Privacy policy.

The short version

Silo Scribe collects no data, and no patient information ever leaves your Mac.

No analytics. No telemetry. No account. No personal data. No usage metrics. No error beacons. No advertising IDs. No fingerprinting. No crash reports sent over the network. Silo Systems runs no server, and the app sends Silo Systems nothing about you, your device, your clients, or your sessions. Apart from Apple's own App Store services (purchase verification and the optional rating prompt), the app's only network use is the optional model downloads you approve, described under Network use below.

Everything Silo Scribe does (recording, transcription, speaker labeling, note drafting, editing, and export) runs entirely on your Mac. Transcription uses Apple's on-device Speech framework or, if you choose it, a locally stored speech model. Structured drafts use a locally stored Gemma 4 E2B open-weights language model running through mlx-lm on Apple Silicon. Silo Scribe sends no session content to any cloud service, and there is no Silo Scribe account.

A documentation tool, not a medical device

Silo Scribe is a documentation and productivity tool. It is not a medical device. It does not diagnose, does not recommend treatment, does not make automated risk assertions, and does not assign CPT or ICD codes. It drafts a structured note from a session you recorded. The clinician reviews, edits, and marks each note Verified — you author and are responsible for every note. Silo Scribe is a drafting assistant, nothing more.

What we don't have, and therefore never see

Because Silo Scribe has no server-side component, the following do not exist anywhere in our infrastructure (and our infrastructure consists of: nothing):

• Your name, email, phone, or address.
• Any information about your clients or patients.
• Your IP address, device identifier, MAC address, or any other hardware fingerprint.
• The audio you record, the transcripts Silo Scribe produces, the notes it drafts, or any file you export.
• The contents of your Documents, Downloads, Desktop, or any other folder.
• Session timing, feature usage, button clicks, or any other behavioural data.
• Crash reports. Silo Scribe does not send crash reports over the network.

The app never sends any of this to us, and it never contacts a Silo server. Silo Scribe's PrivacyInfo.xcprivacy manifest declares zero tracking and no data collected.

On-device processing

When you record a session, the audio is transcribed on your Mac by Apple's on-device Speech framework, or by the optional local speech model if you selected it. Speaker labels come from an offline estimate, or from the optional high-accuracy speaker model if you turned it on, and you can correct any of them. When you generate a note, the local Gemma 4 E2B language model, running through mlx-lm on your Apple Silicon GPU, drafts the structured note. None of this leaves your machine. There is no cloud inference, no remote transcription service, and no third party in the loop.

The note-generation helper is not a network service

Silo Scribe uses a small local helper process to perform note generation. The app and the helper communicate over a Unix-domain socket — on-device inter-process communication (IPC) confined to your Mac. It is not bound to any network interface, accepts no external connections, and is not reachable from your network or the internet.

Encryption at rest

The note bodies and reusable note tools you create are encrypted at rest with AES-GCM, using an encryption key stored in your Mac's Keychain. Your sessions, transcripts, notes, and preferences live inside the app's App Sandbox container on your disk (plus any folder you explicitly choose to export to). Session audio and transcript text are not encrypted by Silo Scribe, so that they can be replayed and searched; they stay inside that container, where macOS FileVault protects them if you have it turned on. They are yours. We do not have access to them. Deleting Silo Scribe removes the app; your work remains under its container until you delete it manually.

Dot phrases and custom note structures contain only wording and headings you author, remain local and source-visible, and are never used to add diagnosis, CPT/ICD codes, treatment recommendations, or automated risk assertions.

Microphone & Speech permissions

Silo Scribe asks for two macOS permissions, and both are used only after you start a recording or choose in-app dictation from the Transcription menu. Neither sends anything off your Mac:

• Microphone. To capture the session, or your dictation, through your input device once you start it.
• Speech recognition. To run Apple's on-device Speech framework against that audio so it can be transcribed locally. Transcription happens on your Mac.

Network use

Silo Scribe's only network use is optional model downloads that you approve first, each from Hugging Face. There are three, and each is fetched only after you ask for it: the note-generation model (about 3.6 GB); the Qwen3-ASR speech model (about 1 GB), if you choose the Local MLX transcription engine instead of Apple Speech; and the speaker-labeling model (about 15 MB), if you turn on high-accuracy speaker labeling. For the note and speech models, the app verifies the pinned revision and every declared file with SHA-256 before loading it. The speaker-labeling model is fetched as the latest version its publisher has posted and is not checksum-pinned by Silo Scribe. Once you turn speaker labeling on, that approval stands: if its model is later missing or fails to load, the app can download it again during a later transcription without asking again. Each download is anonymous by default (no token, account, or registration is required); like any download, it reveals your IP address to Hugging Face. Each model can be removed again in Settings; turning high-accuracy speaker labeling off deletes its model. No session audio, transcript, or note is ever sent during a download; only model files come down, and once the models you chose are on disk, recording, transcription, speaker labeling, and note drafting run fully offline. Apart from this, the only other traffic your Mac may originate while Silo Scribe runs is between your Mac and Apple (App Store purchase verification, rating prompts, and updates) and any external links you click (handled by your browser). None of it goes to Silo Systems.

Children's privacy & not a medical device

Silo Scribe is a professional documentation tool intended for clinicians and therapists, not for use by children, and it is not a medical or diagnostic device. Because no personal data is collected from any user, no special treatment is required for any age group: the policy is the same regardless of who is using the app: nothing collected, and no session content transmitted. Silo Scribe does not diagnose, does not recommend treatment, does not make automated risk assertions, and does not assign CPT or ICD codes; the clinician authors and verifies every note.

Third-party services

Silo Scribe uses these components and public services. None of them receive any data about you, your clients, or your sessions from Silo Scribe:

• Apple Speech framework (on-device speech-to-text) — runs locally on your Mac.
• Gemma 4 E2B (open-weights instruction-tuned language model) — runs locally via mlx-lm.
• Qwen3-ASR 0.6B (optional open-weights speech model, Apache-2.0) — runs locally via MLX when you choose the Local MLX transcription engine; removable in Settings.
• MLX (Apple's on-device array/ML framework) — runs locally.
• FluidInference speaker-diarization model (optional, CC BY 4.0), run through FluidAudio: used only after you turn on high-accuracy speaker labeling. It runs locally, and turning the option off deletes it.
• Hugging Face Hub: contacted only with your consent, to download the optional note-generation, speech, and speaker-labeling model files. No clinical content is sent.

Changes

If we ever materially change how Silo Scribe handles data — for example, if a future version of the app ever begins to collect anything at all — we will publish an updated version of this page, announce the change prominently in the release notes, and require explicit consent in-app before any new collection begins. The effective date at the top of this document reflects the current policy.

The current policy is: nothing is collected, and no PHI leaves your Mac.

Contact

Questions about this policy: support@ohmslaw.net