betterflo
Get it on Google Play

Privacy controls

This page is the operable counterpart to the privacy policy: not just what betterflo promises, but which switches you can actually reach today and what each one does. Where a control is described in the product plan but is not in this build yet, it is labelled planned rather than documented as if it were live.

The default: on-device by default

Everything betterflo needs to turn your speech into text runs on your device by default. Speech recognition and cleanup happen locally; in this build there is no cloud dictation path and no code that transmits your dictation, edits, or the text around your cursor off the device. So even with every toggle left at its default, nothing about your dictation is sent anywhere today.

One thing is sent by default, and it isn’t your dictation: usage and crash diagnostics. That has its own section below, including the switch that turns it off.

What stays on your device

Three kinds of data live only in local, on-device storage — nothing here is uploaded, and nothing here needs a network connection to work:

  • Dictation history. Every dictation is logged locally, searchable, and individually deletable, with a detail view showing the raw transcript alongside each polish level applied to it. See History retention, below, for how long it sticks around.
  • Your personal dictionary. Custom words, phrases, and their “sounds like” hints — see Dictionary, snippets, and voice commands for what you can add. It’s read into the context handed to the recognition engine on every dictation, entirely on-device.
  • Snippets and settings. Your text-expansion snippets, language and model choices, and every toggle on this page — all local key-value or on-device database storage, none of it synced anywhere.

History retention

Settings has three retention options for your dictation history:

  • Keep — no expiry. This is the default.
  • 24 hours — a rolling window; anything older is cleared out as you go.
  • Never — betterflo stops saving new dictations, and this option also deletes everything already stored, behind a confirmation step so it isn’t accidental.

One asymmetry worth knowing: turning history off by itself (without picking “Never”) stops new entries from being written, but it doesn’t retroactively delete what’s already there — only “Never” does that. If you want a clean slate, “Never” is the option that gives you one; anything short of it just stops the list from growing.

Usage analytics

Settings → Privacy → Usage analytics. This one is on by default, and it is the only thing betterflo sends off your phone.

What it covers: which screens you open, which settings you change, whether a dictation succeeded or failed and how long it took, plus crash reports when the app falls over. Every value is a fixed label, a category name or a number.

What it never contains: your audio, your transcript, anything in the field you dictated into, a dictionary entry, a snippet, or which app you were dictating in. That boundary is enforced by a test that fails the build if a diagnostic field so much as looks like message content.

Turning it off does three things at once:

  • stops the next event — the switch is checked on every individual event, not once per session, so there’s no “until you restart the app” gap;
  • shuts off collection inside Google’s Firebase libraries themselves, so they stop gathering on their own account; and
  • deletes what was already collected — betterflo tells Firebase to reset this install’s analytics state, including its per-install identifier, and to bin any crash reports still queued on the phone.

So the switch is both an off switch and a delete button. You can turn it back on whenever you like.

Betterflo collects no advertising ID. The ad-ID permissions Google’s libraries would normally add are stripped out of the app before it’s built.

What the floating mic’s accessibility service reads

“On-device by default” is about sending, not about reading — and it’s worth being precise about that difference. The floating mic, betterflo’s default dictation surface, inserts your text using an Android Accessibility Service. To do that, it reads the text field you’re actively dictating into — its content and where your cursor is — for as long as you’re dictating into it, and nothing else on the screen. That content is used to place your text, then discarded: it isn’t stored, logged, or transmitted. It never acts on a field reporting itself as a password or otherwise secure field. See what betterflo can see for the full, plain-language disclosure shown before this permission is ever requested, or use the betterflo keyboard instead — a full keyboard you type on, with dictation on a key and Fix, Tone, Rewrite and Translate running on your phone, and no accessibility service anywhere in it.

Note

“On-device by default” is the honest framing — not an absolute “nothing ever leaves your device” forever. A cloud Pro tier and an opt-in way to help improve accuracy are planned for later milestones. If those ship, they will be opt-in and covered here and in the privacy policy. This page always reflects what the current build actually does.

Privacy Mode

Privacy Mode is a real, shipping toggle. You will find it in the betterflo Hub app on the home screen, as a switch labelled Privacy Mode. It is off by default.

When you turn Privacy Mode on:

  • No surrounding-text context is captured. Normally betterflo may read a small, capped window of the text around your cursor locally to improve cleanup (for example, to match the surrounding style). With Privacy Mode on, that context is dropped entirely — the field around your cursor is never read, whatever kind of field it is.
  • It pre-emptively gates any future sharing path. There is no telemetry or edit-sharing path in this build, but Privacy Mode is wired to suppress any such data before it could ever be persisted or transmitted, so the switch is meaningful the moment those paths exist.

The Hub summarises the “on” state as “nothing leaves this device.” Turning it back off restores the normal local behaviour (small capped context window used locally for cleanup). The change takes effect on your next dictation — no app restart needed.

Tip

Password and other secure fields are always treated as private — betterflo never reads the context of a password field, regardless of the Privacy Mode setting.

What the website’s feedback form collects

Separately from the app: the feedback form on this website is where you can report something betterflo got wrong. It collects what you type into it — your email address, a description of what happened, and the optional details about your app, language and phone. Because a useful report usually quotes the sentence you said and the text that came out, those words reach us — but only because you typed them into the form yourself, never because the app sent them.

It’s submitted through a static form service (Netlify Forms) with no site-side database and no client-side tracking script. We use it to reply to you, to fix what you reported, and — if you tick the box — to send the tester perk. We don’t sell it, share it, or add you to a newsletter; see the privacy policy for how to be removed. None of this touches the app itself: betterflo needs no account and no email address to use, whether or not you ever send a report.

Planned controls — not yet in this build

The following is part of the privacy plan (M5 scope) but is not implemented in this build. It’s described here so you know what’s coming and can see, honestly, that it isn’t available yet:

  • Opt-in accuracy improvement. An explicit opt-in to help improve betterflo by sharing (raw → edited) pairs — where you dictate something, correct it, and the before/after pair helps the models learn. The plan is that personally identifiable information is redacted on-device before anything leaves, and that you can turn it off at any time. Planned and off by design — the sharing path does not exist in this build, so there is nothing being collected to opt into yet.

When it ships, this page and the privacy policy will be updated to document the actual UI and behaviour.

Also planned, not live

For completeness, other privacy-relevant items you may read about elsewhere are planned, not in this build: a cloud Pro tier, opt-in personalization, and a dedicated Privacy Mode settings screen beyond the current Hub toggle. Today’s honest summary stays simple: on-device by default, with history retention you control, a dictionary that stays local, and one real switch — Privacy Mode — that drops context capture and pre-blocks any future sharing.

← All help guides