Effective: 2026-09-23 · Applies to: Voice Rack for Mac (Mac App Store)
Voice Rack has no network permission. Not "we don't upload" — the app is sandboxed without com.apple.security.network.client, so macOS refuses any outbound connection at the kernel. Your recordings, transcripts, summaries, questions and answers are processed on your Mac and stay on your Mac — unless you yourself connect an AI assistant to your library (see "Connecting an AI assistant" below). We operate no servers, no accounts, no analytics, and we receive none of your data.
You can verify this yourself in ten seconds:
codesign -d --entitlements - "/Applications/Voice Rack.app"There is no network entry. That is the whole policy; the rest is detail.
| Data | Where it is stored | Leaves your Mac? |
|---|---|---|
| Recordings you import | Copied into your library folder (a folder you choose). The originals stay where they were. | No |
| Recordings in folders you add as references | Read where they are | No |
| Transcripts, summaries, tags, notes, highlights, Q&A history | Sidecar files (.moji, .mojivec) next to each audio file, in your own folders | No, unless you turn on assistant access and connect an AI assistant |
| Voice memos you record in the app | Your library folder, as ordinary audio files | No |
| Term book, summary templates, the list of folders you added | Inside the app's container on this Mac | No |
| App settings, unfinished-job list, trial start date, purchase state, the counters in Settings › Statistics | macOS preferences inside the app's container (the app does not use the Keychain) | No |
The app moves or replaces an audio file only when you ask it to rename, compress or delete it. Renaming renames the file; compressing writes a smaller .m4a beside it and moves the original to the Trash; deleting moves the recording to the Trash. The sidecar files follow the audio.
Everything the app produces about a recording sits beside it as plain files you can open, copy, back up, or delete with the Finder.
Deleting the app does not delete your library folder or the sidecar files in it — they are yours. macOS also keeps the app's container (settings, term book, summary templates, folder list, trial and purchase state). To remove that too, quit the app, choose Go › Go to Folder… in the Finder, enter ~/Library/Containers/com.thinkspread.voicerecordfolder, and move that folder to the Trash.
Transcription, translation, summaries, tagging, to-do extraction and question-answering run on models bundled inside the app. Nothing is downloaded at first launch and no text is sent to any model provider. This is why the app is large: the models are in the package.
The app can tell speakers apart within a recording. This runs entirely on your Mac. What is saved is only a label per segment (for example "Speaker 1") and any name you choose to give it. No voiceprint, embedding or biometric template is stored or transmitted.
The microphone is used only when you press record for a voice memo. macOS asks for permission the first time; the recording is written to your library folder and nowhere else.
The app can open only the library folder you choose, the folders you add as references, and the files you explicitly import or drop on it. macOS grants that access when you pick them. The app keeps a security-scoped bookmark for the library folder and for each referenced folder so it can reopen them next time; folders you import from are used for that import only and are not remembered. Removing a referenced folder from the app deletes its bookmark (unless the library folder or another folder you still use lies inside it), so after the app quits neither the app nor a connected assistant can open that folder again. The app cannot see anything outside these places.
Voice Rack Pro can let an AI assistant on your Mac that supports the Model Context Protocol (MCP) search your library. This is off by default, and nothing is connected until you set it up yourself: turn on "Allow AI assistants to access your recording library" in Settings › General › Assistant access (MCP), then copy the configuration shown there into your assistant's configuration. While that switch is off, an assistant that starts Voice Rack sees only the names of the tools below, and every request to use them is refused — no recording is listed, searched or read, and the library is not even opened. With the switch on, the assistant starts Voice Rack in a background mode on your Mac — the same sandboxed program, still without network permission — and can ask it to:
It cannot change, move or delete your recordings, and it cannot reach anything outside your library folder and the folders you added. To answer searches it may create the same search-index files (.mojivec) next to your recordings that the app itself creates.
What happens to those results next is up to the assistant you chose: it passes them to the AI model you selected in it, which may run on your Mac or on another company's servers, and they are handled under that assistant's and that model provider's privacy policies — not this one. We receive none of it. To stop, turn the switch off again (it applies from the assistant's next request), or remove Voice Rack from your assistant's configuration.
The app does not add an encryption layer of its own. Transcripts, summaries and indexes are ordinary files stored next to your audio (or in your library folder), so you can open, back up, move or delete them with any tool. They are protected the way everything else on your Mac is: by FileVault and, on Apple silicon, by the built-in data protection of the Secure Enclave. There is no app-specific key to lose, and nothing we could hold a copy of.
You can require Touch ID or your password to open the app. This uses Apple's LocalAuthentication; no biometric data is accessible to the app.
Pro is a one-time in-app purchase handled entirely by Apple through the Mac App Store. Apple processes payment and manages your receipt; the app only records whether the purchase exists. We never see your name, payment method or Apple ID.
If macOS itself shares diagnostic data with Apple, that is governed by your System Settings and Apple's privacy policy, not by us — we receive none of it.
The app collects no personal data from anyone, of any age.
If a future version ever adds a network capability, this policy will change before that version ships, the change will be called out in the release notes, and the entitlement will be visible with the command above. A build that gains network permission without this policy changing first is a bug; our release pipeline is designed to refuse to build it.
