Voca (usevoca.net) is cloud voice dictation for Windows, macOS and Linux, built so the audio you speak never lives long enough to be a liability. This page explains the architecture, the controls, and the third parties involved, in enough detail that a security team can sign off, and in plain enough English that you don't need one to understand it.
When you press the hotkey and start dictating, your audio takes a short, one-way trip. It is captured on your device, streamed over TLS to our API, forwarded to the transcription provider, and discarded the moment the transcript text returns. Nothing is written to disk on our side. Nothing is queued. Nothing is backed up.
The single sentence version: your audio is in our possession for the seconds it takes to transcribe it, in memory, and then it is gone.
All traffic between the client, our API, and Groq is encrypted with modern TLS. HSTS is enforced on every public hostname.
Passwords are hashed with bcrypt. WebAuthn passkeys, TOTP, and encrypted recovery codes are first-class. Sessions expire after 120 minutes idle.
2FA secrets, recovery codes, and API keys are encrypted at rest with Laravel's app key. Bearer tokens for the desktop app live in the OS credential store.
Application and database run on Hetzner VPS infrastructure in EU data centres. Backups are encrypted and stay in-region.
Card data never touches our servers. We see your last four and a Stripe customer ID. That's it. Stripe handles PCI-DSS.
Google Analytics 4 for aggregate usage stats. No advertising cookies, no session replay, no fingerprinting SDKs. See the privacy policy for what's collected.
The dictionary fixes the words speech models get wrong: package names, file paths, internal service names. Terms you add on the Dictionary page are stored on your account so every device gets them, and they are deleted when your account is.
The desktop app can also read terms from the code project you are working in. This scan runs on your machine only. Here is exactly what it does.
The project name and dependency names from package.json, go.mod, Cargo.toml, composer.json and pyproject.toml; directory and file names two levels deep; and a .voca-terms file if you keep one. By default it never opens your source files. The optional deep scan, off unless you turn it on, opens the 50 files git history shows you edit most and keeps only the parts of identifiers that repeat across them. It skips string literals, comments, .env files, keys, certificates and generated files.
The term list for each project is cached in the app's local data folder and rebuilt when you change project or after 24 hours. The server never stores project terms.
Project terms travel with each recording, are used to correct that transcript, and are discarded when the response is sent. Nothing else from the project leaves your machine.
The app tells you the first time it uses a project's terms and shows the full list, with where each term came from, in Settings → Dictionary. You can turn the project scan or the deep scan off there at any time.
We use a deliberately small number of vendors. Each one is listed below with the data they receive and the role they play.
Receives the audio stream and a filename, returns the transcript text. Zero Data Retention is enabled on our account, which means Groq does not retain audio after processing and does not use it for model training. Hosted in Google Cloud Platform, United States. Cross-border transfers from the EEA rely on Standard Contractual Clauses.
Receives your name, email, and Voca user ID when a billing record is created. Stripe holds your card details under their own PCI-DSS certification. We never see a full card number.
Provides the VPS infrastructure that runs the API and database. EU data centres only. Hetzner does not have access to application data. Disks are encrypted and access is keyed to operations staff.
Receives your email address and the body of transactional messages (password resets, billing receipts, invitations) for delivery. We send through AWS Simple Email Service in an EU region. No marketing campaigns run through this channel.
If you believe you've found a security issue, please email [email protected] with the words "security" in the subject. We respond to confirmed reports within two business days. We do not yet run a paid bug bounty programme, but we are happy to credit reporters and we treat reports in good faith.
Please do not test against accounts that aren't yours, do not exfiltrate user data, and give us a reasonable window to fix issues before disclosing publicly. We will do the same in the other direction.
Voca is operated from the Czech Republic and processes personal data under the GDPR. Our data processing arrangements with subprocessors include the EU Standard Contractual Clauses where required. We are not currently SOC 2 or ISO 27001 certified. If you need a formal questionnaire completed for a procurement review, email [email protected] and we will work through it with you.
