Hush MinutesSecurity and privacy
Private because it has
nowhere to send anything.
Most privacy promises ask you to trust a company. This one is enforced by macOS.
The AI is the one your device already has.
Hush Minutes brings no AI of its own and rents none.
Speech to text
Done by the on-device transcriber Apple ships with macOS. Your audio is turned into words on the Mac in front of you.
The notes
Written by Apple's on-device language model, part of Apple Intelligence. Apple's Private Cloud Compute is never used.
No fees, no keys
There is no API key, no credit balance and no price per minute, because no outside service is involved.
What macOS allows the app to do.
The Mac App Store version runs in Apple's App Sandbox. These are all of its permissions. Network access is not among them, so macOS itself would refuse a connection.
| Permission | Why |
|---|---|
| App Sandbox | The app is confined to its own container and the folder you choose. |
| Microphone | To transcribe what you say, only while Record is on. |
| Calendar | To title a meeting from its event and answer questions about your day. Asked once; read on the Mac. |
| Files you select | To save meetings in the folder you pick, and remember that choice between launches. |
| Network | Not requested. The app has no permission to connect to anything. |
Two things macOS asks you directly
Hearing the other side of a call uses the Screen Recording permission, which is how macOS lets an app hear what the Mac plays. No picture of your screen is taken or used. Reminders are reached only if you allow them.
What is kept, and where.
Files, not a service.
Your folder
On the Mac, each meeting is a folder of Markdown in a place you choose. Until you choose, it stays in the app's own container. On iPhone and iPad it is the app's folder on the device, which the Files app shows.
Audio is discarded
After it has been transcribed, unless you turn on keeping the audio file.
Delete means delete
Remove a meeting like any file. There is no copy anywhere else to chase.
Redaction before saving
Words and numbers you mark are removed as each line arrives, before anything is written.
Nothing collected
No analytics, no crash reports, no identifiers. The App Store privacy label is Data Not Collected.
No account
There is nothing to sign in to, so there is no account to breach.
The honest limits.
What this protects, and what it leaves to your Mac.
The lock is on the app
Touch ID keeps the app closed to someone at your unlocked Mac. The files themselves are protected by your Mac's login and FileVault, not encrypted again by the app.
iCloud is your choice
On the Mac, if you put the folder in iCloud Drive, macOS syncs it through your own account; choose a folder outside iCloud to keep meetings on one Mac. On iPhone and iPad there is a switch, off by default, that keeps meetings in your own iCloud Drive. With it on, your transcripts and notes are stored by Apple's iCloud under your account. They still go to no server of ours.
iPhone and iPad hear the room only
They cannot capture the other side of a call. The older speech recogniser, used for a few languages, is only ever run on the device; if it cannot be, the app refuses to record.
Redaction is pattern matching
It catches the words and number shapes you set. Check anything critical yourself.
Kept audio is not redacted
If you keep the audio, a redacted word is still in the recording.
Languages may download once
Translation runs on the Mac, but macOS itself may fetch a language the first time you use it.
Tell people
Laws on recording conversations differ by place. Telling people you are taking notes is right everywhere.
Coming soon to the
Mac App Store.
iPhone and iPad follow, and one purchase covers all three. US$29.99, once. One email on launch day, nothing else.