Nothing leaves your device.
That is the default answer, not a promise. Below it are the exceptions, the storage, and the four things Android requires before a floating bubble can exist at all.
Audio
Deleted after successful processing. Two opt-in settings exist and both are off: keep all recordings, or keep audio for the last N failures. Anything kept is visible and deletable in Settings → Privacy.
Telemetry
None. No Firebase, no usage analytics, no crash-reporting vendor. Any future anonymous quality telemetry would be off by default and clearly disclosed.
Surrounding text
Not read. Only the metadata insertion needs — package, view id, input type — captured at the start of a dictation, held for the insertion attempt, and not persisted.
Stored locally
The final transcript, raw text when available for retry, which provider answered, timings, outcome, language, and optional feedback. Raw and refined are marked deletable together.
A cloud provider is not excluded by principle, only by default. One would
have to be switched on by you explicitly, document its own data handling,
and sit behind the router’s rules — where cloud counts as
consent-required. The offline switch excludes it outright.
Four things Android requires.
A floating bubble that dictates into other apps needs all four, and each is asked for at the moment you first need it — not in a wall of toggles at first launch. Same form as the claims on the home page: what it touches, then what it cannot do.
-
Microphone
Records while you hold the bubble. Android shows its own indicator; nothing here suppresses it.
-
Overlay
Draws the bubble and nothing else. Revoke it in system settings and the app keeps working — without a bubble.
-
Accessibility service
Writes into the focused field, and only that. Never used to read a screen or work around Android security.
-
Notifications
A foreground-service notification must be visible while recording. That is the notification.
It is not an accessibility tool.
And it is not eligible to be one. Voice-activated assistants explicitly do not qualify, and claiming otherwise risks suspension.
If a dictation app tells you it is one
That is a lie about what it is doing with the service. Play’s own guidance is that a dictation helper is not an accessibility tool, and that a wrong claim can get an app suspended.
What happens instead
Before the service is enabled, a standalone disclosure of exactly what it reads and writes, shown in normal use rather than buried in settings, and an affirmative consent you have to tap.
From docs/privacy/permissions-policy.md and docs/privacy/privacy-policy.md
Refused before recording
Password fields, card fields, and anything else on your blocked list of sensitive packages. The microphone does not open, so there is no audio to hold and nothing to leak later.
If the focused field turns sensitive while you are already talking, the transcript is destroyed entirely and never written to history.
Your settings, and retention
Settings → Privacy holds the JSON history export, clear all history and settings, the audio retention toggles, cloud-provider consent, and the list of blocked sensitive packages.
History is kept indefinitely by default, with optional auto-delete after N days that is never on by default.