Security of Smardly Voice

This is a translation. In case of any difference, the Dutch version prevails.

Version: 8 November 2026 — replaces the version of 6 November 2026.

This page is about Smardly Voice, the app. For Smardly Cards and the account on smardly.com, see the privacy statement.

This document answers the questions a security officer asks before an employee may use Smardly Voice. It is meant to be forwarded. What it says has been checked against the app's source code (as of 5 November 2026) and against our privacy statement and data processing agreement. What we could not establish is stated as well.

How changes are tracked. Every substantive change gets a new date above and a line at the bottom under Changes. Earlier versions are kept; ask for them at the address under Contact.

1. What data exists and where it is

Data	Where it is	At Smardly?
Recordings (audio)	In the app's storage on the device. If iCloud is on, also in the user's private iCloud (see section 2)	No
Transcripts, summaries, action items, markers and speaker names	Same	No
Sender details for a report (name, company, contact lines, logo)	On the device; the text details also in iCloud if that is on. The logo only on the device	No
Pairing code of the optional recorder	In the device's Keychain, synchronised through iCloud Keychain	No
Purchase of a subscription	With Apple (App Store)	No

The app itself is covered by the privacy statement of Smardly Voice. The app has no Smardly account and does not ask for one. Smardly receives no recordings, transcripts or summaries from the app.

2. Does audio leave the device?

To Smardly or to a transcription service: no. Audio is turned into text and summarised on the device. The app contains no code that sends audio, text or summaries to a server of Smardly or of any other party for processing.

Transcription. The app tries three engines, all on the device: first the NVIDIA Parakeet model (runs locally through Core ML), then Apple's dictation models, then Apple's older speech recognition. For that last one "on device only" is switched on; if no on-device model exists for a language, the app shows an error instead of sending audio to a server.
Summarising. This uses Apple's language model on the device (Foundation Models). The app uses neither Private Cloud Compute nor any external AI service.
Fetching models. The speech models come to the device once from outside; no recording goes with them. Normally they arrive as an Apple asset pack (Background Assets). If that fails, the app can fetch them from Hugging Face. After that the app works without a connection.

To the user's own iCloud: yes. If iCloud is on for the device, the app synchronises recordings, transcripts and summaries through CloudKit's private database to that user's iCloud, so they appear on the user's other devices. That is storage with Apple under the user's account, not with Smardly. The app has a "Lokaal-only" ("local only") setting, but it does not currently stop that synchronisation: the app enforces the setting nowhere. Whoever wants recordings kept out of iCloud must turn iCloud off for the app in the iOS settings.

What the user shares. If the user shares a recording, a report or a PDF (the share menu, or an email the user sends), it goes to the recipient the user chooses. The app never does that on its own.

Other traffic. Beyond that the app only makes requests to Apple (App Store for the subscription, iCloud for synchronisation) and connects to the recorder (see section 4). The app has no network code of its own for statistics, advertising or error reporting.

3. Which third parties are involved

The device uses these parties directly; Smardly sits in between nowhere and receives no data from them:

Party	Purpose	What goes to it
Apple (iCloud, CloudKit)	Synchronisation between devices of the same user	Recordings and text, under the user's iCloud account (see section 2)
Apple (App Store)	The subscription	The user's purchase
Apple (Background Assets and speech models)	Fetching the speech models	Nothing from the user; models come in. What every internet request sends along, such as the IP address, is visible
Hugging Face	Fetching the speech models if the route through Apple fails	A request for model files, without a recording, text, account or device ID; what every internet request sends along, such as the IP address, is visible. The region has not been established

The only external software library in the app is FluidAudio (Apache 2.0 licence), which runs locally on the device.

We have not established the region of processing for Hugging Face. We therefore do not claim that all processing takes place in the European Union.

4. Encryption

In transit, app. The app itself makes no connection to Smardly. For iCloud and the App Store, Apple's measures apply.
Recorder. The optional recorder connects directly to the device over Bluetooth Low Energy. The app adds no encryption of its own on top. We have not established what protection the recorder's own protocol offers.
At rest, on the device. The app adds no encryption layer of its own; recordings sit in the app's storage, as the operating system manages it.

5. Retention and deletion

Recordings and text in the app. They stay as long as the user keeps them. If the user deletes a recording in the app, it disappears from the app's storage. Smardly has no copy and so cannot delete anything. Removing the app itself does not automatically remove what is in iCloud; the user manages that in their iCloud settings.

6. Who at Smardly can see what

Recordings, transcripts and summaries: nobody. They are not with us.

7. Signing in

In the app: there is no sign-in. The subscription runs through the App Store. The app asks for no Smardly account and stores no password.

8. Data processing agreement

Are recordings covered by a data processing agreement with Smardly? No. Recordings, transcripts and summaries are not covered, because Smardly does not process them (article 3.4).

9. Data breaches

Reporting to us: email the address under Contact right away.
Recordings cannot leak from us, because we do not have them.

10. What Smardly does not have

Smardly has no ISO 27001 certification and no SOC 2 report, and our systems have not been penetration tested by an external party. For Hugging Face, where the app can fetch the speech models as a fallback, we have not established the region of processing. What there is, is in this document: the audio does not go to Smardly or to a transcription service, and Smardly stores no recordings.

11. Contact

For questions about security or a data breach: [email protected].

Smardly BV, Overhoven 5, 6136 EA Sittard, the Netherlands, Chamber of Commerce number 80435602.

12. Changes

8 November 2026: this document now covers only the Smardly Voice app. Removed is what concerns Smardly Cards and the account on smardly.com: the table of the platform's sub-processors (section 3), the account data (sections 1, 5, 6), signing in on smardly.com, SSO and two-step verification (sections 7 and 10), the encryption of the website (section 4), how a data processing agreement comes into being (section 8) and the notification period towards a Team customer (section 9). For those, see the Smardly Cards privacy statement. Nothing has changed in substance about the app. The numbering of the sections is unchanged.
6 November 2026: address of Smardly BV corrected; the references to the privacy statement now point to the Smardly Cards statement, and a reference to the Smardly Voice privacy statement has been added. The rows about fetching models now also state what an internet request sends along, and the Voice statement names the same parties.
5 November 2026: first version.

Other documents. Privacy statement Smardly Voice · Privacy statement Smardly Cards and the account on smardly.com · Data processing agreement

Terms and conditions
Privacy statement Smardly Cards
Privacy statement Smardly Voice
Data processing agreement Smardly Team