BYOK & data flow
BYOK (Bring Your Own Key): enter a provider’s API key in Settings; your Mac sends requests directly to the selected ASR / LLM service. Apple, on-device models, and loopback services without authentication may not need a key.
Local storage
Section titled “Local storage”| Data | Location |
|---|---|
| ASR / LLM API keys, license key, and trial state | macOS Keychain |
| Preferences, word replacements, manual and auto-learned command entries | UserDefaults |
| History and backup | User Application Support under com.yeahhe365.VoiceHotkey/History/ |
| Auto-learning observation counts | AutoLearnedCommandFrequencies.json in Application Support |
| Local models / runtimes / download caches | Application Support and other local model storage |
| Live recording | Memory / temporary processing; recognized text can enter history |
Local storage is not automatically erased by uninstalling. See Privacy policy for cleanup.
Recognition and LLM providers
Section titled “Recognition and LLM providers”- Cloud ASR receives recorded audio or audio data from a file you transcribe.
- Cloud LLMs can receive transcript text, command utterances, selected text, and enabled context when the corresponding polish / intent / translation feature is enabled and configured.
- On-device / loopback models process on your Mac or your chosen local service. If that service forwards requests to the cloud, its own behavior determines the destination.
There is no default transcript analytics upload. Each cloud service defines its own usage, billing, and retention policies.
New installations default to real recording, and current Settings has no Demo switch. Legacy or test Demo configurations can skip the microphone / ASR, but enabled cloud polish or translation can still receive demo text and configured context. Demo is not a network privacy switch.
VoiceHotkey commercial license service
Section titled “VoiceHotkey commercial license service”Commercial licensing has a separate first-party flow from BYOK. Activation sends the license key, device ID (normally the Mac hardware UUID, with a locally generated fallback), Mac name, platform, and app version to https://voicehotkey.pages.dev/api/activate. Status checks and deactivation send the key and device ID.
The VoiceHotkey operator provides this service through Cloudflare Pages / D1. It stores license and device bindings, activation / last-seen timestamps, and active status. This path does not send ASR / LLM API keys, audio, or transcript content. Deactivation marks a binding inactive; it does not delete the server record. The current implementation defines no automatic deletion period.
Local Only Mode does not block these license requests or explicit model downloads. See Local Only Mode and Privacy policy. Payments are temporarily paused; data from existing orders remains governed by the relevant purchase provider’s privacy policy.