Voice entry is the one place your words leave your phone. Here’s exactly what happens to them.
Almost everything in Carlo is built so your data never leaves your control in a form anyone could read. Your transactions, notes, photos, and reflections are locked field by field with a master key derived from your recovery phrase. The phrase is kept in a private app area of your own iCloud or Google account; Carlo’s servers never receive or store it, and they never have your master key. I wrote about how that works in a separate piece. Voice entry is the exception to all of it, and this is the whole of what happens in the few seconds between tapping the button and seeing your transaction appear.
When you enter a transaction manually, the amount, the payee, and any note are encrypted on your phone before they’re stored or synced. Voice can’t work that way. A recording of your voice has to be turned into words by something that understands speech, and those words have to be turned into a transaction by something that understands language. Neither of those things lives on your phone. They’re too large, and they change too often, to ride around in your pocket. So for a moment, when you speak instead of type, your words travel.
What actually happens
You tap the button and say “I spent eight dollars on coffee at Starbucks and I paid with the Starbucks app.” Your phone records a few seconds of audio and sends it to Carlo’s server. The server doesn’t keep it. It hands the audio to two specialists in turn, passes their answer back to you, and forgets the whole exchange.
The first specialist transcribes. It’s an open speech model called Whisper, running on a fast service called Groq, and its only job is to hear the audio and write down the words. My Groq account runs under zero data retention, so Groq doesn’t retain the audio after transcribing it, except where required by law.
The second specialist reads. It’s a small, fast version of Claude, the language model made by Anthropic, and it takes the plain sentence you spoke and works out the pieces: the amount, who you paid, how you paid, which category it belongs in. It hands back those structured fields and nothing else.
Then your phone has a filled-in card waiting for you. Nothing has been saved yet. You can fix anything that’s wrong. When you tap Save, the transaction enters the same locked world as everything else in Carlo, encrypted with your key before it’s stored. By then the audio is already deleted off Carlo’s server, wiped the moment the round trip finished, whether it succeeded or failed.
The part I won’t skip
There’s one more detail a careful reader would want. To help the transcriber hear you correctly, Carlo sends your payee names to Groq along with the audio, as hints. It’s the difference between the service guessing at a sound and knowing that when you say the name of your coffee place, you mean the one you go to twice a week. The transcript then goes to Anthropic with your account and category names, so it can match the entry to the right ones. Groq doesn’t receive those account or category names, and Anthropic doesn’t receive a separate list of your payees. All of these names go out in readable form for the length of the request, and they come back into the locked world the moment you save.
That’s a real trade, and the word “encrypted” shouldn’t do quiet work it hasn’t earned. For the seconds your voice is being understood, some of your data is readable by the two services doing the understanding. That is the cost of voice, and it only applies when you tap the voice button. Type the transaction instead and none of it happens.
What stays behind is simpler to state. The audio is never stored on Carlo’s servers. The transcript is never written to any table. There’s no log of the words you spoke sitting in a database somewhere with your name on it. The only record that the coffee happened is the transaction itself, encrypted like all the others. If you went looking through everything Carlo keeps about you, you would not find the sentence you said. You’d find the amount, the payee, and the category, all of it ciphertext, locked with your key like everything else.
What this protects, and what it doesn’t
Voice is the one feature where your data leaves the phone in a form a person could read. Two outside providers process parts of it. Groq processes the audio under zero data retention, and Anthropic processes the transcript under zero data retention and doesn’t train on it. The exceptions are spelled out in the privacy policy: where the law requires it, or, for Anthropic, to prevent misuse. That’s good, and it isn’t the same as nothing.
If that boundary bothers you, you never have to cross it. Type a transaction instead, and its amount, payee, and any note are encrypted on your phone before they’re stored or synced, with nothing sent to Groq or Anthropic. When you log a transaction, your words only go out to be understood if you tap the voice button. Both doors are yours. I only want you to know which one you’re walking through.
The reason voice exists at all isn’t speed for its own sake. It’s that the easier it is to catch the moment you spent the money, the more likely you are to actually catch it, and catching it is the whole practice. A minute a day only works if the minute is light enough to keep. Voice makes it lighter.
