Typeless Said “On-Device.” Researchers Found AWS us-east-2.

The marketing copy says one thing. The privacy policy says another. The reverse-engineering analysis from November 2025 says a third. Here’s the part of cloud dictation nobody puts on a landing page.

TL;DR — In November 2025, an independent researcher on X reverse-engineered the Typeless macOS app and reported that voice data is routed to AWS servers in us-east-2 (Ohio), with additional collection of browsing URLs and active window titles. Typeless markets “on-device history” and “zero data retention.” The company’s own privacy policy quietly confirms that voice processing happens on cloud servers — the “on-device” claim refers to history storage, not transcription. Whether or not Typeless intends harm, the architectural reality is this: their voice never leaves your Mac is not what they’re offering. What they’re offering is a policy that says they delete it quickly. Those are not the same product.

The gap that started the controversy

There’s a specific phrase to watch for in privacy marketing: “on-device.” It sounds like the audio never leaves your computer. That’s not always what it means.

Typeless markets three things prominently: zero data retention, on-device history, and “never train on your data.” Each of those can be true at the same time as audio being processed in the cloud. The actual sentence to read isn’t on the marketing page. It’s in the privacy policy. Theirs says audio inputs “are processed in real time on our cloud servers and immediately discarded once the transcription result is returned to your local device.”

That’s cloud processing. The “on-device” claim describes where history is stored after transcription. The transcription itself happens on a server.

That’s the gap. It’s the kind of thing that’s technically not lying — the marketing copy is true if you parse it narrowly — but reads like a stronger privacy claim than it actually is.

What the reverse-engineering analysis reported

In November 2025, a researcher posting as @medmuspg on X published a teardown of the Typeless macOS app. The thread went viral in the Japanese Mac and medical-technology communities and triggered a wave of uninstall recommendations from accounts that had previously endorsed the product.

I’m reporting these as the researcher’s claims; I haven’t independently verified them. The analysis made six specific allegations:

Audio is routed to AWS servers in the us-east-2 region (Ohio). The “on-device” claim, per the analysis, refers strictly to local history storage — not to where audio is transcribed.

The app captures browsing URLs (including pages inside Gmail and Google Docs), focused application names, and window titles via the macOS accessibility API.

Screen text and DOM-level elements in browsers were reportedly accessible to the app through standard accessibility permissions.

Clipboard contents were reportedly accessible — unusual for a speech-to-text workflow that shouldn’t need them.

Transcribed text and URL metadata were reportedly stored in plaintext in the local application database.

The app reportedly requests screen recording, camera, Bluetooth, and full accessibility access — a permission surface significantly wider than a voice tool strictly requires.

The researcher didn’t claim any single item constitutes a breach or a legal violation. The argument was about the combination: a privacy profile that doesn’t match the marketing.

Why “zero data retention” isn’t the protection it sounds like

Zero retention is a useful policy. It’s also a policy, not an architecture. The difference matters because policies have failure modes that architectures don’t.

Audio passing through TLS-encrypted transit is still passing through your ISP, the cloud provider’s network, and the data center’s internal switches. Any layer can be misconfigured, logged, or compromised.

Subprocessors complicate the math further. Typeless’s privacy policy lists “third-party LLM providers, analytics providers, cloud providers.” Each of those is a separate party with its own retention policy and incident history. “We delete it” doesn’t bind them.

Policies can change. A retention policy can be revised with 30 days’ notice; the same servers running “zero retention” today can run “we keep logs for product improvement” tomorrow. Acquisitions reset the policy entirely — when Microsoft bought Nuance in 2022, Dragon customers’ data ended up under Microsoft’s terms.

Subpoenas and national security letters can compel a vendor to preserve data normally discarded. The vendor has nothing to push back with if the data is sitting in their AWS bucket when the order arrives.

And implementation bugs — debug logs left on, caching layers that forget to flush, routing errors — produce data retention that doesn’t match the policy even when the vendor is acting in good faith.

All of these failure modes share something in common: they require the audio to leave your device in the first place. Architecturally, they’re not problems on a tool that processes everything locally.

“Zero data retention” protects you from one specific failure mode. “Zero data transmission” protects you from all of them.

The permission problem that applies to every dictation app

The Typeless analysis surfaced a concern that’s bigger than one vendor: the macOS accessibility API is powerful, and most users don’t know how powerful.

When you grant a dictation app accessibility permission, you’re authorizing it to read window titles, focused text fields, menu contents, and — in browsers — page DOM elements. That’s necessary for any dictation app, because pasting transcribed text into the active field requires knowing where the active field is.

The same API can be used to read continuously, log what it sees, and transmit that data to a server. From a user’s perspective, there’s no visual indicator distinguishing “reading the accessibility tree only when pasting text” from “reading it constantly and shipping it elsewhere.”

Which means the permission surface of a dictation app matters. A well-behaved tool needs microphone and accessibility, and nothing else. If it asks for screen recording, camera, Bluetooth, or full-disk access, that vendor should be able to explain why in one sentence.

