Howl privacy

This page describes what the Howl app, Howl Cloud and this website handle, as of November 5, 2026.

The app

Your voice becomes text on your Mac with Apple’s speech recognition. Recordings are never sent off your Mac.
To clean up a dictation, Howl sends the transcript, the app and window names and an image of the window you’re in (at most 1,600 pixels on the long side) to the route you chose: the AI provider of your own API key, Howl Cloud, or the local model on your Mac. If selected-text context is turned on, the selected text (up to 2,000 characters) goes too.
Copy translation sends only the text you copied.
In password managers (Keychain Access, Passwords, 1Password, Bitwarden and others), Howl doesn’t read the screen or selected text.
Until a dictation is typed, its recording, text and destination are kept encrypted on your Mac so it can be inserted again. They’re deleted once delivery is confirmed; entries that were never typed stay until you delete them.
API keys and the Howl Cloud sign-in are stored in the macOS Keychain.
Howl collects no usage analytics. Once a day it fetches the latest version information from sayhowl.com, and when you open the API key settings it fetches the recommended model list. Howl adds no identifiers to these requests.

You sign in with a code sent to your email. The server stores your email address, sign-in sessions and a daily count of requests.
Requests are passed to Google Gemini and are not stored or logged. Server logs record the request status, duration and usage count.
To limit sign-in attempts, the server stores a keyed hash (HMAC) of your IP address.

If you request a Howl Cloud invite, we store your email address, the page language and the time, and use them only for the invite.
The request goes through Cloudflare Turnstile to block automated sign-ups, which sends your IP address to Cloudflare.
The site uses no analytics scripts. The language you pick is saved only in your browser.
Fonts load from jsDelivr, and the Vietnamese page also loads Google Fonts.