Is Handy safe? Open-source licence, offline use and checks

Yes, Handy is open source: its GitHub repository carries the MIT licence, and anyone can read, build and modify the code. Its README describes it as "a free, open source, and extensible speech-to-text application that works completely offline", and its privacy policy says ordinary transcription does not send your audio or transcripts to the maintainers. Two features do use the network: update checks, which are on by default and contact GitHub, and optional cloud post-processing, which sends your transcript to a provider you choose. Open source makes these claims checkable; it does not prove them by itself.

Publisher note: SuprFlow publishes this guide and is one of the products discussed. Competitor details come from each company's own pages, checked on 1 October 2026. Prices and features change; confirm before you buy.

This page reports what Handy's own repository and website say, plus what we saw in its public source. It is not a security audit, and we have not tested Handy's network traffic.

What do Handy's own pages say?

As of 1 October 2026.

Handy's privacy policy is dated 18 September 2026. It says model downloads send Hugging Face "ordinary technical request information, such as your IP address", not audio or transcripts.

Does Handy work offline?

Yes, for transcription, once a model is downloaded. The README says you press a shortcut ("hold it to record and release to stop, or tap it to toggle"), Handy transcribes locally, and the text is pasted into the app you are using. It also explains how to install models by hand if you are behind a proxy or firewall.

Two things go online unless you change them:

• Update checks. The privacy policy says that when update checking is enabled, Handy contacts GitHub Releases. In the project's settings source, update checks default to on.
• Cloud post-processing. Off by default in the same source. When you turn it on with a cloud provider, the policy says Handy sends "the transcription, selected prompt, model information, and the authentication credential" directly to that provider, under that provider's terms. The source lists OpenAI, Anthropic, Groq, Cerebras, OpenRouter, Z.AI and AWS Bedrock, plus Apple Intelligence and a custom endpoint that defaults to a localhost address. Pick a local option if the text must stay on the Mac.

What does an open-source licence prove, and what does it not?

The MIT licence gives you rights: to use, copy, modify and redistribute the code. It also says the software is provided "AS IS, WITHOUT WARRANTY OF ANY KIND". It is a licence, not a privacy guarantee.

What open source does give you is the ability to check. We looked at the project's main dependency files and did not see an analytics library, which matches the privacy policy. That is a quick look, not an audit; a careful reviewer would also read the network code and the dependencies those pull in.

What it cannot tell you on its own:

• That your download matches the source. Unless you build it yourself or verify the release, you are trusting the build.
• That your settings are safe. Post-processing with a cloud provider is in the open code too.
• That copies are the same. The policy notes "Modified or redistributed versions of Handy may have different practices."

Does open-source dictation prove privacy? covers this in more depth.

How do you verify a Handy release or build it yourself?

Get it from the source. The README points to the GitHub releases page and handy.computer, and lists Homebrew (brew install --cask handy), winget and APT as other routes. The latest release when we checked on 3 October 2026 was v0.9.8, with Mac .dmg files for Apple silicon (aarch64) and Intel (x64) among its assets, according to the GitHub releases API.

Check the signature. The README says release files are "signed with Tauri's updater signature format". Each file has a matching .sig, and the public key is in src-tauri/tauri.conf.json. The README gives a short script that decodes both and checks them with the minisign tool, which prints "Signature and comment signature verified" on success.

Check the checksum. The release page lists SHA-256 checksums for its assets. On a Mac, run shasum -a 256 on the downloaded file in Terminal and compare.

Check the Mac signature separately. A Tauri updater signature is not Apple code signing. How to check a signed Mac release shows how to see who signed an installed app.

Or build it. BUILD.md lists Rust, the Bun package manager, Tauri's prerequisites and Xcode Command Line Tools, then: clone the repository, bun install, and bun run tauri build. It notes Intel Macs need ONNX Runtime from Homebrew, and that a local build may need its Accessibility permission reset with tccutil reset Accessibility com.pais.handy.

Then grant only what the app needs. The README says Handy needs Microphone and Accessibility permission on macOS.

When is Handy a good choice, and when does something else fit better?

Handy is a strong choice when you want free, local push-to-talk dictation, readable source, or the same tool on Mac, Windows and Linux. For many people it is all they need.

Something else may fit better if:

• Your organisation needs a vendor contract, audit report or support agreement. Handy is a free project with no warranty.
• You want an iPhone app. Handy lists desktop systems only.
• You need meeting recording or file transcription. A file-focused tool such as MacWhisper fits that better; see Is MacWhisper safe?.

SuprFlow is a paid, proprietary alternative for Mac users who prefer a packaged app with a personal dictionary, voice snippets and recent history. It recognises speech on the Mac with a WhisperKit model, and its Default formatting is local cleanup of punctuation, capitalization and numbers. You cannot read its source, it uses the network for licence checks, model downloads, updates and usage telemetry, and it costs $125 once with no free tier. SuprFlow vs Handy compares them honestly.

Questions people ask

Is Handy free?

Yes. Handy's site says it is free, and the code is MIT licensed.

Does Handy collect telemetry?

Its privacy policy says it "does not contain advertising, behavioral analytics, or user-tracking telemetry". It does check GitHub for updates by default, and model downloads contact Hugging Face.

Is Handy available on Mac?

Yes. The README lists macOS alongside Windows and Linux, and the latest release includes a Mac download for Apple silicon. Handy needs Microphone and Accessibility permission.

Can Handy send my text to the cloud?

Only if you turn on post-processing with a cloud provider. It is off by default in the source, and you can choose Apple Intelligence or a local endpoint instead.

Related guides

• SuprFlow vs Handy
• Does open-source dictation prove privacy?
• Open-source Wispr Flow alternatives
• Is VoiceInk safe and open source?
• Parakeet vs Whisper speech models
• On-device dictation vs no internet

Sources

• Handy — GitHub repository and README
• Handy — LICENSE
• Handy — Releases
• Handy — BUILD.md
• Handy — settings.rs source
• Handy — official site
• Handy — Privacy Policy