Microphone access — required to capture audio. Accessibility permission — required to paste text. Input monitoring — needed for global hotkeys; scope matters. Screen recording, camera, Bluetooth, full-disk access — none of these are required for voice-to-text, and the vendor’s justification for requesting them should determine whether you grant it.

The eight checks I run before installing a dictation app

After reading the Typeless analysis I built a checklist for evaluating any dictation app on Mac. It’s not foolproof, but four or more red flags means you should treat the tool as cloud-routing your voice regardless of what the landing page says.

1. Does the privacy policy explicitly confirm on-device processing? Read the actual policy. Look for “cloud servers,” “real-time processing on our infrastructure,” “third-party LLM providers.” Any of those means audio leaves your device.
2. Does the app work fully offline? Disconnect Wi-Fi and try to dictate. If it fails, the tool is cloud-based regardless of marketing.
3. Can you use it without an account? If you have to log in to dictate, the vendor has tied your voice to an identity on their server — even with a zero-retention policy.
4. Is the permission scope minimal? Microphone plus accessibility is enough. Anything more is a question mark.
5. Does the vendor publish a subprocessor list? If the list is missing, vague, or hidden behind a login, the data trail is opaque.
6. Is there a named legal entity in the Terms of Service? Privacy-first vendors identify themselves. Generic “contact us” forms and private WHOIS are transparency concerns.
7. What does Little Snitch show during a dictation session? A network monitor doesn’t lie. Zero outbound traffic = on-device. Connections to AWS/GCP/Azure = cloud.
8. How broad is the content license in the Terms of Service? Watch for language like “access, copy, modify, distribute, transmit, store, and otherwise use” your content. Even with zero-retention marketing, a broad ToS license allows future use changes.

Apply all eight. If four-plus come back wrong, you have your answer about what the tool is actually doing.

What’s happened since

Typeless responded to the privacy criticism in March 2026 by announcing HIPAA compliance on X. That addresses one slice of the criticism — healthcare professionals concerned about PHI — but doesn’t directly rebut the reverse-engineering claims about AWS routing, URL capture, or permission scope.

An independent assessment by Paubox, a HIPAA-focused compliance vendor, flagged a meaningful gap: Typeless doesn’t publicly advertise a standalone Business Associate Agreement. For covered entities, a signed BAA isn’t optional — it’s a prerequisite before any PHI can be processed by a third-party service. Paubox’s recommendation was that healthcare organizations contact Typeless directly to confirm BAA availability.

A HIPAA compliance announcement without a publicly signable BAA is a marketing milestone, not a compliance milestone. That isn’t unique to Typeless — it’s a pattern in the broader cloud-AI space — but it’s the relevant detail if you’re considering Typeless for regulated work.

The architectural alternative

If the gap between Typeless’s marketing and policy bothers you, the solution isn’t a different cloud dictation app. It’s a tool that doesn’t route audio anywhere because there’s nothing to route.

Three on-device options exist on Mac. Voibe runs Whisper locally on Apple Silicon, requires only microphone and accessibility permissions, and doesn’t require an account to dictate. It’s $149 lifetime. VoiceInk is open-source under GPL v3 — the codebase is auditable, $25–$49 once. Superwhisper is on-device on Apple Silicon with optional cloud modes for those who want them, $249.99 lifetime.

All three process audio on the Neural Engine, transmit nothing during dictation, and have no subprocessors for voice data because none is sent off-device. Run Little Snitch during a session and outbound traffic is zero.

The trade-off: less aggressive AI cleanup compared to cloud tools like Typeless. You get a clean Whisper transcript and you finish the polish yourself. For most people, the trade is worth it. For some specific workflows — multilingual code-switching, AI text expansion, automatic filler-word removal — the cloud tools still have features the local ones don’t.

What the Typeless story actually teaches

This isn’t a vendor-specific scandal so much as a worked example of a structural limit. Cloud dictation apps can’t offer the same privacy guarantees as on-device dictation, no matter how carefully their policies are worded.

The marketing-to-policy gap that started the Typeless controversy will repeat. The vendor names will change, the regions will change, the specific subprocessors will change. The underlying fact won’t: if your audio leaves your machine, you’re trusting policies all the way down — the vendor’s, their subprocessors’, the cloud provider’s, and the future versions of all three.

If that trust feels reasonable for what you dictate, cloud tools are fine. If it doesn’t, the architectural answer is the only one that holds.

The privacy policy you can trust most is the one the server can’t break. That means no server.

The one-line version

Typeless’s “on-device” marketing describes where history is stored, not where audio is transcribed. The transcription happens in AWS us-east-2. Researchers reported broader data collection than the marketing implies. If that gap matters to you, switch to an on-device tool — Voibe, VoiceInk, or Superwhisper’s offline mode are the three real options on Mac, and all three eliminate the question of what your vendor’s privacy policy actually means in practice.

This piece is a personal-essay rewrite of the original investigation on the Voibe blog, which goes deeper on the reverse-engineering claims, the community response, the macOS permission model, and a full eight-point privacy audit framework. The long version is here: Typeless Privacy Issues: What Researchers Found (2026).