Trust and privacy
Ambient should be easy to understand before you install it.
The important trust answer is simple: Ambient handles short clips locally, not full recordings, and it gets out of the way when your Mac is active again.
The three trust questions
What runs, what stays hidden, and when it stops.
What runs on my Mac?
A local worker that transcribes short clips with Apple Silicon acceleration and returns text results.
What stays hidden?
Your Mac does not receive a full conversation, customer identity, or the final merged transcript.
When does it stop?
Ambient is designed for idle, plugged-in windows. It should yield as soon as your machine becomes active.
How short clip routing helps
No single worker hears the whole thing.
The system routes short fragments to different machines so one worker does not receive enough audio to reconstruct the full recording on its own.
What that means in practice
- A longer recording is broken into short pieces before dispatch.
- Your Mac receives one clip, transcribes it, and returns text.
- Adjacent clips are intentionally spread across different workers.
- Ambient does not turn your Mac into a place where someone browses source audio.
Workers see vs workers do not see
Workers see
Workers do not see
A short audio fragment
The full recording
The language needed for the task
Customer identity or account data
Only the current clip timing
All surrounding clips
A result upload path
A browsing interface for source audio
Quality controls
What the coordinator does to validate workers.
Ambient does not assume every worker is trustworthy on day one. Trust is earned through measured output.
Double-check new workers
New workers face the most validation while the system learns whether their results are reliable.
Canary injection
Known-answer clips can be mixed into the work stream so quality can be measured without self-reporting.
Reputation scoring
Workers build from new to elite over time, unlocking less validation and faster payout release.
Permission prompts
Ambient keeps macOS permission prompts narrow and explicit.
Ambient asks for notifications only when you enable a notification category, and asks for Launch at Login only when you enable that setting. Denying either prompt keeps the app usable.
Prompts Ambient may show
- Notifications (optional)
- Launch at Login / Login Items (optional)
- Gatekeeper first-open trust warning (install-time only)
Prompts Ambient does not request
- Accessibility
- Automation / Apple Events
- Input Monitoring
- Screen Recording
- Full Disk Access
- Camera / Microphone
Still want the deeper legal copy?
The trust page is the human explanation. The legal pages still exist.
Read the Privacy Policy, Terms, and Worker Agreement if you want the formal beta language.