How to see what data a voice recorder app sends on iPhone

Two different questions get asked as if they were one. "Does this app have access to the microphone" is about permission — a toggle you granted once, visible in Settings at any time. "Does this app send anything anywhere" is a separate question about behaviour, and a permission screen cannot answer it. An app can hold a permission for years and never once act on it, or hold one and use it constantly. The App Privacy Report is the part of iOS built to answer the second question with something closer to evidence than a claim.

What the App Privacy Report actually is

It is a rolling log, built into iOS since 2021, of two kinds of thing per app: which of the sensitive data categories it accessed — microphone, location, contacts, photos and the rest — and which network domains it contacted while doing so. Nothing about it is specific to any one app or developer; it is Apple watching every app on the phone the same way and keeping the results for you to read, not for anyone else.

It is off by default and has to be turned on once. From that point it covers a rolling seven days, so it tells you nothing about the week before you enabled it — this is a going-forward tool, not an audit of the past.

Turning it on

• Open Settings → Privacy & Security → App Privacy Report.
• Tap Turn On App Privacy Report.
• Use the phone normally, including the app you want to check, for at least a few minutes and ideally a few days.
• Come back to the same screen to read what accumulated.

That is the whole setup. Nothing about it requires the app being checked to cooperate, because it is the operating system doing the watching, not the app reporting on itself.

Reading an entry for one app

Tap an app in the list and two sections matter most. Data & Sensor Access shows which categories it read — microphone, location, and so on — and roughly when, each time it happened. App Network Activity is the more revealing one: every domain that app contacted, listed by name, with a timestamp for the most recent contact. A recorder app with a microphone entry every time you record is expected and unremarkable. A recorder app whose network activity list contains a domain you do not recognise, at a time that lines up with something you did in it, is worth a second look.

There is a third list worth knowing about too — Most Contacted Domains, which ranks across every app on the phone rather than one at a time. It is a good way to notice a domain that keeps turning up under several unrelated apps, which usually means a shared analytics or advertising service rather than anything belonging to a single developer.

What counts as expected versus worth questioning

Context does most of the work here. A domain ending in apple.com or icloud.com next to a Speech-related app is Apple's own infrastructure, not a third party — dictation and server-side speech recognition have always run through Apple's own servers, for every app that uses the system frameworks, including Apple's own apps. A domain you do not recognise, especially one that reads like an analytics or advertising service rather than the app maker's own name, is the entry worth pasting into a search engine before assuming the worst or dismissing it. Not every unfamiliar domain is a problem — plenty are crash reporters or content delivery networks doing unglamorous, genuinely limited jobs — but "I do not recognise this and the app never explained why it is there" is exactly the situation this report exists to surface.

What it can tell you, and what it cannot

It logs that a connection to a domain happened, not the contents of what was sent. It cannot tell you whether the payload was a full recording, a single diagnostic ping, or nothing but a version check. What it gives you instead is something narrower and still useful: proof that a connection happened at all, and to where, and roughly when. For an app that claims a specific behaviour — "nothing leaves your phone", "transcription runs locally" — the presence or absence of any network activity for that feature is a checkable fact, not a claim you have to take on trust.

It also will not catch anything from before you turned it on, and it only logs what happened while you were actually using the app during the window it covers. Checking it once, right after installing something, and seeing nothing, mostly tells you that you have not used the app yet.

A companion to testing in Airplane Mode, not a replacement

There is a more immediate test for one specific question — did this particular transcription use the network — and it does not require turning anything on in advance: switch on Airplane Mode, run the transcription, and see whether text comes back. If it does, nothing could have been sent, because there was no connection available to send it over. That test is covered in more detail in the companion guide on on-device versus cloud transcription. The two methods answer slightly different questions: Airplane Mode proves one specific attempt stayed local; the App Privacy Report shows you a standing, cumulative record without your having to remember to test anything, and it covers every kind of network activity an app has, not just transcription.

How Voice Studio handles it

Voice Studio has no account, no server of its own and no analytics SDK, so there is nothing routed through infrastructure that belongs to us to begin with — checking its entry in the App Privacy Report will not turn up a domain with our name on it, because none exists. The one place a domain can appear at all is Apple's own speech service, and only on the recordings where the on-device transcription pass came back empty or errored and the app retried with on-device recognition turned off. That is the same fallback described in the on-device versus cloud transcription guide, and it is exactly the kind of claim this report is built to let you check rather than take on faith: turn it on, transcribe a few things over a few days, and see for yourself what shows up.

Common questions

Does the App Privacy Report work retroactively, for before I turned it on?

No. It only logs activity from the moment you turn it on, and covers a rolling seven days from there. It has nothing to say about anything that happened before you enabled it.

If an app shows no network activity, does that prove it sent nothing?

Only for the period you actually used it while the report was on. If you never opened the app during that window, an empty list just means it was not used, not that it was tested and passed.

What should I do if I see a domain I do not recognise?

Search the domain name before assuming the worst. Many unfamiliar domains turn out to be crash reporters or content delivery networks with a narrow, unglamorous job. The App Privacy Report tells you a connection happened; it does not tell you what was in it.

Does Voice Studio ever show its own domain in the App Privacy Report?

No. Voice Studio has no account, no server of its own and no analytics SDK. The only domain that can appear belongs to Apple's speech service, and only when the on-device transcription pass failed and the app retried with on-device recognition off.