Privacy

Sotto is a dictation app that runs on your own computer. This page says exactly what leaves it, which is very little.

What stays on your machine

• Your voice. Speech recognition runs on your computer. Audio is never sent anywhere. It is kept only if you turn on the audio archive, and then only on your disk.
• Your text. In Private mode, the default, AI cleanup also runs on your computer and Sotto makes no network calls at all.
• Your history, phrases, dictionary and settings. All local files. Delete them and they are gone.

Enhanced mode, if you turn it on

Enhanced mode sends the text of a dictation, never the audio, to the cloud model you choose, using your own API key. Settings shows which provider, and whether your account with them has a business associate agreement and zero retention. You can keep any app, such as your EHR, in Private mode even when Enhanced is on. It is off by default.

The licence check

After the trial, Sotto confirms your licence with Lemon Squeezy, the store that sold it, at most once a day. That request contains your licence key and an instance id for this Mac and nothing else: no audio, no text, no usage, no identifiers. If the check cannot reach the internet, Sotto keeps working for 14 days on the last good answer.

Privacy Mode

Holding the Privacy Mode key replaces common identifiers with plain words before a paste, on your computer. Two things it can store, both on your Mac and nowhere else: an optional always redact list of names you add (treat it like a patient list; clear it from Settings), and an optional higher-accuracy model you download yourself. Nothing about what was redacted is kept: the mapping from a stand-in back to a name exists only for the moment of one dictation and is never written down.

What Sotto never does

• No account. No sign-in.
• No telemetry, analytics or crash reporting.
• No screenshots of your screen, ever.
• No sale or sharing of anything, because there is nothing collected to sell.

Purchases

Payment is handled by Lemon Squeezy as merchant of record. They see what a card processor sees. Sotto never sees your payment details.

Updates

Sotto checks for signed updates over HTTPS. That request carries the version you have and nothing about you.

Last changed September 2026.