What stays on your Mac, and the only ways anything leaves
Recording, transcription, speaker separation and the summary all run on your Mac. Out of the box, no part of a meeting is sent anywhere, and there is no account to sign into and nothing to sync.
Audio never leaves. Not to us, not to a model provider, not to an assistant. The only way a recording leaves your Mac is Export Audio, which writes a copy into your own export folder.
The five connections that exist
Section titled “The five connections that exist”Model downloads
Section titled “Model downloads”The first time a feature needs a model, Recordstead fetches it from Hugging Face and its content delivery network. The request is anonymous: no token, no account, no identifier. It carries no meeting content, and the download is checked against a pinned checksum before it is used.
Trial licensing
Section titled “Trial licensing”An invited build checks its trial with a Recordstead service. It sends an anonymous per-installation key and signature, an identifier that stops one request being counted twice, and your invitation code when you enter it. It sends no machine serial, no account, no email address and no device fingerprint, and it never receives meeting content.
A build compiled from source carries no endpoint and contacts nothing.
Updates
Section titled “Updates”Once a day Recordstead asks whether a newer build exists. That request carries nothing of yours; the service sees your IP address, as any website you open does.
When it then downloads a build, it sends three things and no more: the same anonymous per-installation key as above, the time of the request, and a signature proving the request came from that installation. The service answers only if it already knows the installation, which is what stops a build being downloadable by anyone who finds the address.
It sends no meeting content, no file names, no list of what is installed on your Mac and no report of how you use the app. Nothing is checked or downloaded while you are recording, and both halves can be switched off; see the release notes.
A build compiled from source has no update feed either.
A model provider you point at yourself
Section titled “A model provider you point at yourself”You can send summaries or Ask answers to an OpenAI-compatible endpoint instead of the built-in model. Then transcript text goes to the address you typed, under your own agreement with whoever runs it. Audio still does not.
This is off until you confirm it, and each role is confirmed separately for one exact destination, so agreeing to a remote summary provider does not also agree to send your archive for indexing. A remote address must be HTTPS.
An AI assistant you connect
Section titled “An AI assistant you connect”If you connect an assistant, it can read meeting metadata, summaries, bounded stretches of transcript and your Dictionary terms. Recordings and audio paths stay out of reach.
The agreement you confirm says the part that matters plainly: I understand that what an assistant reads may leave this Mac. Recordstead cannot follow that text to the assistant's own service, and cannot take it back.
What never happens
Section titled “What never happens”No analytics. No telemetry. No crash reporting. No account. No sync. Nothing is uploaded in the background, and there is no path by which we could receive a recording, a transcript or a saved voice.
What sits on the disk, and in what state
Section titled “What sits on the disk, and in what state”The archive is encrypted. Your meetings, transcripts and summaries live in an encrypted database, and each stored recording is an encrypted, tamper-evident file rather than a playable one. The key is held in your Mac's keychain and is tied to your macOS account, so copying the folder to another Mac is not enough to read it: that copy asks for a transfer code, which you get from the Mac the meetings came from.
Two things are deliberately not encrypted, and both are worth knowing:
- A recording in progress. While a meeting is being recorded, audio is written to a staging area in the clear and is encrypted when the finished recording is filed. There is no way to encrypt a stream that is still being written and still be able to recover it if the Mac loses power.
- The operational log: the queue, the timings and the record of what the app did. It holds no meeting content: meetings appear there under an opaque handle, never by title. It stays readable on purpose, because it is what lets Recordstead tell you why it cannot open your meetings when something is wrong with the key.
Result
Section titled “Result”You can say, connection by connection, what Recordstead sends and what it never sends.