Audio is never written to disk

The strongest privacy statement Savory makes is structural: the code path that would save audio does not exist. Microphone and system-audio samples are read in memory, handed to the on-device transcription engine, and dropped. An automated audit runs on every change to the app and fails the build if any audio write path appears.

This is a stronger claim than "we don't upload your audio." There is no file to upload, subpoena, leak, or sync. When the meeting ends, the audio is already gone; only the text you saw being written remains.

Transcription happens on your device

Savory transcribes with Whisper models that live on your Mac. Nothing is streamed to a server, which is why transcription works in airplane mode and why "works offline" is a privacy feature, not a convenience. Speaker separation also runs locally, with models shipped inside the app.

Summaries: the one deliberate network step

When you ask for a summary, and only then, the text transcript is sent to a leading AI model, OpenAI or Gemini, and the structured summary comes back to your local library. Before sending, Savory redacts email addresses, phone numbers, card numbers, and internal IDs from the transcript.

To be precise about the boundary: the scrubbing targets identifiers, not meaning. Spoken names and the content of your discussion are what a summary is made from, so they are sent, under your explicit, per-meeting consent. Summaries are off by default; a transcript-only meeting stays transcript-only forever unless you ask.

Voice recognition stays home

If you turn on "Remember voices," Savory stores a voiceprint on this Mac only. It is never uploaded, never synced, and hard-deleted when you delete your data. The feature is off by default, and automatic recognition never overrides a decision you made by hand.

Where your data lives

Everything Savory knows sits in local storage on your device: ~/Library/Application Support/Savory/ on the Mac. At-rest protection comes from FileVault on macOS and system data protection on iOS. Secrets live in the system Keychain. Crash diagnostics stay inside Apple's own MetricKit; there is no third-party analytics or crash SDK in the app, and this website sets no cookies.

Every recording starts with a consent prompt, enforced before capture begins rather than mentioned in a settings page. Per-person rules let you mark people who should never be recorded. An audit log records consent decisions without storing any meeting content.

Deleting is real

Sign-out removes nothing; deletion is its own explicit act. "Delete all data" is biometric-confirmed and wipes account content, including voiceprints. Auto-delete can retire transcripts after 90 days if you prefer a shorter memory. Notes and transcripts export to plain files anytime, because data you can't take with you isn't really yours.

The promises, verbatim

"Audio never leaves your device."
"Savory only sends summary emails to your own address. Never to participants."
"Savory listens to your microphone to transcribe meetings on your device. Audio is never saved."

These strings ship inside the app, in Settings and in the OS permission prompts, so the product is accountable to the same words this website uses. If you ever catch the app and this page disagreeing, tell us; the strictest version wins.