The Halopen audit log: what it is and how to read it

The Halopen audit log stores dictation text and supported app events on your Mac. It can help you recover a draft or inspect how a particular dictation was processed. It is not a complete network monitor, and an absent row does not prove that no network request occurred.

Open the log

Open Halopen’s Settings, choose Privacy, then Open audit log. Find the dictation by its time. The underlying file is ~/Library/Application Support/Halopen/audit-log.json, with owner-only file permissions.

The transcript is useful when words landed in the wrong window or you need to revisit what you said. Before copying recovered text into another app, review it for recognition errors and confirm that the cursor is in the intended field. A saved transcript is evidence that text exists, not proof that it reached the correct destination.

Read a dictation entry

Supported entries can include a timestamp, event type, endpoint information, status, duration and transcription details. Available fields depend on the event; a local dictation does not have the same network response fields as a cloud request.

A (local) dictation entry identifies the local transcription route. It does not mean that the entire application, its libraries or your Mac stayed off the network. Conversely, the absence of a transcription entry can reflect your retention setting or the event’s lifecycle. Do not use absence alone as a privacy test.

Separate recognition from other activity

On-device speech recognition runs on an Apple Silicon Mac after its model is downloaded. Cloud recognition sends audio to a transcription service. Account and license checks, model downloads, app updates, usage reporting and enabled diagnostics are separate activities.

The log covers supported app events. It does not observe every SDK delivery, model-download request or request made by another application. A diagnostic event recorded as queued also does not prove that its network delivery completed.

Your destination app has its own storage and sync behavior. Dictating locally into a synced note does not make the resulting document local-only. Read the processing and retention details and check the destination app’s settings when evaluating the whole workflow.

Choose what remains on your Mac

Dictation text can be sensitive. In Settings → Privacy, choose the retention period that fits your needs, or use Off to clear the history and stop recording it. The log also has an entry limit. A shorter retention period means fewer old drafts remain available for recovery.

Clearing the local log does not erase content you already inserted into another app or change a service provider’s retention policy. Review those systems separately. The privacy page also distinguishes the audit log from other local stores, including recovery data.

Investigate a problem without overclaiming

For missing or unexpected text, first check the entry time and available transcript. Compare the result with your intended draft, then check the target field and permissions. For a processing question, note the selected mode and the entry’s route.

Network diagnostics are a separate investigation. The log alone cannot establish that every outbound request was captured or that a particular service retained nothing. The transparency page explains the boundaries, and support provides a way to ask about a specific problem. Avoid sharing sensitive transcript text when a description of the issue will do.