Verify it yourself

Last updated: 8 July 2026 · Applies to Sopravo 1.0

1. What "on-device" means here, precisely

Recording uses the iPhone microphone APIs. Transcription runs on Apple's on-device speech models. Speaker separation runs local open-source ML models (pyannote/WeSpeaker via FluidAudio). Summaries are written by Apple Intelligence's on-device foundation model (iPhone 15 Pro or later). None of these steps sends audio or text anywhere. The app works with no account — there is nothing to sign in to.

We do not claim "the app makes no network requests." That would be false for any app with App Store billing. The honest claim is narrower and stronger: your content is never in any request. Here is the complete list of what is.

2. Every host Sopravo can contact

Host	Purpose	When	What it carries
api.revenuecat.com	Subscription / purchase state (RevenueCat)	App launch, purchase, restore	A pseudonymous purchase identifier and entitlement state. No account, no name, no content.
eu.i.posthog.com	Anonymous product analytics (PostHog, EU)	Only while "Share anonymous analytics" is ON	The events in section 3 — scalar values only. No person profiles (personProfiles: never), IP masked server-side.
*.ingest.de.sentry.io	Crash reports (Sentry, EU)	Only while "Share anonymous analytics" is ON, after a crash	Stack trace, device model, OS version. sendDefaultPii is off. Never content.
lifetime.sopravo.app	The founder-lifetime counter on the paywall	When the paywall is shown	A GET that receives one public number (seats left). Sends nothing about you.
Apple (*.apple.com, iCloud/CloudKit)	App Store billing; optional backup to your own private iCloud database	Purchase flows; backup only if you enable it	Billing is Apple's, we never see payment details. The private CloudKit database is readable by your Apple account only — the developer cannot access it, by design of the platform.

That is the whole list. In particular there is no Sopravo content server: no host exists that could receive your audio or text.

3. The exact analytics events

Analytics is limited to a small set of hand-defined events. Event properties are restricted to safe scalars by construction (the event type cannot carry free-form text), so content cannot leak in even by mistake. Events share a random per-install identifier (so unique installs can be counted); no person profiles are ever created (personProfiles: never) and the IP address is masked server-side. Separately from the custom properties below, the SDK adds its standard technical envelope, such as app and SDK version, operating-system and device context, locale and time-zone context, and that random installation identifier. The current App Store version emits:

Event	Properties
paywall_shown	—
trial_started	plan (weekly / monthly / yearly / lifetime)
purchase_completed	plan (same categorical values)
restore_completed	—

The next update adds the following, defined with the same closed-scalar discipline — published here before they ship, so this page never trails the app. Note what is not in this list: no screen views, no session recordings, no automatic lifecycle capture, and no automatic tap or "rage click" detection — the analytics SDK ships that one switched on by default, and the app switches it off. Every event below is one we wrote by hand, and every property is a fixed set of values or a yes/no flag, so free-form text cannot enter one even by mistake.

Event	Properties
app_opened	is_first_launch (true / false)
device_capability	summary_availability (available / device_not_eligible / ai_not_enabled / model_not_ready)
onboarding_started	—
onboarding_step_reached	step (showcase_record / showcase_intelligence / showcase_capture / showcase_organize / showcase_privacy / permissions / value_moment)
onboarding_showcase_skipped	from_step (the same closed onboarding step values; one event per install)
paywall_backgrounded	trigger (same five values as paywall_shown below)
mic_session_started	—
mic_session_finished	duration_bucket (under_1m / 1_to_5m / 5_to_15m / 15_to_60m / over_60m — a coarse bucket, never the exact length) and saved (true / false)
pipeline_finished	outcome (categorical: summary_ready, transcription_failed, … — never transcript text)
first_summary_completed	—
ui_stuck	screen (record / library / actions / settings / meeting_detail / paywall / onboarding / app_lock), plus step only for onboarding (showcase_record / showcase_intelligence / showcase_capture / showcase_organize / showcase_privacy / permissions / value_moment)

The same update adds trigger to the existing paywall_shown, recording which entry point opened it (first_run / launch_gate / record_cta / import_cta / settings). That event and trial_started also carry summary_availability (available / device_not_eligible / ai_not_enabled / model_not_ready) and device_eligible (true / false), describing only the device's on-device-summary capability. These properties say nothing about you and nothing about your recordings.

ui_stuck is an exploratory rapid-tap proxy, not a claim that the interface failed. The app emits it after at least five taps whose newest and oldest timestamps are no more than two seconds apart and which all land within 60 points of the first tap, followed by a 60-second in-memory cooldown for that screen. The in-progress tap window resets whenever the onboarding page changes, while the onboarding cooldown remains shared. Legitimate rapid controls can still create residual noise. Coordinates, tap count, interval, and timing never leave the phone; meeting_detail deliberately does not reveal whether Summary, Transcript, or Actions was visible. This detector is app-owned and hand-defined; the SDK's automatic tap and rage-click detection remains off.

Opting out: Settings → Privacy & Data → turn off "Share anonymous analytics." With the toggle off, the PostHog and Sentry SDKs are never started on the next launch — not muted, not sampled: zero requests to either host. That is test 3 below.

4. Test 1 — Airplane mode (2 minutes, no tools)

1. Enable Airplane Mode (Wi-Fi off too).
2. Record a short meeting in Sopravo.
3. Watch it transcribe live, separate speakers, and (on iPhone 15 Pro or later with Apple Intelligence enabled) write the summary with action items.

Everything works end to end with no network at all, because nothing about the pipeline needs one. An app that uploads your audio for processing cannot pass this test.

5. Test 2 — Watch the traffic with a proxy (15 minutes)

1. Install an HTTPS-inspecting proxy — Proxyman, Charles, or mitmproxy — and trust its certificate on the iPhone.
2. Use Sopravo normally: record, transcribe, open the summary, export a PDF.
3. Compare the captured hosts against the table in section 2.

What you will see: small JSON requests to RevenueCat, and (if analytics is on) the section-3 events going to PostHog. What you will not see: any request carrying audio, transcript text, summary text, or anything sized like them. If you ever observe traffic that contradicts this page, please email [email protected] — that would be a bug, and we will treat it as a severity-one incident.

6. Test 3 — The opt-out is real

1. Settings → Privacy & Data → turn off "Share anonymous analytics."
2. Force-quit and relaunch the app with the proxy from test 2 running.
3. Observe: no connection to eu.i.posthog.com or *.ingest.de.sentry.io — the SDKs were never initialized.

7. Why the iCloud backup doesn't weaken the claim

Optional backup uses CloudKit's private database, which lives inside your own Apple account. Apple's platform design gives the developer no API to read a user's private database — we could not fetch your backups even if we wanted to. Turning backup off keeps everything solely on the device.

8. Corrections

This page is a factual, versioned claim about app behavior. If an app update changes any row of the table above, this page changes in the same release. Found an inaccuracy? [email protected].