Saylith · internal

Users

not connected

What the app sends, and what it must never send

An install id — random, generated on the Mac, never derived from hardware or an email.
App version and macOS version.
Current plan, and whether microphone and accessibility were both granted.
Dictation count, total seconds of audio, and the local/cloud split. Running totals, so a lost report costs nothing and a repeated one changes nothing.
Only when switched on in onboarding or Settings. Never having been asked is not consent, so the stored answer starts as neither yes nor no.

Transcribed text, in whole or in part — including a length in characters, which leaks more than it looks like it does.
Audio, or any derivative of it.
Which apps were dictated into.
API keys, or anything identifying whose key was used — and so never their API spend, which stays between them and their provider.
The Mac model. It is a fingerprint, and knowing it has never fixed a bug.

POST /v1/events refuses any body carrying a field it does not recognise. A pipeline that quietly drops extras is one that starts storing transcripts the day someone adds one to the client by mistake.

Anything anyone said to an agent. The relay routes sealed envelopes between paired devices and holds the ones it could not deliver in memory for a few minutes. It has never had a key, so there is nothing here to decrypt and nothing to leak.