Scribla is a dictation app for iPhone and Mac. On the phone it is a keyboard plus an engine app that turns speech into text; on the Mac it is a single app in the menu bar. This page explains what happens to your data. Recognition runs on the device itself, and audio is never stored anywhere and never sent anywhere. Everything below applies to both versions; where they differ, it is said so.

What stays on the device

• Audio. The recording lives in memory as a ring buffer and is overwritten by the next one. It is never written to disk, not even temporarily, and never leaves the phone — in any mode.
• Speech recognition. Runs entirely on the device, with a model inside the app. There is no network in that path at all.
• Transcript history. Text only, in the phone’s protected app container. How many entries to keep is your setting; any entry and the whole history can be deleted.
• Third-party service keys, if you enter any, live in the Keychain with the “this device only, after first unlock” class. They do not appear in backups in the clear and are never written to the diagnostics log.

What leaves the device, and when

Audio never leaves the phone, in any mode. Text does, and in the AI modes it works from the first launch: polishing, answers and search are on right away, through the built-in service. What goes out is spelled out in the intro, directly above the switch; you can decline there, or later in the settings. Everything else below waits for you to ask.

If you installed Scribla earlier and never turned these modes on, they stay off: an update does not switch them on retroactively.

• Text polishing, AI answers and fallback translation. On from the first launch. The recognised text is sent to the service you picked. With the built-in provider the path runs through our server: the text arrives at scribla.io and is passed on to ollama.com on our key. That middle step exists so the key does not sit inside the app, where anyone can dig it out. We store neither the question nor the answer: the service record keeps the length, the model name and the response code — enough to see the load, not enough to read what you wrote. If you picked OpenAI or DeepSeek on your own key, the text goes to them directly, bypassing us. What those services do with the text is governed by their own terms, not ours.
• Web search. On from the first launch as well: your question travels the same way — through scribla.io to the ollama.com search service — and the pages found are given to the model along with the question. When you have pressed the “text from the field” key, it is that text rather than the question that goes to the search: there would be nothing to search for in “reply to this”.
• Currency rates. The app requests published rates from the Bank of Russia (cbr.ru). The request contains none of your data — it fetches a public table.
• English model download. On your command, model files are downloaded from github.com. The request contains none of your data.
• The app’s own log. If the “Help with bugs” switch is on (it is off by default), the app sends us service notes about its own work: which button was pressed, where it failed, how long it took, the build version and the phone model. No audio, no transcripts, nothing you typed. Entries that could contain your text are marked inside the app and are never sent — you can see them on the log screen labelled “stays here”.

The app’s own log

Sending is off until you turn it on. The “Help with bugs” switch is on the last page of the intro and in the app’s settings; turning it off also erases whatever had piled up to be sent.

A random install marker travels with the entries — enough to tell that ten entries came from one phone, and nothing more. It is tied neither to you nor to your device: it is generated at random, disappears when the app is deleted or the switch is turned off, and a new one is born if you turn it back on. We do not store the address the request came from.

The logs live on our server in Russia (Timeweb) and are deleted automatically after 60 days. We read them when investigating a failure.

They are also counted up: how many installs sent entries on a given day, which phone models and iOS versions those entries touched, and how many installs got as far as a working keyboard. This is a count, not surveillance — it is assembled from the same service entries the log is made of and adds nothing to them. Its purpose is to keep a failure that hit ten people once from being buried under one that hit a single person forty times.

The keyboard and Full Access

The Scribla keyboard asks for Full Access, and that deserves a plain explanation, because the system warning sounds alarming.

Full Access is needed for exactly one thing: to read the recognised text from the shared container, where our own app put it. iOS offers no other channel for delivering text into a keyboard. The keyboard itself never goes online under any circumstances — it contains no networking code. It does not read or transmit what you type on ordinary keys.

The Mac version and Accessibility

On the Mac there is no keyboard extension, and therefore no shared container and no Full Access. Instead the app asks for two permissions: the microphone — otherwise there is nothing to record — and Accessibility.