Online version: https://www.thinkspread.com/voicerack/privacy/
生效:2026-09-23 · 适用:Mac App Store 版
声音档案馆没有网络权限。不是"我们不上传",而是 App 运行在没有 com.apple.security.network.client 的沙盒里,macOS 在内核层拒绝任何出站连接。你的录音、转写、摘要、提问与回答都在你的 Mac 上处理、留在你的 Mac 上——除非你自己把 AI 助手接到你的库上(见下文「接入 AI 助手」)。我们没有服务器、没有账号、没有统计,也收不到你的任何数据。
你可以十秒钟自己验证:
codesign -d --entitlements - "/Applications/Voice Rack.app"里面没有任何 network 条目。这就是整份政策,其余都是细节。
| 数据 | 存放位置 | 会离开你的 Mac 吗 |
|---|---|---|
| 你导入的录音 | 复制进你的库文件夹(由你选定的文件夹),原件留在原处 | 否 |
| 你添加为引用的文件夹里的录音 | 原地读取 | 否 |
| 转写、摘要、标签、批注、高亮、问答记录 | 每个音频旁边的附属文件(.moji、.mojivec),在你自己的文件夹里 | 否,除非你打开了助手访问并接入了 AI 助手 |
| 在 App 内录的语音备忘 | 你的库文件夹,普通音频文件 | 否 |
| 术语表、摘要模板、文件夹列表 | 这台 Mac 上 App 的容器里 | 否 |
| 设置、未完成任务清单、试用起始日、购买状态、「设置 › 统计」里的计数 | App 容器里的系统偏好(App 不使用钥匙串) | 否 |
只有在你要求改名、压缩或删除时,App 才会移动或替换音频文件:改名就是给文件改名;压缩会在旁边写一个更小的 .m4a,原件进废纸篓;删除会把录音移到废纸篓。附属文件随音频一起走。
App 为一段录音产生的一切都以普通文件形式放在它旁边,可以用访达打开、复制、备份、删除。
删掉 App 不会删掉你的库文件夹和里面的附属文件——它们是你的。macOS 还会保留 App 的容器(设置、术语表、摘要模板、文件夹列表、试用与购买状态)。要一并删除:退出 App,在访达里选「前往 › 前往文件夹…」,输入 ~/Library/Containers/com.thinkspread.voicerecordfolder,把这个文件夹移到废纸篓。
转写、翻译、摘要、标签、待办抽取、问答都跑在随 App 一起打包的模型上。首次启动不下载任何东西,没有任何文本发给任何模型服务商。这就是 App 体积大的原因:模型在包里。
App 可以区分一段录音里的不同说话人,全程在你的 Mac 上完成。保存下来的只有每段的标签(如"说话人 1")和你自己起的名字。不存储、不传输任何声纹、嵌入向量或生物特征模板。
只在你按下录音、录语音备忘时使用。macOS 会在首次时征求许可;录音写入你的库文件夹,不写去别处。
App 只能打开你选定的库文件夹、你添加为引用的文件夹,以及你明确导入或拖进来的文件,访问权限在你选择它们时由 macOS 授予。App 为库文件夹和每个引用文件夹保存一个安全作用域书签,下次启动才能重新打开它们;导入时选的来源文件夹只用于那一次导入,不会被记住。把引用文件夹从 App 里移除即删除它的书签(除非库文件夹或你仍在用的其他文件夹就在它里面),App 退出后,App 和接入的助手都不能再打开它。除此之外的地方 App 看不见。
声音档案馆 Pro 可以让你 Mac 上支持 MCP(Model Context Protocol)协议的 AI 助手检索你的录音库。这项功能默认关闭,你不主动设置就什么都不会接上:先在「设置 › 通用 › 程序接口(MCP)」里打开「允许 AI 助手访问录音库」,再把那里显示的配置复制到助手的配置里。开关关着时,拉起声音档案馆的助手只能看到下面几个工具的名字,每一次使用它们的请求都会被拒绝——不列出、不检索、不读取任何录音,连库都不打开。开关打开后,助手会在你的 Mac 上以后台模式启动声音档案馆——同一个沙盒程序,同样没有网络权限——并可以让它:
它不能修改、移动或删除你的录音,也够不到库文件夹和你添加的文件夹以外的任何东西。为了回答检索,它可能在录音旁边生成与 App 自己生成的相同的检索索引文件(.mojivec)。
这些结果之后如何处理,由你选的助手决定:助手会把它们交给你在助手里选的 AI 模型,那个模型可能在你的 Mac 上,也可能在别家公司的服务器上,并按该助手和该模型服务商的隐私政策处理——不适用本政策。我们一条也收不到。要停止,把这个开关关掉即可(从助手的下一次请求起生效),或把声音档案馆从助手的配置里删掉。
App 不额外加一层自己的加密。转写、摘要与索引是放在你的音频旁边(或库文件夹里)的普通文件,你可以用任何工具打开、备份、搬走或删除。它们受到的保护和你 Mac 上其他文件一样:FileVault,以及 Apple 芯片上安全隔区内置的数据保护。没有一把 App 专属的密钥可丢,也没有任何东西可供我们留副本。
可以要求 Touch ID 或密码才能打开 App。这用的是 Apple 的 LocalAuthentication, App 接触不到任何生物特征数据。
Pro 是一次性应用内购买,完全由 Apple 通过 Mac App Store 处理。付款与凭据由 Apple 管理;App 只记录是否购买过。我们看不到你的姓名、支付方式或 Apple ID。
macOS 自身是否向 Apple 分享诊断数据,由你的系统设置和 Apple 的隐私政策决定,与我们无关——我们一条都收不到。
App 不收集任何人的任何个人数据,不分年龄。
如果未来某个版本要加入联网能力,本政策会在该版本发布之前修改、在更新说明里明示,并且那个权限用上面的命令就能看到。一个未先修改本政策就获得网络权限的版本是 bug——我们的发布流程被设计为拒绝构建它。