I believe quite a few readers have probably already tried what we introduced before Typeless Voice Text Input Softwareits extremely fast recognition speed, powerful AI Features like auto-correction and formatting have made it popular with many users. However, if you are someone who values privacy, you may want to consider whether to continue using it.
Recently, a Japanese engineer, through reverse engineering analysis, discovered that Typeless There are serious privacy risks, including 100% cloud-based voice processing, extensive data collection, all data stored locally, excessive permission requests, and low company transparency.
More importantly, it also has keyboard logging capability.
Japanese engineer: Typeless’s voice processing is all on the cloud, marketing claims are misleading
Recently, a Japanese engineer @medmuspg warned on social media that people should avoid using Typeless as much as possible, as it poses serious privacy risks.
@medmuspg Conducting an in-depth technical analysis of Typeless v0.9.3 for macOS through reverse engineering methods, including binary analysis, network packet monitoring, local database inspection, and native library string analysis, to understand the actual operation mechanisms of this software.
According to him, besides checking whether the application contains a local speech recognition model, they also observe the software’s actual network transmission behavior.
It turns out there are no local speech recognition models like Whisper in the app—all audio data is first compressed and then sent to AWS cloud servers for processing.
Although official sources do mention real-time processing on cloud servers, the marketing emphasizes “On-device history” and “Zero data retention,” which can easily mislead users into thinking that voice processing is done locally—this is misleading.
What data might Typeless collect?
If it’s just simply uploading audio to the cloud for speech-to-text, that’s actually not a problem—there are plenty of similar services available. But what truly sparks controversy is that the scope of data it may collect could far exceed the audio itself.
Based on the analysis results, Typeless has the following data access capabilities:
- Full URL of the page you’re viewing (including Gmail, Google Docs, and similar pages)
- Active application and window title
- Text content visible on the screen (accessed via the macOS Accessibility API)
- Clipboard read/write permission
- System-level keyboard input monitoring
- Browser DOM Element Information
- User-edited text content
Additionally, he discovered that the local database typeless.db stores speech recognition results, browsing URLs, and application information in plaintext, and that audio files are not fully deleted either. This creates a clear discrepancy with the “Zero data retention” claim.
In terms of permissions, Typeless requires not only microphone access but also screen recording, camera, Bluetooth, and accessibility permissions, even requesting the built-in screenshot feature. For a voice input app, this scope of permissions is clearly excessive.
The biggest controversy: keyboard logging capability
Most notably, Typeless has technical capabilities equivalent to a keylogger.
The reason lies in the combination of three features:
- CGEventTap (system-level keyboard monitoring)
- Accessibility API (reads screen text)
- Clipboard access permissions
By combining these three, they can theoretically monitor user input, read on-screen text information, and even capture copied and pasted data.
Although @medmuspg has not accused Typeless of necessarily using these capabilities maliciously, he reminded all users that from a technical standpoint, keyboard logging functionality is already achievable.
Company transparency issues
In addition to the above, there is currently very limited operational information available about Typeless:
- Corporate Name Not Disclosed in Terms of Use and Privacy Policy
- Only mention “San Francisco County, CA” as the jurisdiction
- Domain WHOIS Data Privacy
- No mention of security certifications such as SOC 2 or ISO 27001
- Only a single email address is provided for contact.
For software that requests so many permissions and transmits data to the cloud, company transparency is a crucial trust indicator.
@medmuspg also at the end urged to delete Typeless immediately, and if you must use it, recommended using firewall tools to monitor its network connection behavior to keep track of data transmission.
It also provides several alternatives, such as:
- Whisper.cpp or MLX Whisper (open-source, runs entirely offline)
- Built-in voice dictation on macOS (on-device processing with Apple Silicon)
- Superwhisper (based on Whisper technology, but still requires your own evaluation)
Source: KOCPC Chinese