BabbleScribe privacy policy

Effective date: 2026-11-03

BabbleScribe is a private voice typing app for Android. This policy describes what the app does with your data. In short: the app author runs no server for BabbleScribe, collects nothing, and has no analytics or ads. Anything that leaves your phone goes only to a speech or text service that you configure yourself.

Who is responsible

• The app author is responsible only for the BabbleScribe app code. The author does not receive your audio, text, keys or usage data, because the app never sends them to the author.
• A cloud provider you choose (for example OpenAI, Groq, ElevenLabs, OpenRouter or Anthropic) handles the data you send it under its own terms and privacy policy. For ElevenLabs, your audio goes to ElevenLabs, and its free plan has no commercial licence.
• A server operator (you, or whoever runs a self-hosted server you pair with) handles the data that server receives. If someone else runs it, read their policy first.

What stays on your device

• Transcript history is saved on your phone by default: the recognised and final text, timestamp, duration, language hints, model or provider display names, title and pin state, and for a polished note the name of the polishing step that polished it and how each polishing step went (its connection name and id, model, and a short result such as ok or failed; a private take stores none of this). Text, titles, model names and these step names are encrypted with AES-GCM using an Android Keystore key. Row IDs and timestamps are unencrypted index data inside the app sandbox.
• Original audio from normal recordings is kept on your phone as encrypted segments. Private sessions use a temporary encrypted cache that is removed when the take finishes or is discarded.
• Insights (weekly totals, streaks, goals, timing measurements, top words) are computed on the phone from saved notes and are not sent anywhere. Themes and tone are the one exception, described below. Their results are saved on your phone encrypted with the same key as your history, deleted with the note they describe, removed when you clear history or tap Forget theme analysis, and left out of backups and exports.
• A usage record is kept on your phone for each speech or text call, including the phone's own model (time only). It holds the time, the feature, the connection id and kind, the route type (your server, your own network, the cloud or this phone), the model, how long the call took, the HTTP status code of a failure, the audio length, token counts, the cost (reported by the provider or estimated), whether it worked, and a random id that groups the calls of one dictation. A saved note keeps that same random id in your encrypted history, so the note can show what its calls cost; a private take keeps none. It never holds text, audio, keys, addresses or connection names. Private takes add to daily totals only and leave no per call row. Per call detail is kept for 90 days, then only monthly totals remain. Clear history deletes the per call rows and keeps the totals. The record is never backed up and never sent anywhere. Settings, Usage shows it, and Clear usage record deletes it. A balance check happens only when you tap Check balance on an OpenRouter or ElevenLabs card: it sends that connection's key to that provider's own address and nowhere else, and keeps only the numbers it gets back.
• API keys and pairing tokens are encrypted with the Android Keystore, one slot per profile. They are not included in exports or backups.
• Settings such as dictionary words, languages and routing choices are stored locally.
• Android's own backup is disabled (allowBackup is false), so Android does not copy app data to Google or another device by itself. The optional Google account backup below is separate and is off unless you turn it on.
• Turn on Private session to skip history and stats for one take, or turn off Save notes in history. Deleting history removes saved notes. Uninstalling the app removes local data and keys.

What goes to providers or servers

Data leaves the phone only when you set up a provider or server, and only for the task you route to it. Audio goes only to the connections in your flow, in the order you set. When one is unavailable or its free allowance is used up, BabbleScribe moves to the next and tells you. There is no fallback to a provider you did not add. The one other case is Transcribe again: you may pick a connection that is not in your flow for that single run, and nothing is sent until you tap Send to that connection. It is not added to your flow, and Phone and my server only refuses a cloud choice.

