The Privacy Ledger, explained

The Privacy Ledger is a list, kept by the app, of the network requests it makes: when, to which host, how many bytes it sent, why, and where that host is. It covers almost all of them; the few it does not record yet are listed below. It exists so that what leaves your machine is something you can check rather than something you take our word for. Open it in Settings → Privacy; it shows the newest 100 requests.

This machine, Local network and Internet

The Where column puts each request in one of three places:

This machine: the addresses that never leave the machine (127.0.0.1 and the rest of 127.x.x.x, ::1 and localhost). Only these requests stayed on your machine. They are shown greyed out. On a Mac before version 1.0.4 this place reads This Mac, and on Windows and Linux before version 1.0.7 it reads This computer; it means the same.
Local network: private and link-local addresses, such as 192.168.x.x or 10.x.x.x, and .local names, for example another machine on your network that runs Ollama. These left your machine without being addressed to the public internet. A VPN can carry a private address further, so the ledger never calls them This machine.
Internet: everything else, including every other host name, because a name can point anywhere. When the ledger cannot tell, a request counts as Internet.

The tiles above the table count internet requests and the bytes sent to the internet, the requests to this machine (the notes engine), and, when there are any, the requests to your local network. Below them are the internet and local-network destinations with their totals.

Recorded before it is sent

A request that can carry meeting content is written to the ledger before it goes out, with the number of bytes it sends, and its row is completed when the answer arrives. A request that fails or is cut off keeps its row, marked failed, and one still under way shows as sending. Downloads and calendar feeds are recorded the same way.

What a normal ledger looks like

On the default setup, the first day of a Mac with version 1.0.4, set up in English, has lines like these, oldest first (the app lists the newest first, and the order of the later lines can vary):

Oct 8  media.recordist.app  Internet     First launch (one fixed address; carries only the version and the kind of Mac)        ↑0 B
Oct 8  media.recordist.app  Internet     Update check (one fixed file; carries only the updater component's name and version)  ↑0 B
Oct 8  media.recordist.app  Internet     Download speech model base.en                                                         ↑0 B
Oct 8  media.recordist.app  Internet     Download speech model silero-vad                                                      ↑0 B
Oct 8  media.recordist.app  Internet     Download speech model large-v3-turbo-q5_0                                             ↑0 B
Oct 8  media.recordist.app  Internet     Download built-in notes runtime: check that the download is available                 ↑0 B
Oct 8  media.recordist.app  Internet     Download built-in notes runtime (Ollama, MIT)                                         ↑0 B
Oct 8  registry.ollama.ai   Internet     Download notes model qwen3:4b-instruct (Apache-2.0)                                   ↑0 B
Oct 8  127.0.0.1            This machine  AI notes (Ollama, on this machine)                                                    ↑18.4 KB

The update check asks our release host for one fixed file and carries no identifier.

The First launch line appears once per install, from version 1.0.3: the first update check after you install also asks for one fixed address whose path names only the version and the platform, such as media.recordist.app/updates/hello/1.0.4/macos-aarch64, so we can count new installs. It carries no identifier, sends nothing in its body, and is never sent again, not after an update, not after a reinstall over your data, and not at all while update checks are off. On Windows and Linux it comes with version 1.0.7, where the line ends “the version and the platform”.

From version 1.0.7, a First steps line can appear up to three times per install: once when your first call of a minute or more is recorded, once when the Pro trial starts, and once when you open the License screen. Each asks, with an update check, for one fixed address whose path names only the step, the version and the platform, such as media.recordist.app/updates/step/recorded/1.0.7/macos-aarch64, so we can see where people get stuck. It carries no identifier and nothing about your meetings, and none is sent while update checks are off or while Settings → General → Count first steps anonymously is off.

If our download host cannot be reached, the speech model comes from Hugging Face and the notes engine from GitHub, and the ledger shows those hosts too.

From version 1.0.10, if you give an address when Recordist asks where to send your Pro key, a Pro key line for recordist.app appears: once, or once for each try while you were offline, for up to 7 days. It carries the address, a random code for this install, the platform, the app’s version, your time zone and which words you saw, and nothing about your meetings. If you choose Continue with Free or Not now, there is no such line. If you answer How did you hear about Recordist? on that screen, one more line carries that word, the platform and the version, and nothing else.

