ClearDictate
Support Download
Download
Menu
Security

Everything happens on the Mac. Here is what doesn’t.

ClearDictate makes at most two kinds of network call: a one-time model download, and optional OpenAI requests that are off by default and can be locked off by IT.

Your Mac
On-device mode · nothing crosses this line
  1. Microphone · only while key is held
  2. Parakeet TDT 0.6B v3 · Neural Engine · ①
  3. Style + dictionary
  4. Paste at cursor
Stored locally
HistoryApplication Support
DictionaryApp preferences
OpenAI keyKeychain · if set
① One-time · first run
Hugging Face, or your internal mirror
Downloads the speech model (about 470 MB) once. No audio or text is sent.
② Optional · off by default
OpenAI API
Cloud engine and Smart cleanup, using the user’s own key. IT can force both off.
One-time model download Optional, off by default, lockable via MDM

Network calls

This is the complete list. Nothing else connects out.

CallWhenSendsIT control
Model downloadhuggingface.co or your mirror First run only A standard file request ModelMirrorURL
OpenAI cloud engine, Smart cleanupapi.openai.com Only if a user turns it on and adds a key Audio and/or text to OpenAI ForceOnDevice

No telemetry

There is no analytics SDK, no crash reporter, no usage pings and no advertising. There is no account, so there is nothing to link activity to. We cannot see who uses ClearDictate or how.

You can confirm this with any outbound firewall such as Little Snitch or your network proxy logs.

Signing and notarisation

Every release is a DMG signed with our Apple Developer ID and notarised by Apple. Verify the installed app before deploying:

$ codesign --verify --deep --strict --verbose=2 /Applications/ClearDictate.app
/Applications/ClearDictate.app: valid on disk
/Applications/ClearDictate.app: satisfies its Designated Requirement
$ spctl -a -vv /Applications/ClearDictate.app
/Applications/ClearDictate.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Megakad xd ltd (E6Y52GB4C4)

The expected signer is Developer ID Application: Megakad xd ltd (team E6Y52GB4C4). Don’t deploy a build signed by anyone else.

Permissions

  • MicrophoneTo hear you while the key is held. Each user allows this; MDM can’t pre-grant it.
  • AccessibilityTo paste text at the cursor. Can be pre-approved with a PPPC profile.
  • Input MonitoringTo detect the Fn key. Not needed if the user picks a custom shortcut.

Report a vulnerability

Email us privately with steps to reproduce. We acknowledge reports within 2 working days and will agree a disclosure date with you. Please don’t test against other people’s Macs.

/.well-known/security.txt