• Speech recognition: if you pick a cloud or self-hosted speech route, the recorded audio is sent to that endpoint with your key or token, plus the chosen model, language and optional dictionary hints. If you pick an on-phone model, recognition runs locally and no audio is sent.
• Themes and tone (optional): nothing is analysed until you tap Find themes, and analysis never runs in the background or on a schedule. The text of the notes being analysed, with a language code, goes to your paired server. Titles, dates and audio are not sent. Your pairing token goes in a header to your own server, as with every request to it. When you open Insights, BabbleScribe asks your server once what it can do (a request with only that token and no notes), but only if that server is in your speech flow or does your text polishing. If the server fails, analysis stops; it never moves to another route.
• Suggested titles (optional): when a polished note has at least 50 words and no title, or when you tap Suggest title, up to 6,000 characters of the note and its language code go to your paired server (which gives the model the first 4,000), or the first 4,000 characters go to the polishing (or, for the button, writing) connection you chose, never to a connection you did not choose, never in a private take, and not to a cloud connection while Phone and my server only is on. When your polishing style is Remove fillers only, a take makes no title request at all; only a tap on Suggest title sends the note, to your polishing connection (as do Fix punctuation and Polish in a note). The title that comes back is checked on the phone, saved with the note, and never replaces a title you typed. A failed request is dropped without a message.
• Text cleanup, rewriting and voice commands: these are off by default. When you turn one on, the transcript (or the note you chose to rewrite, or the current field text for a voice command) and your dictionary hints go to the text profile you selected. When cleanup (polishing) is on, the transcript, its language and your dictionary hints go to your polishing connection. If you choose a Custom polishing style, your style text goes with them. With Remove fillers only, dictation sends nothing. Suggest title, Fix punctuation and Polish send the note only when you tap them, to the connection they name (your polishing connection), after showing you where it goes. Your writing instructions are used only for drafts. Phone and my server only, and private sessions, also skip cloud polishing steps. Transcribe again can polish with a connection you pick for that one run, even when automatic polishing is off: the transcript then goes to that connection, only after you tap Send to it (or if it is already your polishing connection), and it is not saved as your polishing choice.
• Snippets (optional): if you save snippets (a spoken trigger and the text it stands for, such as an address or a meeting link), they are kept in one encrypted file on this phone and are not part of History. They leave the phone only inside a backup you turn on, in its encrypted file, and nowhere else. A snippet is expanded on the phone only after polishing, and only where you said the cue word and the trigger (or the whole take is the trigger), so what goes to your speech and polishing connections, and to the automatic title, is always the words as spoken and never an expansion. The voice keyboard never expands in an incognito field; the floating mic cannot tell an incognito field apart, so it can expand there. The expanded text is what is inserted and saved in the note; the note keeps the recognised words as spoken beside it. Later actions you start on a saved note (a rewrite, Suggest title, a Themes run on your server) send the note as it is, expansion included.
• Server recording library: if you pair a server that offers the optional library, retained recordings and their transcript parts can sync to it. You can disable this in the app. Deleting a recording on the phone removes the server copy only if you choose to delete it everywhere.
• Model downloads: on-phone speech models download from public locations (the sherpa-onnx releases on GitHub) when you tap Download. That request reveals your IP address to the host, as any download does.
• Connections use normal certificate validation and do not follow redirects when carrying a key. The Google Play version refuses plain HTTP addresses and reaches every provider and server over HTTPS. Builds you install from GitHub also offer plain HTTP as a deliberate opt-in, for use inside a trusted private network.
• Backups: BabbleScribe writes encrypted backup files to a location you choose in Android's file picker, which can be Google Drive or any other storage app you have installed. The Google Play version can also connect to your own Google account if you choose (see Google account backup below). Without that, BabbleScribe never contacts Google itself.

Personal voice (optional)

If the server you paired offers it, BabbleScribe can make a synthetic copy of your own voice. This is hidden unless the server says the feature is on, and the Google Play version does not show it.

• What is sent: a voice sample you choose from one of your recordings, its transcript, and a short recording of you reading aloud a consent sentence that the server gives you, to your paired server only. The consent recording is checked to confirm that the same person gave the sample and the consent, and a voice is created only when it passes.
• What the server holds: the voice and the samples, under the server operator's own policy. If someone else runs the server, read their policy first. Spoken text you ask it to read in your voice is sent to the same server, and the generated audio is saved encrypted on your phone.
• Your control: you can only copy your own voice. You can delete a voice from the app at any time, which asks the server to remove it.

No analytics, no ads

BabbleScribe has no analytics, crash reporting, advertising or tracking libraries, and no developer operated server. The app has no built in updater and does not check for updates.

Export diagnostics (optional)

Settings, About, Export diagnostics builds a short plain text file for you to share with support if you choose. It runs only when you open it, and it shows you the exact text before anything is saved. BabbleScribe does not send it anywhere and does not keep a copy. You pick where the file is saved in Android's file picker, and cancelling writes nothing.

• What it contains: the app version and build, the Android version, the phone's maker and model, and the type of each step in your speech and polishing flows (on the phone, paired server, your own network or cloud, plus the kind of provider such as openai_compatible, or "removed" if the connection was deleted) with whether each step is on or off and whether Polishing is on or off. For up to 20 recent saved takes it lists the date (no time of day), the length in seconds, the route type, which part of the app it came from, the cleanup outcome (such as cleaned or partial) and short error codes from the speech steps, such as OFFLINE or KEY_REJECTED, sometimes followed by an HTTP status number (for example KEY_REJECTED/401). It also lists three checks made at that moment: whether the microphone is allowed, whether the speech model on the phone is present, and whether storage is low.
• What it never contains: transcripts, audio, notes, titles, dictionary words, keys, tokens, addresses or host names, provider names, contact details, text from other apps, or anything from private takes. Private takes are never saved, so there is nothing to list.
• No new log: the file is built from what BabbleScribe already stores. Failed takes are not in history (their audio, when saved, stays in Library), so only trouble inside a take that finished is listed.