While a licence key is stored, each update check comes with a request to license.recordist.app, labelled as a licence check. It carries no key, licence id or account.

From version 1.0.5, a Pro subscription renews by itself, and two more lines for license.recordist.app can appear, only while update checks are on. Licence renewal: register this machine appears once, when a subscription key is saved or at the first update check after you update with one saved: it sends the key with a one-way code of a random secret that this machine keeps in its keychain. Licence renewal: fetch the renewed key appears about once a day in the last days of each paid period, until the new key arrives: it sends only the key’s licence id and that secret. Neither carries anything about your meetings. The privacy policy says what our licence service keeps and for how long.

From version 1.0.9, one more kind of line for license.recordist.app can appear, so that a key never needs pasting. It appears only after you open Pro checkout from inside the app, while the app waits for the key you are buying: it sends only a random code the app made for that checkout, about every 15 seconds for the first 15 minutes, then when the app starts, when you switch back to Recordist and about once an hour, until the key arrives or 24 hours pass. It carries nothing about you or your meetings.

From version 1.0.9, with Install updates automatically on, a new version downloads by itself after the check that found it, never during a recording: an Update download line from media.recordist.app, the same signed package that Restart to update fetches, carrying nothing about your meetings.

The update check repeats at launch and every six hours while the app runs. Turn off update checks and, after the downloads and the Pro key line if you gave an address, the only new lines are the app’s requests to the notes engine on your own machine, marked This machine. There is no code path that sends audio to us. Audio appears on this list only on a Mac whose organisation archives each meeting to its own storage: each upload is written here before it is sent.

With a cloud key, or your own Ollama elsewhere

If you use Anthropic or an OpenAI-compatible provider, each request that carries meeting content adds a line:

Oct 9  api.anthropic.com  Internet  AI notes (Anthropic, your key)  ↑41.2 KB

A notes request carries the transcript text of one meeting, its title, the names of its attendees, the date of the meeting and the template’s instructions. Writing one meeting’s notes can take more than one request, for example for a long transcript. Ask, a Pro feature, sends the transcripts of the meetings it reads (the last 5 or 8, or those matching your search), with their titles and dates, under the same label. The Test connection button’s request carries no meeting content and is labelled as a test. Switch the provider back to Built in and these lines stop.

If you use an Ollama you already run on another machine, its requests show that machine’s address, marked Local network or Internet. Recordist never sends notes to Ollama cloud models, because they run on Ollama’s servers; if one is chosen, the built-in engine on your machine writes those notes instead.

The privacy receipt

The Privacy receipt button above the ledger adds up the last 30 days or all time: meetings recorded, audio, words transcribed, notes by engine, internet requests by reason, and how many bytes of meeting content left the app and where they went. It is made on your machine from the database and the ledger, and it sends nothing. It says 0 bytes only when the ledger covers the whole period; a period that starts before the ledger began, or before you last chose Delete all my data, gets no such claim. You can copy the receipt as text or save it as an image.

What it does not include

Requests that the AI assistants you connect make to the app. They arrive over a connection on your own machine and never leave it. Where an assistant sends what it read is that assistant’s business; the ledger only covers what Recordist sends.

Exporting it

There is no export button yet. The ledger moves with your data folder to a new machine, and the local API can read it. Delete all my data clears it, and the app keeps the date it did, so a later privacy receipt makes no claim about the time before.

What it does not record yet

A few requests are not written to the ledger yet. None of them carries audio, transcripts or notes:

the app asking a notes engine on your machine, the built-in one or your own Ollama, whether it is running and which models it holds (these requests never leave your machine);
the extra hosts a download is redirected to (only the first host is shown);
an update check cut off by quitting the app, because its row is written when the request ends;
requests the built-in notes engine makes by itself, because it runs as a separate program; the model download the app asks it for is recorded.

A network monitor such as LuLu or Little Snitch shows every connection the app makes, if you want an outside view as well.

Check it against the Trust Center

The public version of this table, with every possible request explained, is on the Trust Center. If you see a host in your ledger that is not on that page, that is a bug; report it to security@recordist.app.