WaveType Privacy
Overview
WaveType has no telemetry or speech-upload path in the reviewed application source. Speech recognition runs locally using Parakeet. Optional Smart cleanup uses Qwen through an authenticated server bound to 127.0.0.1.
Local Processing and Network Connections
Speech recognition uses Parakeet locally.
Optional Smart cleanup uses Qwen through an authenticated server bound to 127.0.0.1.
The engine's authenticated inter-process communication (IPC) also listens only on 127.0.0.1.
After installation, the app downloads missing model weights and optional Qwen runtimes over HTTPS from Hugging Face and GitHub and verifies pinned SHA-256 hashes. New Windows builds include a pinned Parakeet runtime DLL in the installer; source runs can download its pinned archive. On Windows, the downloader uses the operating system's certificate-chain validation through truststore, while HTTPS verification remains enabled. Parakeet starts on first launch; Qwen downloads only when selected in Settings. Pausing retains a partial download; canceling removes it.
These download services receive ordinary connection information, not dictation.
Installed builds can also check GitHub Releases for app updates. Automatic checks and downloads are off by default. A manual check or enabling automatic updates sends an HTTPS request to GitHub; installer downloads stay in the local app data folder and are checked against the release SHA-256 file. No dictation audio or text is included in update requests.
Browser links open only when selected.
Dictation works offline after the required files are installed.
An application receiving inserted text may independently send or synchronize it.
For Notepad insertion, WaveType temporarily places the final text on the Windows clipboard, uses the Windows format that excludes it from clipboard history and cloud synchronization, and restores the prior clipboard formats and bytes after paste. Clipboard data is held in memory only. If a format cannot be preserved, WaveType leaves the clipboard untouched and reports an insertion error; the final text stays in local History. Other apps continue to receive Unicode key input without using the clipboard.
Microphone and Data Storage
When an input device is available, the microphone remains open while the engine runs to maintain a short pre-roll in memory. The app can still open Settings if no microphone is available. Recorded clips and inference buffers stay in memory.
History stores only the following information:
Date and time
Final text
Foreground process name for dictation, or Assistant for Assistant commands
Personal dictionary files, history, and saved shortcut nicknames and targets are stored as local JSON and are not encrypted. Installed builds keep shortcuts in %LOCALAPPDATA%\STTCore\shortcuts.json; source runs use an ignored shortcuts.json beside the source code. Shortcuts are kept on uninstall unless Also delete all local data is selected.
The keyboard hook handles Ctrl+Win and, when Assistant is enabled in Settings, Ctrl+Shift+Win. Ordinary keystrokes are not written to a key log. Assistant speech is transcribed locally without Smart cleanup or text insertion. Its final text is saved in local History with Assistant as the source, never the foreground app name; empty transcripts are not saved. A complete open <nickname> command launches a saved local app, opens a saved local folder in Explorer, or passes a saved HTTP or HTTPS URL to the Windows default browser. The browser may contact that website according to its own settings; WaveType does not fetch the page or check whether it loaded.
Local Data and Uninstallation
Installed-app data lives in %LOCALAPPDATA%\STTCore.
Individual history entries can be deleted in History.
Uninstallation keeps models, partial downloads, preferences, dictionaries, history, and diagnostic logs by default. Reinstalling restores this data.
Select the unchecked “Also delete all local data” option during uninstall to remove the canonical %LOCALAPPDATA%\STTCore folder for a fresh start. Directory links are not followed; any failure is reported and the uninstall entry remains available to retry. Custom data locations are not removed. Silent uninstall keeps data unless /REMOVE-DATA is explicitly supplied.
Settings offers separate deletion for Parakeet and Qwen, including each model's downloaded runtimes, cached archives, partial files and verification records. Qwen includes both CPU and GPU runtimes. Deleting Qwen turns off Smart cleanup; deleting Parakeet prevents dictation until downloaded again. Personal data and the other model are kept. Pause, cancel and deletion intent are stored locally and survive restarting the app.
Exit WaveType from the tray before install, upgrade or uninstall. Setup checks file access and asks you to retry if files remain in use. Exiting stops active recording without inserting unfinished speech, releases the microphone and stops model workers and owned cleanup processes.
Source runs keep personal dictionaries, shortcuts, models, and history in ignored repository folders instead.
Release Security and Validation
The release build rejects bundled models, WAV recordings, JSONL history, personal dictionaries, saved shortcuts, endpoint tokens, and signing-key files. It produces a file manifest containing SHA-256 hashes.
This verifies package contents. It is not a complete audit of upstream native binaries or proof based on network capture.
This first prerelease has not undergone clean-VM testing, Microsoft Defender validation, or runtime network-capture testing. Trusted code signing remains pending.
No antivirus exclusions or changes to Windows protections are required or recommended.