Security & Responsible Disclosure

betterflo does voice dictation for any app, by default through a floating mic that uses an Android Accessibility Service to insert text, and alternatively through a full keyboard (IME). Software that can read what a person is typing is high-trust software — so we run a coordinated responsible-disclosure program and we want to hear from you.

Report a vulnerability

Email us atmobilebytesensei@gmail.comwith enough detail to reproduce the issue — affected version or build, steps, and impact. If you can, tell us how you would like to be credited.

Please report privately and give us a chance to fix the issue before disclosing it publicly. We commit to acknowledging your report and working with you in good faith throughout.

Coordinated disclosure window

We follow a coordinated-disclosure model with a 90-daywindow, the industry standard. You report the issue to us privately; we investigate, remediate, and coordinate a release; and we ask that you hold public disclosure until a fix ships or 90 days have passed — whichever comes first. If an issue is complex we will keep you updated, and if it is being actively exploited we will move faster together.

Why we run this program

A floating mic that inserts text via an accessibility service, and a keyboard, can both read what you're typing into. That makes trust the whole product, and it means a security bug in betterflo is never "just a bug." betterflo is designed to be on-device by default — audio and text are processed on your device and are not transmitted, and the diagnostic data the app does send is switchable off in Settings → Privacy — but a design is only as good as its implementation. External scrutiny is how that promise stays honest.

The industry has a recent, concrete lesson here: a competing dictation app shipped undisclosed data-capture behavior that its own disclosures did not match, and it triggered a 2025 privacy incident. We would rather a researcher find our mistakes first and tell us — which is exactly what this program is for.

Scope & good-faith safe harbor

Research conducted in good faith under this policy — accessing only data that is yours, avoiding privacy violations and service disruption, and giving us reasonable time to respond — is welcome, and we will not pursue action against it. Please do not access, modify, or exfiltrate data that does not belong to you.

Related reading

For what the Accessibility Service reads, why, and how to turn it off, see theAccessibility Service Statement. For everything else betterflo does and does not collect, see thePrivacy Policy.