Where your voice recording goes

For an app that listens, this is the first question that matters: where does what I say go? Most answers to it are one line long and reassuringly worded. When this text first appeared, it carried the long version — four stops, two countries, one uncomfortable exception.

The short answer

Nowhere. You speak, your phone turns it into text, the recording is discarded. There is no code path left in the app on which a voice recording could leave the device — not to us, not to a third party.

Recognition is done by the speech recognition built into your phone’s operating system. It is the same one that works when you tap the microphone on the keyboard: on iPhones Apple’s Speech framework, on Android devices the recogniser the system ships with. Both can do it without a network, and that is exactly what the app insists on.

What happens now when you speak

1. The recording is created in your phone’s memory.
2. The operating system listens along and returns text while you are still talking.
3. The text is broken up. “Two magnesium capsules and a coffee” becomes two cards with a time stamp — the app works that out itself, on the device.
4. The recording is gone. What remains is the entry you confirm, and that sits in the database on the phone.

Your vocabulary — the preparation names you use — goes into recognition as a hint, so that “Elalanin” becomes “L-Alanine”. It, too, stays on the device. That is the item that matters most here: knowing which preparations someone names tells you something about their health. It was exactly this list that used to go down the wire with every recording.

The route that existed until 11 September

It had four stops, and it was built so that it could be written down:

1. On your phone an audio file was created.
2. Frankfurt am Main. It went to an endpoint of our own in a German data centre, which checked that a signed-in user was calling it.
3. Paris. That is where the recognition service ran — Scaleway, a French company, with the open model Whisper.
4. Back. The text returned the same way.

That took a good second, was covered by contract and lay entirely within the EU. Measured against what is customary, it was a good solution. It has gone anyway.

Why we tore it down

What travelled along this route is health data under Article 9 GDPR — the category with the highest protection the regulation knows. Anyone who hands such data to a service provider should have an undertaking from that provider that its service is intended for it at all.

We asked. In writing.

The answer was no. The provider does hold a certification of its own for hosting health data under French law. It covers servers, storage and network — not the recognition service we were using. A second provider we checked answered the same way, for the same reason.

That left two ways. Look for a third provider and hope the answer is different there. Or do away with the transfer.

We did away with the transfer. What is not transmitted needs no clearance, no contract, no location and no exception for error cases.

What disappears along with it

• The processor. For voice recordings there is none any more — not in France, not anywhere else.
• The consent. It was needed because there was a transfer. Without a transfer it has no subject. The switch “Allow speech recognition” has disappeared from the settings.
• The two weeks. On technical errors the old service was allowed to keep the affected request for up to two weeks — roughly one in a million. That paragraph was in this article and in the privacy policy, because otherwise “is not stored” would not quite have been true. Now it is true.
• The minute allowance. It counted seconds at a service that no longer exists. There is no recording time left that could be used up.

What it costs

This belongs in the same text as the good news, otherwise the good news is not good news.

Not every phone can do it. The app only starts recognition if the operating system confirms that it really does understand your language on the device. On iPhones that has been the case for years. On Android it takes version 13 or newer and an installed language pack. If both are missing, there is no speech recognition in RecTake — then you type.

We expressly do not build a silent fallback to a server for this. An app that transmits after all when in doubt and does not say so is worse than one that lacks a feature.

What never set off on this route

Your entries. What ends up in the diary — which preparation, what quantity, how you were doing — has always sat in a database on your phone and was never transmitted. Nothing has changed about that; the recording has merely followed them.

That has an inconvenient flip side, and honesty requires naming it: we have no copy. If the phone is lost, the entries are gone and we cannot restore them. Privacy and convenience really do pull in opposite directions here, and we have chosen.

What your account still knows

You still need an account, but only for one purpose: a subscription has to be recognised again on a new phone. It knows your email address, an account ID and your subscription status. It does not know what you enter — and, now, not what you say either.

Why we write this out at length

Because “your data is safe” means nothing. A promise only becomes checkable once it says who has to keep it, where that happens and what exception exists.

This article once had such an exception, and it was not in a footnote. That it is gone now is the actual news — and the reason we would rather rewrite the text than delete it quietly. Anyone who read the old version and gave consent should learn what became of it.

The full wording is in the privacy policy. What happens to consent given earlier is in section 8 there.