server somewhere on the internet (cloud), or on your own computer's processor (local, on-device). The user experience is similar — you speak, words appear — but the privacy implications are very different.
Cloud-based dictation sends your voice audio to a server, where the recognition runs, and sends the resulting text back. Your voice was uploaded to a third party's infrastructure. Whether that audio is stored, logged, used for training, shared with partners, or deleted depends entirely on the vendor's policies — which usually you didn't read.
Local/on-device dictation runs the recognition on your own computer's CPU using a downloaded model. Your voice audio never leaves the device. There is nothing for anyone to log, store, or train on, because nothing was uploaded in the first place.
Which tools are which, in 2026
Local (your voice stays on your computer):
- CaringDictate — fully local. Whisper Large v3 Turbo runs on your CPU. Nothing uploaded, ever. Privacy policy here.
- Dragon Professional Individual v16 — local. Older recognition technology, but runs on your computer.
- Apple Dictation on newer Macs and iPhones — local on devices with the Apple Neural Engine (2020+ Macs, iPhone XS or newer). Older Apple devices send audio to Apple servers.
- Microsoft Voice Access on Windows 11 — local.
- VoiceInk (Mac) — local.
Cloud (your voice goes to a server):
- Dragon Anywhere — cloud-only.
- Dragon Medical One — cloud-only.
- Otter.ai — cloud-only.
- Wispr Flow — cloud-based (despite marketing implying otherwise; their recognition runs on their servers).
- Google Docs Voice Typing — cloud-only. Audio sent to Google.
- Voiceitt — cloud-only.
- Older Apple devices — cloud, audio sent to Apple servers.
For users with HIPAA-relevant conversations, financial sensitive discussions, legal privilege concerns, or just personal preference for not having third parties hear them — the cloud category is a hard pass.
What "HIPAA compliant" usually means (and doesn't)
Many cloud dictation services advertise being "HIPAA compliant." This sounds like a privacy guarantee. It mostly isn't.
HIPAA compliance for a cloud vendor typically means the vendor has signed Business Associate Agreements with covered entities (hospitals, clinics), implemented certain access controls, and follows certain audit requirements. It does not mean your voice isn't uploaded to their servers. It means they handle that upload according to HIPAA rules — which still includes storing the data, having employees with access to it, and (in many cases) using it for service improvement.
For an individual patient or family member who wants their voice never to leave their computer, the right test is not "is it HIPAA compliant?" The right test is "is it local?" If the answer is yes, the privacy is technically guaranteed by the architecture, not by policy. If the answer is no — even if the cloud service is HIPAA compliant — your voice was uploaded.
What actually gets stored, even on cloud services
For cloud dictation services, what gets stored varies. Common patterns include:
- Audio recordings — kept for service improvement, debugging, or model training. Some services let you opt out; many don't.
- Transcripts — the text outputs are often stored indefinitely. Most users don't realize the transcripts of everything they dictate exist in the cloud.
- Metadata — timing, device info, IP address. Useful for analytics, but it's still data about your usage.
- Voice profiles — some services build a profile of your voice over time for better recognition. This is a literal voiceprint, which has biometric implications.
None of this exists for local dictation tools, because nothing was uploaded.
The "AI training" question
Many people are now justifiably wary of having their voice or writing used to train AI models. Cloud dictation services often (not always) include training-data clauses in their terms of service. These clauses grant the vendor a license to use your audio and transcripts to improve their recognition models.
For some users this is fine. For others — especially those who write about medical conditions, family matters, or intellectually-protected work — this is unacceptable. The defense is to use local dictation. With CaringDictate (and any other fully-local tool), nothing was uploaded, so there is nothing to train on.
The internet-required question
A related but separate issue: cloud dictation requires internet. If your home internet is down, your cloud dictation does not work. If you're traveling somewhere with poor connectivity, your dictation quality may suffer or fail entirely. For users who depend on dictation for accessibility reasons, this dependency on a stable internet connection is a vulnerability.
Local dictation works without internet. CaringDictate downloads the recognition model once during the initial install, and from that point on, it works fully offline. This matters for travel, for intermittent connections, and for the (increasingly rare) cases where you simply don't want your computer phoning home for everything.
How CaringDictate handles privacy specifically
Our architecture is intentionally simple to verify:
- Whisper Large v3 Turbo (the recognition engine) is downloaded once during install and stored on your computer.
- When you dictate, audio is captured by the microphone, processed by Whisper on your CPU, and converted to text. The audio buffer is then discarded.
- The text is injected into whatever text field has the cursor.
- Nothing is sent over the internet. Nothing is logged. Nothing is stored.
- You can verify this with any network monitoring tool — CaringDictate makes no outbound connections during dictation.
The only network traffic CaringDictate ever generates is during the initial install (downloading the recognition model and any update checks). Once installed, it is fully offline.
Practical recommendations by use case
For general dictation (email, documents, web forms): Any local dictation tool will do — CaringDictate, Dragon, or Apple Dictation on a newer Mac.
For medical conversations or HIPAA-relevant work: Local-only is the right answer. CaringDictate is built specifically for this; older Dragon Professional also works (though it lacks updates).
For meetings you want transcribed: Otter.ai is the standard choice but is cloud-based — make sure everyone in the meeting consents to that.
For privacy-sensitive personal writing (journals, memoirs): Definitely local. CaringDictate or older Apple Dictation. Avoid cloud services entirely.
Where to go from here
For the full technical detail on how CaringDictate handles your data, see our privacy policy. For comparisons with cloud-based alternatives, see vs Dragon Anywhere, vs Wispr Flow, vs Otter.ai.