Screenshots and screen recordings are allowed throughout BabbleScribe, including notes, settings and dialogs. Android may show app content in its recent apps preview. Existing secret field masking is unchanged. Content displayed or revealed on screen can appear in captures.

Accessibility service

The optional floating microphone needs BabbleScribe's Accessibility service, which you must enable yourself in Android Settings. BabbleScribe is not an accessibility tool: the service exists only to place the floating mic and insert your dictated text, and the app works without it.

• Why: to show the floating mic over other apps when a keyboard is open, to find the focused text field, and to insert your dictated text into that field.
• What it reads: window and focus information, and the focused field's node so that text can be inserted into the field that was focused when you started recording. Voice commands, when you turn them on, also read the current text of that field to send to your text connection. Just before and just after each paste it reads the focused field to check that your words landed (only once you have agreed to the current explanation of the floating mic), and if you then tap Undo it reads the field once more to confirm they are still there before removing exactly those words. For this the app keeps, in memory for six seconds, only the words it inserted and a one way hash of what the field should hold, never the field's text, and drops them as soon as you change field or app, start another dictation or switch the mic off. Undo works in most plain text fields; in rich text editors, web views and fields that change pasted text it is not offered. Undo itself never touches the clipboard; Copy text copies the words only when you tap it.
• Voice command replacement: after you agree to the current floating mic explanation, the app keeps a one way hash of the focused field while a voice command runs and checks the same field again immediately before replacement. If its text changed, the result is copied to the sensitive clipboard instead of overwriting your edits. The hash stays in memory only and is dropped when the request ends.
• Your agreement: before opening Android's Accessibility settings, BabbleScribe shows a screen that explains this and asks you to agree. It stores only which version of that screen you agreed to, on the phone.
• What it never reads: password fields. It skips fields that apps mark as passwords, so a field an app does not mark that way cannot be recognised. Dictation is refused in a marked password field, both when recording starts and at insertion.
• What it does with it: apart from the field text that voice commands send to your text connection, the screen information is processed on the phone, is not saved and is not sent to any server. Only the audio you record (and text you route to a text connection) leaves the phone, as described above.
• If text cannot be inserted safely, it is copied to the clipboard instead, marked sensitive. Android decides which apps may read the clipboard.

Recording and copying inside BabbleScribe work without the Accessibility service.

Voice keyboard

The optional voice keyboard is an Android input method you turn on yourself in Android Settings. For a held dictation, releasing the mic stops that recording. Android warns that any keyboard "may be able to collect all the text you type". BabbleScribe's voice keyboard has no typing keys and does not record, store or learn what you type. It reads only the field's type and options (to refuse password fields and detect private fields), the name of the app that owns the field (kept in memory to make sure your words go only to the field you started in), and the one character before the cursor (to add a space). Only when you tap Undo right after an insertion, it also reads the text just before the cursor, up to the length of the words it just inserted, to check they are still there before removing them; that text is compared and dropped at once, and nothing is stored or logged. The inserted words are held in memory for six seconds for this and are dropped as soon as you type, move the cursor, switch field, hide the keyboard or start another dictation. Undo only shows when the keyboard stays on screen, so turn off Return to my keyboard after inserting to use it. It never reads password fields and never records while one is focused. Fields that ask for no personalised learning, such as incognito browser tabs, are treated as a private session: nothing is saved to history or stats, the temporary audio is deleted, and if the field changes the text is discarded. The voice keyboard never uses the clipboard. Audio goes only to the speech route you chose, as described above.

Microphone

The app records audio only while you dictate from the app, the floating mic or the voice keyboard, after you grant the microphone permission. Recording from the app or the floating mic shows a notification and runs in a foreground service. The voice keyboard records only while its panel is on screen and stops when it is hidden. There is no background listening and no wake word. Revoke the permission in Android Settings at any time.

Encrypted backups

Settings, Backup and restore creates an encrypted file with a separate recovery key that you store yourself. You choose where the file goes through Android's file picker. The storage provider receives only ciphertext and file metadata such as name and size. Backups hold saved transcripts and an allowlist of preferences. They exclude keys, provider settings, raw audio and private sessions. Without the recovery key, nobody, including the author, can decrypt the file. Deleting local history does not delete older backup files.

Google account backup (optional, Google Play version)

Google account backup is present in Google enabled builds. Ordinary releases keep it disabled while phone validation is pending. The separate owner validation build can run an optional local password speed check using public fixture text. It keeps the median timing in memory only and sends no check input or result anywhere.

The Google Play version of BabbleScribe can back up to your own Google account. It is off by default, and the app works fully without it. The GitHub version has no such feature. You turn it on in Settings, Backup and restore, Google account backup: connect your account, then create a backup password.