No. Voca at usevoca.net is a separate product with no connection to VocaHQ or Vocalinux (vocahq.com, vocalinux.com). Descriptions of "Voca" as a free, offline, open-source app usually refer to those projects, not this one.
No. usevoca.dev is a different product. Voca is the dictation app at usevoca.net.
Yes. If you can type in it, you can dictate into it: Gmail, Slack, Notion, ChatGPT, Cursor, your terminal, a browser form. The desktop app types the text where your cursor is and copies it to your clipboard, so you can always paste it with Ctrl+V or ⌘V. There is nothing to install per app.
Press the hotkey once to start recording, speak, and press it again to stop. There is nothing to hold down. You can change the hotkey in the desktop app's settings.
Yes, on Android: get Voca on Google Play. Record in the app and the text is copied to your clipboard, ready to paste into any other app. There is no iPhone app yet.
Three things. Voca uses the same hotkey on Windows, macOS and Linux, and Linux has no built-in dictation at all. It tidies what you said before it lands: filler words and false starts come out, punctuation goes in, and spoken lists become real lists. And it learns your words, so names, package names and file paths come out spelled the way you spell them.
Yes. A cleanup pass removes filler words, repeated words and false starts, fixes punctuation and capitals, and drops anything after you say "scratch that". It is on by default on every plan, including free, and you can turn it off in Settings → Features. It never translates, and if the cleanup fails for any reason you get the plain transcript instead.
Yes, over 90 of them. Voca detects the language you are speaking, so there is no setting to change. If you mix languages in one sentence, the text keeps them as you said them. Accuracy is best in widely spoken languages and varies for less common ones, so try the browser demo in your language first.
Yes. The speech model is trained on a very wide range of speakers and handles most accents well. If it keeps getting a particular name or term wrong, add it to your dictionary and it will be spelled correctly from then on.
Talking fast is fine. Voca does not filter background noise itself, so in a loud room or if you speak quietly, sit closer to the microphone or use a headset. You can choose which microphone Voca listens to in the desktop app under Settings → Microphone.
No. A laptop's built-in microphone works. A headset or a desk microphone helps in noisy rooms, and you can switch between them in Settings → Microphone.
Yes. Add words to your dictionary on the Dictionary page and Voca spells them your way, on every device. You can also save a longer block of text, such as an email sign-off or a review checklist, and insert it by saying a short phrase.
Your audio is deleted as soon as the text comes back. It is never stored, backed up or used to train a model, by us or by our transcription provider. Transcripts are kept only if you turn history on. We keep the duration, time and model of each recording for billing. We are not SOC 2, ISO 27001 or HIPAA certified, and the rest of this page explains exactly what happens instead.
Voca has a free tier of 5 hours a month, with no card needed. After that you pay $0.10 per hour of audio, or $6 a month for unlimited use on Pro. If you run out of free hours, recording stops until next month; nothing is charged without a purchase. Transcription runs in the cloud, so Voca needs an internet connection.
Sign in, open Billing and choose Start Pro. You pay through Stripe. Pro is billed on the 1st of each month, and your first month is charged only for the days left in it. See pricing for what each plan includes.
Yes. Open Billing and choose Manage subscription to cancel. Pro keeps working until the end of the month you paid for. Pay-as-you-go credits never expire, so there is nothing to cancel there.
Yes. Heavy users get Pro seats at $6 a month each. Light users draw from a shared credit pool at $0.10 an hour, with a monthly cap you set per person. Everything comes on one invoice on the 1st of the month. See Voca for teams.
No. Voca only records between one press of the hotkey and the next, and it only transcribes what you say. It does not join calls, record other people or run in the background.
Security reports: [email protected]
Privacy enquiries: [email protected]
Legal entity: Shay Stephan Lee Punter, Korunní 2569/108, 101 00 Praha - Vinohrady, Czech Republic