Privacy & data handling

Scribe0 is built for clinical work, so this page is precise about what leaves your device. The short version: on the native apps, consult audio never leaves your device. The nuances are below.

Audio

Platform	Where audio is processed
Windows	On your PC, never uploaded
macOS	On your Mac, never uploaded
iOS	On your iPhone, never uploaded
Android	On your phone, never uploaded
Web	Your choice: on-device in the browser (beta, capable desktops; audio never uploaded), or streamed to a US cloud service

Transcript text and note drafting (Enhance)

Transcription itself produces text locally on the native apps, and in the browser on the web app when you pick its on-device engine. The optional Enhance step (turning a raw transcript into a structured note) uses a large language model, and this is where platforms differ:

• macOS and iOS can draft notes fully on-device using Apple’s on-device model (macOS 26 / iOS 26 with Apple Intelligence), meaning nothing (not even text) leaves the device. Both also offer cloud options.
• Windows can draft notes fully on-device too, using a local Qwen3 model that runs on your graphics card. Nothing (not even text) leaves the PC. This needs a Vulkan-capable GPU: Scribe0 tests your card before switching the option on, and tells you if it cannot run it. It also downloads about 2.4 GB the first time you enable it. If you use the cloud route instead (the default, and the only option on a PC whose graphics card cannot run the local model), Windows sends the transcript text (never audio) to an Australian-sovereign Amazon Bedrock endpoint: inference runs in AWS Sydney/Melbourne and does not leave Australia. An OpenRouter route is available as an alternative.
• Android has no on-device model, so drafting always sends the transcript text (not audio) to the same Australian-sovereign Bedrock endpoint. The app asks for your consent once, before the first cloud call.
• Web drafts notes via cloud models.

Know your obligations

If you use a cloud enhance route, the transcript text (which may contain patient details) is processed by that cloud provider. Choose the route that matches your local privacy obligations. On macOS, an on-device PII redaction pass can mask identifying details before any cloud call; this is currently a macOS-only capability. See also encrypted history & app lock for how saved sessions are protected at rest.

Storage

All apps store transcripts and notes locally on the device (the web app stores them in your account). Nothing is synced between native apps. There is no analytics or telemetry service. Diagnostic metrics stay in local logs on your device.

On Windows, macOS, and Android, that local database is additionally encrypted at rest: the key lives in Windows Credential Manager, the macOS keychain, or the Android Keystore respectively. On Android you can also require fingerprint, face, or PIN to open the app.

Accounts

The native apps require no account and no sign-in. Only the web app uses accounts (for sync and access from any browser).