• What leaves the phone: only data sealed on the phone first. Your backup password makes a key on the phone; the password and that key never leave it. What BabbleScribe uploads is encrypted with keys that come from it, and goes to a hidden app folder in your own Google Drive storage that no other app and no Drive screen shows. Google sees the names of the files (random codes; the first letter shows whether a file is the key, the key's seal, a list of one backup, or a piece of one), how many there are, their sizes and times. It does not see your notes, audio or settings. Sizes can still say something: notes and settings are padded, but a recording's file is not, so its size shows roughly how long the recording is.
• What a backup holds, and only what you choose: your saved notes (optionally with their earlier versions), the settings on the allowlist (dictionary words, weekly goal, languages, appearance, polishing style, snippets) and, only if you turn them on, your saved voice recordings (off by default: they are large and use your Google storage) and your connections and flows (also off by default): the names and https web addresses of the providers you set up, which speech and text steps use them, and the model names, never API keys, passwords or tokens. After a restore each restored connection needs its key typed again, and each of its steps waits for your OK before anything is sent to it. A connection whose address looks like it contains a key is left out, and the app tells you which.
• What is never included: API keys and pairing tokens, the paired server and its settings, the "Phone and my server only" choice, the recovery key of a file backup, the usage record, theme results, models, private sessions and the audio of private takes, and anything still being recorded.
• What Google is asked for: permission for BabbleScribe to use its own hidden app folder in your Google Drive (the Drive "app data" permission). BabbleScribe does not ask to see your other Drive files, your email or your contacts.
• What is kept on your phone: the email address and name of the account you picked, the backup keys (wrapped by the Android Keystore), what was backed up and when, and a short log of result codes, all encrypted. BabbleScribe does not keep the access token that Google gives it; Google Play services holds the permission. The email is shown to you and is never sent anywhere else.
• When it runs: when you tap Back up now, and, if you choose, every day or every week at night, on Wi-Fi and while charging unless you change that. Restoring is always something you start. A restore on mobile data asks first.
• Several phones: a second phone uses the same backup password to restore or to back up to the same account.
• If you forget the password: nobody can restore the backup, including the author and Google. While you still have the phone you can set a new password with its screen lock (Change backup password). If the password may have leaked, use Start over: it deletes every backup in the account and makes a new password.
• Stop it, delete it: Disconnect (with the option to delete your backups from Google) forgets the account on the phone and asks Google to remove the permission. Delete backups from Google removes every file from the hidden folder. If other phones back up to the same account they will start backing up again on their own, so turn them off first, or use Start over, which makes them stop. You can also remove the data in Google Drive settings, Manage apps, and remove access in your Google Account under Third party connections. Notes deleted on the phone stay in older backups until three more backups have run, unless you delete the backups.
• If the account is not named: in the rare case that Google does not tell BabbleScribe which account was connected, BabbleScribe asks Google (oauth2.googleapis.com) to cancel the permission it was just given, and sends only that permission's token for this.
• The usage record stays on the phone and the Google backup adds nothing to it. Android's own backup stays disabled.

BabbleScribe's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. BabbleScribe uses the Drive app data permission only to store and read its own sealed backups.

Deleting your data

BabbleScribe has no accounts and the author holds no copy of your data, so there is nothing to ask the author to delete. You delete it yourself:

• Notes and history: Settings, Delete all history removes every saved transcript and resets the scorecard on this phone. Open a note and delete it to remove a single one. Turn off Save notes in history to stop saving.
• Usage record: Settings, Usage, Clear usage record deletes it.
• Theme analysis: tap Forget theme analysis in Insights.
• A recording on your server: delete the recording and choose to delete it everywhere. This also removes the server copy.
• A personal voice: delete the voice in the app, which asks your server to remove it.
• Everything on the phone: uninstall BabbleScribe, or clear its storage in Android Settings. This removes history, audio, settings and the keys that protect them.
• Backup files and exports are copies you made. Delete them where you saved them.
• Your Google backup (Google Play version only): Delete backups from Google removes every backup file from your account's hidden app folder; Disconnect forgets the account on the phone and asks Google to remove the permission; Delete all history can delete your Google backups too. See Google account backup above.
• At a provider or server: data you sent to a cloud provider or a self-hosted server is held there under their policy. Use that provider's own deletion process or ask the server operator. Deleting data in BabbleScribe does not delete it there.

Exports and sharing

Copying, sharing and JSON export are explicit actions. Exports are readable text at the destination you pick. Choose that destination with care.

Children

BabbleScribe is not directed at children under 13, and the author does not knowingly collect data from anyone, children included, because the app collects none.

Changes

Changes to this policy appear on this page, with the effective date updated.

Contact

For questions about this policy or your data, email support@babblescribe.com.