Privacy · the app

What the app does on your Mac.

The audio of your calls is transcribed on your own machine and is never uploaded. What does leave the machine is text — the question, the part of your materials that answers it — because that is what a model has to read to answer. This page says exactly what leaves, when, and to whom.

Last updated 14 September 2026

This covers the Tiho app on your Mac. The website and its waitlist have their own policy. Tiho is not publicly released yet: today it runs on a small number of machines by invitation, and this page is written to be true of the build those testers have.

Who is responsible

Tiho is run by Yuri Varshavsky, an individual entrepreneur (ФОП) registered in Ukraine, acting as the data controller. For anything on this page — a question, a correction, a deletion — write to privacy@tiho.dev.

The promise, and how to check it

Audio never leaves your Mac. Both sides of a call are transcribed by whisper.cpp running as a local process on your own machine, reachable only at 127.0.0.1. No recording, no audio stream and no fragment of either is sent anywhere, to us or to anyone else.

This is meant to be verified rather than believed. Point a network monitor at Tiho during a call — Little Snitch, or nettop, which ships with macOS — and you will see requests to whichever model answers, and nothing carrying audio.

Audio is not written to disk either. The app keeps text. There is one developer switch that dumps call audio to a folder, used for comparing speech models; it is off unless someone has explicitly set it, it announces itself in the log every time a call starts while it is on, and it is the only thing in Tiho that ever writes a recording.

What stays on your Mac

Everything Tiho keeps lives in ~/Library/Application Support/Tiho, in files only your account can read (mode 0600, in a folder at 0700):

• Your calls — one append-only file per call holding the transcript, the questions you asked and the answers, and next to it the note as plain Markdown.
• The speech model downloaded on first run, and the choice of which tier your Mac can keep up with.
• Your settings, including any API key you chose to put there.
• Your licence, if you have one, and the Telegram delivery token, if you connected Telegram.
• Your glossary, if you wrote one — the names and terms you want spelled correctly.

None of it is synchronised anywhere. Deleting a call is deleting two files; deleting Tiho's folder removes everything it has ever kept. There is no account to close, because there is no account.

What leaves your Mac

Answering a question means sending it to a model, and there is no version of that which keeps the text at home. What is sent, each time you ask:

• Your question — the part of the call you asked about, or what you typed.
• Your materials — the pack you armed for this call, which is whatever files you pointed Tiho at.
• The recent transcript of the call, so the answer is about what is actually being discussed.
• A screenshot, only when you ask for one. The screen-question hotkey captures the window you are looking at and sends that image with your question. It is deleted from disk as soon as it has been sent. Nothing is captured unless you press that key.

It goes to Anthropic, and to OpenAI if the first attempt fails and you have configured a key for it. Both are processors for this purpose, and their own terms govern what they do with an API request.

Whether it passes through us

Two routes, and you can tell which one you are on by whether you put an API key in your own settings:

• Your own key. The request goes from your Mac straight to Anthropic. Tiho's servers are not involved and see nothing.
• A Tiho licence. If you have no key of your own, the request goes through a proxy we run at tiho.dev, which holds the key instead of you. The text passes through our server on its way to Anthropic.

On that second route: we do not store what passes through. Request and response bodies are never written to disk and never logged. What is recorded is one line per answer — which licence, which model, how many tokens, what it cost — so that a spending limit can exist at all. That line contains no part of your question, your materials or the answer.

The calendar, if you allow it

Tiho can read the calendar event a call belongs to, which is how a note knows what the meeting was and who was on it. This is optional and refusable on its own: refuse it and everything else works, the call is simply filed without a title or names.

What happens with it is deliberately split:

• The attendees' names are used locally, to tell the speech model how those names are spelled. They do not leave your Mac for that.
• The meeting's title and the attendees' email domains — the part after the @ — are sent with the end-of-call summary, so it can work out which of your projects the call belonged to. The domain is what identifies an organisation; the part before the @ identifies a person, and it is not sent.
• The full addresses stay on your Mac, in the call's own record.

Telegram, if you connect it

Tiho can deliver answers to you on Telegram, which is what makes it usable with the panel hidden. Connecting it through the built-in bot means the text of those answers passes through our server on its way to Telegram; it is not stored there and not logged. You can instead point Tiho at a bot of your own, in which case the text goes from your Mac straight to Telegram and we see none of it. Either way, nothing is delivered anywhere until you connect it.

Notion, if you connect it

Tiho can push a finished call to a Notion database — the note, and the call's date, participants and project. This exists because a file on your Mac cannot be shared with a colleague and a Notion page can, and it is off unless you configure it: without a token and a database, nothing is sent and the app never mentions Notion.

When it is on, the call's note and its full transcript are created as a page in your own Notion workspace, under your own credentials, and Notion's terms govern it from there. Tiho only ever creates: it never reads a page back, never updates one and never deletes one, so anything you change in Notion afterwards is untouched. Turning it off is removing the token; pages already created stay where they are, because they are yours.

The other people on the call

A transcript is a record of what other people said, and they did not install anything. Tiho is built so that the recording stays yours — the audio never leaves your machine and the transcript lives in your own folder — but the law where you are may still require you to tell the room that you are keeping a record. Tiho reminds you of this at the start of each call, in the panel and nowhere else, with a sentence you can say out loud. Whether to say it is your decision and your responsibility.

What Tiho does not do

• No telemetry, no analytics, no crash reporting. There is no analytics library in the app at all — not disabled, absent. The only network destinations it has are the model that answers, Telegram if you connected it, the download of the speech model on first run, and its own licence check.
• No profile. Nothing about your calls, your materials or your usage is collected anywhere outside your own machine.
• No cloud transcription, not as an option and not as a fallback.
• No training. Nothing you say or write is used to train anything, by us or by anyone on our behalf.

What it asks macOS for, and why

• Microphone — your side of the call.
• Screen & System Audio Recording — the other side. It is the audio that is captured, not a picture of your screen.
• Accessibility and Input Monitoring — so one key can ask a question while another app is in front.
• Calendars — optional, above.

Your rights

Because the app keeps its data on your own machine, most of these you exercise directly: the files are yours to read, copy, edit and delete. For anything held on our side — the spending record tied to a licence, or a licence itself — write to privacy@tiho.dev and it will be shown to you or deleted. If you are in the EU or the UK, the lawful basis for that record is the performance of the agreement that gave you the licence.

Changes

This page carries the date it was last changed. While Tiho is in testing, anyone holding a licence is told by email when something on it changes materially.

This policy is published in English only. The rest of the site is translated; a legal text is not, because a machine-translated version would create obligations nobody has read.