Choosing software that respects your data: a practical checklist

Every app you use makes decisions about your data: where it’s stored, who can read it, how long it’s kept, and what happens if you leave. Most of those decisions are buried in settings pages and privacy policies. You don’t need to be a security expert to make good choices, though. A handful of questions will tell you most of what you need to know.

This is the checklist we use when we evaluate software for our reviews, and the one we tried to meet when we built Hark. It works for note apps, password managers, meeting tools, AI assistants and almost anything else.

1. Where does your data live?

Start with the most basic question: when you create something in the app, where is it stored?

• On your device only. Your data never leaves unless you send it somewhere. Nobody else can lose it, but you’re responsible for backups.
• On your device, with optional sync. Data lives locally and a copy goes to the cloud only if you turn sync on.
• In the cloud, with a local cache. The real copy is on the company’s servers; your device shows a copy.
• Cloud only. Nothing works without the company’s servers.

None of these is wrong, but they suit different things. A shared team wiki naturally lives in the cloud. A private journal, a password vault or a recording of a confidential meeting may be better on your own device.

What to look for: a plain statement in the docs or privacy policy about where data is stored and in which country. If you can’t find one, that tells you something too.

Notes apps show the contrast clearly: our Notion vs Obsidian comparison looks at a cloud workspace next to a local folder of Markdown files.

2. Can you get your data out?

The best test of whether an app respects your data is how easy it is to leave.

Ask:

• Is there an export button, and does it cover everything (not just some of it)?
• Is the export in an open format that other apps can read: Markdown, plain text, CSV, JSON, standard audio files?
• Can you export in bulk, or only one item at a time?
• If you stop paying, can you still read and export what you created?

An app that stores your notes as plain files on your disk, like Obsidian, passes this test almost by default. Apps with proprietary formats can still be fine if their export is complete. Try exporting something before you commit years of work.

3. How is it encrypted, and who holds the keys?

Almost every service now encrypts data “in transit” (between you and their servers) and “at rest” (on their disks). That’s the minimum. The more important question is who can decrypt it.

• End-to-end or zero-knowledge encryption means data is encrypted on your device with a key the company doesn’t have. Even the company can’t read it. Good password managers work this way; see our Bitwarden review and 1Password review.
• Standard server-side encryption protects against stolen disks, but the company can read your data, which means so can anyone who compromises its systems or compels it to hand data over.

Neither is automatically right. Server-side access is what lets a service search, summarise or share your data for you. Just know which one you’re getting.

What to look for: a security page that says specifically who holds the keys, and whether any independent audit has checked those claims.

4. How does the company make money?

Business models shape behaviour. It’s worth asking how the company pays its bills, because that tells you what it is motivated to do with your data.

• You pay for it. A subscription or one-off purchase means you’re the customer. That isn’t a guarantee, but the incentives line up.
• Free, funded by a paid tier. Common and often fine. Check what the free tier is for: a genuinely useful product, or a funnel with limits designed to frustrate.
• Free, funded by advertising or data. Your attention or your data is what’s being sold. Read the privacy policy carefully.
• Free, funded by investors with no clear plan. The product may change a lot, be sold, or shut down.

We think it’s fair to tell you how we do this ourselves: everything Hark does on your computer is free, and the subscription pays for the parts that cost us money each time you use them, AI notes and sync. The reasoning is in free forever: how Hark’s pricing works.

5. Is your data used to train AI?

This question barely existed a few years ago. Now it’s one of the most important.

Many apps have added AI features, and some AI providers use customer content to improve their models unless you opt out. Policies differ between consumer and business plans of the same product, and they change.

Ask:

• Does the company use your content to train its own or anyone else’s AI models?
• Is training on by default, and is there an opt-out? Does the opt-out cover data you’ve already provided?
• When the app sends your data to a third-party AI provider, what does that provider do with it?
• Are human reviewers ever allowed to read your content, and when?

What to look for: a direct answer in the privacy policy or an AI-specific FAQ. Vague phrases like “to improve our services” deserve a closer look. Our reviews of Claude, ChatGPT and Notion AI summarise what each company says.

6. Does it work offline?

An app that works offline usually keeps your data on your device, and it keeps working when the internet, or the company, doesn’t. Ask:

• Can you open and edit your data without a connection?
• Does the core feature work offline, or only a read-only view?
• What happens if the company’s servers are down, or the company goes away?

Offline use matters most for anything you can’t afford to lose access to: notes, passwords, recordings. Speech recognition is a good example of something that used to need the cloud and no longer does; we explain why Hark transcribes locally in the case for on-device transcription.

7. What does it send, and when?

Even local apps can send data: analytics, crash reports, or content to an AI service. A trustworthy app is specific about this.

• Is telemetry described, and can you turn it off?
• When a feature sends content to a server (AI summaries, sync, sharing), is it clear in the app that it’s happening?
• Is it opt-in or opt-out?

8. Who else is in the conversation?

For tools that handle other people’s data, like meeting recorders, shared documents and email, think about the people who didn’t choose the app. A meeting bot that records everyone on a call, for example, puts a third party in the room for every participant. We wrote about that in meeting bots are awkward, and if you’re evaluating a specific service, see is Otter.ai safe?.

The checklist

Copy this and keep it for the next app you evaluate:

• I know where my data is stored, and in which country.
• I can export all of it, in an open format, even if I stop paying.
• I know who can decrypt my data: just me, or the company too.
• I understand how the company makes money.
• My content isn’t used to train AI, or I’ve opted out and know what that covers.
• The core features work offline, or I’m comfortable that they don’t.
• I know what the app sends to servers, and I can turn off what I don’t want.
• If it handles other people’s data, they know and have agreed.

Free tools that upload nothing

Many free online tools quietly send what you type or record to a server. Ours don’t. Every tool on our site runs in your browser and uploads nothing:

• Online voice recorder: record audio and download it.
• Microphone test and webcam test: check your setup before a call.
• JSON formatter: paste data without sending it anywhere.
• Character counter and case converter for everyday text.

You can check this yourself: open your browser’s developer tools, watch the Network tab, and use the tool. Nothing should be sent.

Good enough is good enough

No app will score perfectly on every point, and that’s fine. The goal isn’t purity; it’s knowing what you’re agreeing to. An app that stores your data in the cloud, is clear about it, lets you export everything and doesn’t train on your content is a perfectly good choice. The ones to avoid are the ones that won’t give you straight answers.