Privacy and your data

How Flash 2.0 processes voice, text and data on your Mac. No Flash account and no AppFly server between you and transcription.

Voice and text in Groq

Audio for transcription goes directly to Groq over HTTPS, using your API key and Whisper Large v3. Correction, Change text with a command and Actions use GPT OSS 20B and send the required text, selection and relevant dictionary context. A selection command includes the selected text, instruction and boundary metadata, without surrounding text. Flash does not run web searches.

Retention, limits and processing terms depend on Groq and your account settings. Groq - Your Data ↗

When is audio sent?

Short dictations are checked locally for speech before being sent after you stop. During longer ordinary dictation, completed chunks may be sent to Groq at detected pauses while recording is still in progress. Audio chunks do not overlap. If enabled, a single AI correction follows all transcriptions, then the complete result is inserted. Canceling stops further sending and insertion, but does not recall chunks already sent.

Dictation audio is processed in memory. After an error, it may remain there until you retry, discard it, start a new recording or close the app. Flash does not save dictation audio files.

What stays on your Mac

• Your Groq key and history encryption key are stored in macOS Keychain, in Flash’s own namespace.
• Dictation history is encrypted with AES-256-GCM. The target app name stays in local history and is not sent to analytics.
• The dictionary, Actions, scripts and script versions are local JSON files. They are not encrypted by the app.

Live words, teleprompter and Apple Speech

Live words in Full notch and the teleprompter use Apple Speech. The preview prefers local recognition. If it is unavailable or fails, it automatically lets Apple recognize speech locally or online. Audio may then go directly to Apple during recording. Final dictation text still comes from Groq; the preview is not saved in history. Manage permissions in Flash’s Privacy settings and macOS. Opening settings or granting a permission does not start recording.

Analytics only with your consent

Two independent permissions are off by default:

• Performance and diagnostics: TelemetryDeck and PostHog receive technical dictation timings, insertion success, recording duration and word count, model, Mac architecture, RAM range, versions and error codes. PostHog may receive sanitized native crash reports.
• Feature usage: PostHog receives app launches, setup steps, categories of features used and teleprompter events.

Analytics receives no audio, transcriptions, clipboard content, prompts, selections, API keys, script or Action names, or target app names. PostHog does not record screens or sessions and skips IP geolocation. Services use separate random installation identifiers. Providers’ infrastructure still handles network connections, including IP addresses.

Turn either permission off in Privacy. Flash stops new events and removes the pending queue. This does not recall requests already sent or delete historical provider data.

Diagnostic log

From version 2.1.3, Settings -> Diagnostics keeps the last 40 dictation attempts on your Mac, with up to 200 entries each: stages, timings, HTTP statuses, connection measurements and verification decisions. This includes cancelled and interrupted sessions. You can manually copy and share one attempt or the full retained log. It contains no dictated text, recordings, clipboard contents or keys. With diagnostic consent, analytics also receives stage names and random attempt IDs to correlate a manually shared report with technical events. Usage-analytics consent alone is not sufficient.

A suspicious opening or ending may be checked using the existing Apple preview or a separate on-device Apple Speech session, followed by resending a short audio segment to Groq. The separate verification session does not send speech to Apple online or request new permissions. Apple text is used only for comparison, never for insertion.

Import and updates

Import from the old Flash or Noryn is manual and shows a summary first. It backs up current data and leaves the originals unchanged. Backups may also contain private content. API keys, accounts, licences and analytics consent are not imported. The public update channel is available. The app fetches its manifest over HTTPS and verifies its signature and package.

This website and contact

The website is hosted by Vercel. The provider processes connection data, including IP addresses, requested pages and request times, for delivery, security and diagnostics. Demonstrations use fictional text and do not access your microphone or Groq. We do not collect API keys here or record sessions. External links lead to services with their own privacy terms. For data and app questions, contact Sebastian Urbaniak, AppFly | Flying Pixel: kontakt@appfly.pl.

Vercel Web Analytics and Speed Insights collect aggregate traffic and performance statistics: visited pages, traffic sources, general location, device type, browser, loading times and page responsiveness. Query parameters and fragments of the visited URL are removed before measurements are sent. These measurements do not include dictations from the Flash app.

Last updated: 12 October 2026.