Does dictation audio leave your device? Fireflies, Phonon-2, Sume

It depends on the product. Fireflies Talk, launched on October 1, stores completed dictations locally but sends the audio to its speech-to-text provider, according to Fossbytes. Phonon-2 is a 164 MB model that runs on Apple hardware, so audio need not leave the device. Sume STT is a hosted job, so audio is fetched from a URL you supply.

So the useful question is not private or not private. It is: who receives the raw audio, and who keeps the text. Write that down for each tool before you pick one.

Three designs, three answers

The table lists what each source states. Where a source is silent I say so rather than guess.

• Fireflies lists SOC 2 Type II, GDPR and HIPAA compliance, per Fossbytes.
• Phonon-2 is English only and non-streaming.
• Sume STT takes up to 10 minutes of audio and returns word timings.

How to run a privacy check in four steps

• List every hop the audio takes, from microphone to final text.
• Ask each vendor for its retention terms in writing; this post does not state them.
• Decide whether the audio may sit at a public HTTPS address, which Sume STT requires.
• Delete the source file from storage after the job result is saved.
• Write the answers into a one-page note that your team can review each quarter.

Questions to put to every vendor

Ask where the audio is processed, how long it is kept, who can read it, and whether it is used to train a model. Ask for the answers in writing, with the page or contract that states them. For on-device models, ask what the app sends back, if anything, such as crash logs or usage events.

Then compare the answers with what your own users were told. A mismatch between a privacy notice and the real data path is the usual cause of incidents, not the model itself. If a recording holds sensitive material, keep a record of the decision and the date, so you can show why a given tool was chosen.

What Sume does not do

Sume STT needs a public HTTPS audio_url, and the docs prefer a Sume media URL. It has no device-side mode and no live microphone input. This post does not describe Sume retention rules, because the pages I read do not state them. Ask for them before you send sensitive audio.

Pick by risk

For private dictation of short English notes, on-device is simplest. For recorded interviews in many languages, a hosted job is practical. See the cost of transcribing 1,000 hours for the hosted side of the bill, and Fireflies Talk versus an API transcript of a recorded file for use cases.