· TALKIE / SECURITY
Security Approach.
Talkie is built so unfinished thoughts stay on your devices by default. Your library lives locally, sync can run through your iCloud, transcription can stay on device, and external providers are opt-in with your own keys.
· 01 / DATA FLOW
Where your data goes — and where it doesn't.
Solid traces are your data path. Dashed amber traces are opt-in only — text leaves the device solely when you explicitly route a workflow to an external provider.
Security Architecture
Data Sovereignty Model v1.2iCloud
Encrypted CloudKit ContaineriPhone
Mac
OpenAI
Anthropic
Google
Notion
Zapier
LinearOutbound: Text-Only Stream
· 02 / DATA INVENTORY
What is stored. What is not.
On your devices only.
- Voice memos (locally, on your device)
- Transcripts (locally, in SQLite)
- Your library index (encrypted on disk)
- API keys you provide (macOS Keychain only)
- iCloud sync data (your Private CloudKit DB)
Never on Talkie servers.
- Audio files on Talkie servers
- Transcripts on Talkie servers
- Your API keys on Talkie servers
- Any library content on Talkie servers
- Usage telemetry linked to your content
· 03 / PRINCIPLES
How the trust model is built.
On-device first
Your data lives in a local SQLite database file on your device’s encrypted disk. It is not just “cached” locally; it is authoritative locally. Deleting the app deletes the data.
You own the keys
We use Apple’s CloudKit for sync. Your data is encrypted with keys managed by your Apple ID. We (Talkie Systems) have no access to these keys and cannot decrypt your data.
On-device transcription
Transcription can stay 100% on device using Apple silicon. For later transformations, you can keep using local models or opt into external providers only when you choose to.
BYO providers
When you use an external provider, audio can stay on your device and only the text you choose to send leaves the machine. That keeps the trust boundary clear. Your keys are stored in the macOS Keychain and accessed only at runtime to sign requests.
Audit trails
Every network request initiated by a workflow is logged in a local, immutable audit trail. You can inspect exactly what text was sent to which API and when.
· 04 / VENDOR ISOLATION
The wall of separation.
Understanding who holds the keys to your data is critical. We use Apple's Private CloudKit container, which keeps your data on a different shelf from ours.
Talkie Systems Inc.
(The Vendor)We publish the app binary to the App Store.
We push updates and bug fixes.
You & Apple ID
(The Data Owner)Your devices generate the encryption keys.
Data resides in your Private CloudKit Database.
Only your authenticated devices can read it.
· 05 / ADVANCED DATA PROTECTION
Advanced Data Protection Ready
Nobody can decrypt it. Not even Apple.
Talkie fully supports Apple's optional Advanced Data Protection for iCloud. Because we utilize standard CloudKit Private Databases, enabling ADP in your Apple ID settings automatically extends strict end-to-end encryption to your Talkie data.
Keys stay with you
Encryption keys are stored only on your trusted devices, not on iCloud servers.
Zero Server Access
Neither Apple nor Talkie Systems can decrypt your data, even under warrant.
· 06 / COMPARISON
Talkie vs. hosted AI apps.
We don't run a cloud that stores your library.
By design, Talkie is built around local storage, iCloud custody, and provider choice. That keeps your memos, transcripts, and unfinished thoughts on your side of the line.
curl -fsSL go.usetalkie.com/install | bashAudio stays on device. Transcripts land in your local SQLite. iCloud sync runs through your keys, not ours.