Audio is never written to disk

The strongest privacy statement Savory makes is structural: the code path that would save audio does not exist. Microphone and system-audio samples are read in memory, handed to the on-device transcription engine, and dropped. An automated audit runs on every change to the app and fails the build if any audio write path appears.

This is a stronger claim than "we don't upload your audio." There is no file to upload, subpoena, leak, or sync. When the meeting ends, the audio is already gone; only the text you saw being written remains.

Transcription happens on your device

Savory transcribes with Whisper models that live on your Mac. Nothing is streamed to a server, which is why transcription works in airplane mode and why "works offline" is a privacy feature, not a convenience. Speaker separation also runs locally, with models shipped inside the app.

Summaries: the one deliberate network step

When you ask for a summary, and only then, the text transcript is sent to a leading AI model, OpenAI or Gemini, and the structured summary comes back to your local library. Before sending, Savory redacts email addresses, phone numbers, card numbers, and internal IDs from the transcript.

To be precise about the boundary: the scrubbing targets identifiers, not meaning. Spoken names and the content of your discussion are what a summary is made from, so they are sent, under your explicit, per-meeting consent. Summaries are off by default; a transcript-only meeting stays transcript-only forever unless you ask.

Voice recognition stays home

If you turn on "Remember voices," Savory stores a voiceprint on this Mac only. It is never uploaded, never synced, and hard-deleted when you delete your data. The feature is off by default, and automatic recognition never overrides a decision you made by hand.

Where your data lives

Everything Savory knows about your meetings sits in local storage on your device: ~/Library/Application Support/Savory/ on the Mac. At-rest protection comes from FileVault on macOS and system data protection on iOS. Secrets live in the system Keychain. Crash diagnostics stay inside Apple's own MetricKit, and there is no third-party analytics or crash SDK in the app. This marketing website is a separate surface: it measures its own traffic and advertising like any other website, which the privacy policy details, and none of those tags can reach a single byte the app holds.

What syncs between your devices

Text your account owns syncs through your own private iCloud database: transcripts, summaries, action items, people, notes, and reminder settings. It is your iCloud account rather than a Savory server, and Apple encrypts it in transit and at rest. Audio never syncs, because it never exists as a file to sync. Voiceprints never sync either, and that is enforced by a rule in the sync engine rather than by a setting you could flip. Calendar caches, consent records, and everything in the Keychain stay on the device that made them.

The one server, and what it is for

Savory asks you to sign in so an account can be yours on more than one device, and so a subscription can be metered. The account service holds your email address, your sign-in method, your consent choices, session records, and purchase and metering records. It holds no transcript, no summary, no note, no person, no calendar event, and no voiceprint. When Savory sends a summary request through it, the scrubbed text is forwarded to the provider and never stored, and the logger structurally refuses to write message bodies. The full inventory is in the privacy policy.

Every recording starts with a consent prompt, enforced before capture begins rather than mentioned in a settings page. Per-person rules let you mark people who should never be recorded. An audit log records consent decisions without storing any meeting content.

Deleting is real

Sign-out removes nothing; deletion is its own explicit act. "Delete all data" is biometric-confirmed and wipes account content, including voiceprints. Auto-delete can retire transcripts after 90 days if you prefer a shorter memory. Notes and transcripts export to plain files anytime, because data you can't take with you isn't really yours.

The promises, verbatim

"Audio never leaves your device."
"Savory only sends summary emails to your own address. Never to participants."
"Savory listens to your microphone to transcribe meetings on your device. Audio is never saved."

These strings ship inside the app, in Settings and in the OS permission prompts, so the product is accountable to the same words this website uses. If you ever catch the app and this page disagreeing, tell us; the strictest version wins.