The short version
- Saybox (for Mac) turns speech into text on the Mac itself. The speech model is inside the app.
- Saybox Mic (for iPhone, optional) sends microphone audio only to the one Mac it’s paired with, over your local network, encrypted.
- There are no company servers, accounts, analytics, ads or crash uploads. We never receive your audio, your text or anything about your patients, and we never use them to train anything.
- Today’s builds make no internet connections. From the subscription release, Saybox will check its license key with our payment service when it starts and once a day, sending only the key and a random device ID. See The subscription check.
What the apps handle
Everything below stays on your devices. Paths are on the Mac, in your user’s Library folder.
| What | Where and how long |
|---|---|
| Audio from the Mac’s microphone | Memory only, until it’s turned into text. Never saved. |
| Audio from the iPhone | The iPhone’s memory, then the Mac’s. Audio the Mac hasn’t confirmed is discarded once delivered, 200 seconds after you stop, or when you unpair. |
| Dictated text | Typed into the app you’re using, or put in the Saybox Text Box or on the clipboard. Inside Saybox it’s held in memory only. The app that receives it keeps it under its own rules. |
| Saybox Text Box | Memory only. Erased 60 seconds after you close it, and when Saybox quits. |
| Transcript history | Off unless you turn it on. Then up to 20 entries in memory, until Saybox quits. |
| Personal dictionary and prepared phrases | Application Support/ScriptaPlus/, encrypted with a key in your login Keychain. Kept until you delete them. |
| Security event log | Logs/ScriptaPlus/Security Events/. When and where dictation went, pairings and refused connections, never what was said. At most 90 days. |
| Timing and count records | Logs/ScriptaPlus/. Numbers only, no text. At most 30 days. |
| Settings | The app’s preferences file, until you remove it. |
| iPhone pairing key | The Keychain on the Mac and on the iPhone, until you unpair. |
What the apps never do
- Send audio, text or anything about your patients over the internet. Today’s builds make no internet connections at all; with no iPhone paired, Saybox opens no network port. The only internet connection planned is the subscription check below.
- Ask you to create an account or sign in.
- Collect analytics, usage statistics or advertising identifiers.
- Upload logs, crash reports, audio or text. There’s no “send diagnostics” button.
- Write dictated words to log files. An automated test checks every log line in the code.
Permissions
- Microphone (Mac and iPhone): to hear you while you dictate, and only then.
- Accessibility (Mac): to type at your cursor. Saybox also reads the selected field’s text, in memory only, to check its own typing, to take text back when you say “delete that”, and to correct drug names. Without this permission, dictation goes to the clipboard for you to paste.
- Local Network (iPhone, and the Mac if it asks): so the paired devices can find and reach each other.
- Camera (iPhone): once, to scan the pairing code. If you decline, you can copy the code on the Mac and paste it on the iPhone instead.
The iPhone link
Saybox Mic talks only to the Mac it’s paired with, over your local network. Pairing uses a one-time code that expires after 5 minutes, and both screens show a six-digit confirmation code; the Mac accepts no dictation until you confirm they match. The connection is encrypted with a key made at pairing. Unpairing on the Mac cuts the iPhone off at once, and the iPhone forgets its key and any unsent audio.
The subscription check
Today’s builds of Saybox make no internet connections. The check below is decided but not yet built. From the release that starts subscriptions, the Mac app will check its license key with Lemon Squeezy, our payment service.
- When: when Saybox starts, and once a day.
- What it sends: only the license key and a random device ID. Never audio, text, dictionary words, names or anything about patients.
- What any internet request reveals: like any connection to the internet, the check also shows Lemon Squeezy, and the networks it passes through, your Mac’s IP address and the time of the check.
- Offline: Saybox works offline for 14 days, then asks you to reconnect. The check never interrupts a dictation.
- Payments: Lemon Squeezy handles payments. It holds your name, your email address and your card payments, and never receives patient information. We use the name and email address it holds to email current subscribers about Critical or High security problems (see Security notices).
Saybox’s Privacy settings will describe the check too.
If you write to us
Support is by email only. We don’t offer phone support, screen sharing or remote control, and we will never ask to see your screen or connect to your Mac.
When you write, we receive your email address, your message and anything you attach. We use them only to answer you, and we keep them for up to 2 years after our last message, then delete them.
Please never send patient information: no names, dates of birth, chart screenshots, recordings or transcripts. Describe problems with made-up details, such as “Patient: Jane Example”. If a message reaches us with patient information anyway, we delete it and tell you within 2 business days.
We don’t sell or share the personal information you send us.
This website
This website sets no cookies, runs no analytics and loads nothing from other sites: no fonts, scripts or trackers. It is hosted by Cloudflare, which handles your IP address, the pages you request, the time and your browser type to deliver the site and protect it from attacks, under Cloudflare’s privacy policy. We don’t keep our own records of individual visitors.
Your practice and HIPAA
Saybox is designed so that we never receive patient information. The text you dictate goes into the apps you choose, such as your EHR, which keep it under their own rules. Your practice remains responsible for its own obligations under HIPAA, including its risk analysis, its devices and the apps that receive dictated text.
Check with your clinic’s privacy or security officer before using Saybox with patient information. If your practice needs a Business Associate Agreement, write to privacy@saybox.app.
Saybox is not intended for children.
Changes and contact
If we change this notice, we’ll post the new version here with a new effective date. Questions about privacy: privacy@saybox.app.