Privacy and encryption

What stays on your device

Microphone audio is held in memory for the dictation in progress and dropped when it ends. Drafts and corrections are kept the same way.

When you turn on context for polishing, Arion reads a bounded excerpt around the cursor in the focused field and visible text in the focused window through Accessibility. Nothing is stored, and password and unknown fields are skipped.

Usage statistics are daily totals of sessions, speaking time and words. They hold no text, app names or times of day.

What uses the network

Model downloads: public files, each checked against a pinned SHA-256 digest before use.

Update checks: the release manifest from the Arion update center, carrying no content or device identifier. Updates verify a trusted signature before installing, and automatic checks can be turned off.

Optional sign-in and cloud polishing: the account service is contacted only when you sign in or manage your account; if you connect a cloud polishing provider, only the recognized text and enabled context are sent, never audio. Arion has no cloud speech recognition and no telemetry.

Encryption on the device

Approved and learned vocabulary is sealed with AES-256-GCM. The key is generated on the device and kept in the login Keychain (this device only) on macOS, or with DPAPI on Windows.

A missing key or a failed integrity check is an error. Arion never falls back to plaintext.

Sync

Sync is in development and not yet available. Its design is fixed in the specification: each record is encrypted on the device before upload, and only devices that hold the group key can read it.

A new device joins through one of your existing devices or your recovery key. Removing a device rotates the key for future writes.

The relay, hosted or self-hosted, can see timing, IP addresses, device and group routing identifiers and ciphertext sizes. Encryption does not hide that metadata, and it cannot protect a device that is already compromised.

Your AstraFoundry account

An account is optional. Dictation, vocabulary and learning work without one.

Signing in tells the hosted relay who you are and whether you have access to hosted sync. The account holds no keys and cannot decrypt anything you sync, and neither can AstraFoundry. The hosted relay does know which account each sync space belongs to.

Signing out keeps your local keys and vocabulary. Turning sync off and deleting data from the server are separate actions.

What cannot be undone

If you lose every device and your recovery key, synced data is gone. Account recovery restores sign-in, not data.

Text already downloaded to a device cannot be erased from it remotely, even after that device is removed.