We say "on-device by default", not "nothing ever leaves"

This post isn’t announcing anything new. It’s a plain restatement of a rule we already hold ourselves to internally — the one written down as our single non-negotiable positioning guardrail — because a rule that only lives in an internal document isn’t one a reader can hold us to.

The rule is short: the store listing, this website, the privacy policy, and the app itself have to tell one truthful story, and none of them get to claim more than the shipped product actually does. Concretely, that means we never imply “nothing ever leaves your device” while an opt-in cloud tier exists on the roadmap. We say “on-device by default,” and then we explain the opt-in part honestly instead of leaving it out.

It would be easy to write the stronger sentence. “Nothing ever leaves your device” reads better on a landing page than “nothing leaves your device by default, and here’s the one exception you’d have to turn on yourself.” It’s punchier, it’s more absolute, and it’s exactly the kind of claim that turns into a real problem the moment a product adds any feature that isn’t fully offline — a cloud Pro tier for extra quality, say, or an opt-in program to help improve the models. The instant that feature exists, “nothing ever” stops being true, and a company that said it anyway is now explaining a gap between what it claimed and what it does. That’s not a hypothetical risk; it’s the exact shape of mismatch that’s cost other voice-typing products real trust when their marketing outran their actual behavior.

So we chose the less flattering, more defensible sentence instead. “On-device by default” is still a strong, real promise — dictation runs on your phone today, with no server round-trip required to get a result, and that’s true right now, not aspirational. But it’s a promise that stays true even as the product grows, because it was never claiming more than “by default” in the first place. If a cloud Pro tier ships later, that sentence doesn’t need walking back — it already said “by default,” and the opt-in mode gets described as exactly that: something you’d have to turn on, disclosed plainly, never a silent default flip.

We think honesty here isn’t a compliance checkbox, it’s a positioning choice — arguably the whole one. A company willing to concede the boundary of its own claim, out loud, on its own website, is a company you can actually check. That’s the entire point of writing this post instead of just filing the rule away: “on-device by default” is a sentence built to survive the product getting more capable, and “nothing ever leaves” was never that sentence to begin with — it just sounded like it, for as long as nobody asked a follow-up question.