Accessibility is needed for exactly two things: to hear that you are holding the dictation key, and to insert the finished text where the cursor is. The app does not read the contents of other windows, takes no screenshots, and contacts nothing with that permission. The text is inserted through the clipboard, and the previous clipboard contents are put back.

Everything else matches the phone version: audio never leaves the computer in any mode, the transcript history lives only on disk in the app’s support folder, and what goes out — only in the AI modes — is text, as described above. There is no account here either, and the app does not go online to check for updates: a new version appears on this site.

What there is none of in the app

• Analytics or counters: the app counts neither launches nor screens. The site does have a counter, described separately below.
• Advertising or advertising identifiers.
• Tracking across apps and websites.
• Sharing data with brokers or third parties for their own purposes.
• Accounts: there is nowhere and no reason to register in Scribla.
• Third-party analytics or crash-reporting libraries.

Deleting data

Transcript history can be cleared inside the app. Deleting the app from the phone takes the history, the settings, the diagnostics log and the model files with it.

Third-party service keys are a separate case, and it deserves to be said plainly. iOS keeps them in the Keychain, and the Keychain outlives the app’s deletion: an app has no code that runs at the moment it is deleted — that is how the system works, not a choice of ours. So Scribla erases the keys on the first launch after a new install. If you want them gone right away, clear the key field in the settings before deleting the app.

We keep exactly one thing, and only if you allowed it: the app’s own log. It deletes itself after 60 days, and turning the “Help with bugs” switch off stops the sending at once and erases what had piled up on the phone. If you want what was already sent removed sooner, write to us with your install marker; there is nowhere to look it up, so it is easier to give us a rough time when you were using the app. Beyond that we hold nothing: no audio, no transcripts, no account.

Forms on this site

Everything above is about the app. The site itself is simpler, but it does receive a few things, and those deserve their own section.

The “we’ll write when it ships” form keeps an email address. We will write to it once — on release day — and that is the end of the list.

The feedback form keeps the message, the email address if you gave one, and any screenshots you attached. The address the request came from is stored with them: it exists so the form cannot be hammered by a script, and it has no other use.

All of it lands on the site’s server and goes from there to us by email. Nowhere else: no analytics, no mailing service, no third parties. The screenshots sit outside the public part of the server — no link opens them.

Before it is sent, a screenshot is resized and re-encoded inside your browser. As a side effect that strips the original file’s metadata: capture time and coordinates never reach us. What’s in the picture itself stays — before attaching, look at what is on the screen.

You can also write to us by plain email, with no form at all: dev@scribla.io. To have something deleted, write to the same address.

The site’s visit counter

The site’s pages carry Yandex Metrica, counter 111532968. It is there for one thing: to see how many people come and which pages they read. Until 12 August 2026 there was no counter at all, and this page said so. Now there is one — and saying plainly what it collects beats leaving the old line in place.

Metrica sets cookies and passes Yandex the usual set for a counter: the page address, where you came from, the browser language and version, the screen size, and an approximate region from your connection address. No name and no email are in that set. What you type into the forms does not go there: it lands on our server and comes to us by email, as described above.

Session recording (Webvisor) is off. Mouse movement, scrolling and what you type into fields are not recorded — on a page with a free-text feedback form such a recording would collect exactly what we promise not to collect. The click map is on: it counts taps by position on the page, with no field contents.

One more thing, visible only in a debugger, which is why we say it ourselves: as it loads, Metrica calls Yandex’s advertising endpoint (mc.yandex.ru/metrika/advert.gif). That is how their counter is built. There are no ads on this site, we run no retargeting and build no advertising audiences — but the call happens, and on their side Yandex is free to use it under their own terms.

What Yandex does with what it receives is governed by their terms, not ours: the privacy policy and the Metrica terms. You can opt out without asking us — Yandex provides a way to disable Metrica, and an ordinary content blocker works too. The site will keep working either way: the counter is a separate file and affects nothing on the page.

Children

The app is not directed at children and collects no data about them — nor, for that matter, about anyone else.

Changes

If a feature appears that changes how data is handled, this page will be updated and the date at the top changed.

Contact

Privacy questions: dev@scribla.io