What Hindsight
does with sound.

Hindsight listens continuously and keeps only the last few minutes. That is a serious thing to run on a device you wear, so this page describes exactly what is captured, where it is held, how long it survives, and who else can reach it. It is written to be read, not to be survived.

Last updated 10 September 2026 · Applies to the Hindsight watch and phone apps (earth.diego.hindsight)

The short version

Hindsight has no server, no account and no login. Neither app requests the Android INTERNET permission, so neither one can send your audio, transcripts or usage anywhere.
The watch holds only a rolling window of the last 1 to 60 minutes, whichever you choose. Older audio is continuously overwritten and is not recoverable.
A clip you save travels directly to your paired phone over the local Wear OS connection, and is erased from the watch as soon as the phone confirms it has been written.
Transcription runs on the phone itself, using Android's on-device speech recognition. No audio is uploaded for transcription.
There is no analytics, telemetry, advertising or crash-reporting code in either app.
Audio leaves your devices only if you deliberately share a clip using Android's share sheet.

What the app records, and when

The watch app records audio from the watch microphone only while a listening session is running. A session starts when you start it and stops when you stop it, when a session time limit you set expires, or when Android stops the app. Nothing is recorded before you start a session, and nothing is recorded after you stop one.

While a session runs, the watch shows a persistent notification and an ongoing activity indicator, so the watch face itself tells you it is listening. This is not something the app can do silently.

Audio is written into a fixed-size ring buffer on the watch's own storage. The buffer holds the retention window you selected — 1, 5, 15, 30 or 60 minutes, defaulting to 1 minute. Once the buffer is full, the oldest audio is overwritten by the newest. Audio that falls outside the window is gone; the app keeps no second copy and no index of it.

What happens when you save a clip

Tapping save writes the current retention window to a clip and queues it for your paired phone. The transfer runs over the Wear OS Data Layer, which is the local channel between a watch and its paired phone provided by Google Play services. The clip is not routed through a Hindsight server, because there is no Hindsight server.

The clip stays on the watch until the phone acknowledges that it has written the file to disk, at which point the watch deletes it. This is the only circumstance in which a saved clip is removed from the watch automatically. If your phone is out of range, the clip waits in a queue on the watch until it can be delivered.

On the phone, clips and their transcripts are stored in the app's private internal storage. That area is not readable by other apps on the device, and is not written to shared or external storage where a gallery or file manager would pick it up.

Transcription

The phone app can turn a saved clip into searchable text. It does this with Android's on-device speech recogniser, which on supported devices is backed by system components such as Android System Intelligence. The audio is handed to that system service on the same phone. The app holds no API key, contacts no speech service, and cannot upload audio for transcription.

On-device recognition requires Android 13 or newer and is not available on every device. If it is unavailable, the clip simply stays untranscribed — nothing is sent elsewhere as a fallback. Transcripts are stored alongside the clip in the app's private storage, and are deleted with it.

The phone app lets you share a clip through Android's standard share sheet. This is always something you start, for a clip you pick, choosing the destination yourself.

Once you share a clip with another app — a messaging app, a mail client, a cloud drive — that copy is governed by that app's privacy policy, not this one. Hindsight has no way to reach it, recall it, or delete it afterwards.

How long things are kept, and how to erase them

Unsaved audio on the watch: until it falls outside your retention window, which is at most 60 minutes. Then it is overwritten.
A saved clip on the watch: until the phone confirms delivery, then it is deleted.
Clips and transcripts on the phone: until you delete them. Hindsight applies no automatic expiry to saved clips — they are yours to keep or remove.
Deleting a clip: moves it to an in-app trash so the action can be undone, and permanently deletes it from the phone's storage once that undo window closes.
Uninstalling: removes the app's private storage, which erases every clip, transcript and setting on that device. Uninstall the watch app to clear the watch buffer.

Permissions, and why each one exists

RECORD_AUDIO: Watch only. Captures the rolling buffer. This is the app's entire function; without it there is nothing to save.
FOREGROUND_SERVICE_MICROPHONE: Watch only. Lets recording continue with the screen off, which is the point of a wearable buffer. Android requires a visible notification for the whole time it runs.
POST_NOTIFICATIONS: Both apps. Shows the listening notification and save confirmations.
FOREGROUND_SERVICE_DATA_SYNC: Phone only. Receives an incoming clip from the watch reliably enough to acknowledge it.
WAKE_LOCK: Watch only. Keeps the recorder running rather than being suspended mid-buffer.
VIBRATE: Watch only. Confirms a save by touch, so you need not look at the watch.

Neither app requests INTERNET or network-state permissions. Neither requests location, contacts, camera, or access to your photos or files.

Other people in the room

Hindsight records whatever the watch can hear, which will often include people who are not you. In many places, recording a conversation without the consent of the people in it is unlawful, and the rules differ sharply between countries and between states.

You are responsible for how you use the app. Tell the people you are with that you are listening, and get their agreement. The app is designed to make this easier rather than harder: it shows a persistent notification while it listens, and it keeps minutes rather than days.

Third parties

Hindsight has no advertising, analytics, attribution or crash-reporting SDKs, and shares no data with any company for those purposes. Two Google components are involved in running the app on your own hardware:

Google Play services (Wear OS Data Layer): carries a saved clip from your watch to your paired phone over the local connection between them.
Android's on-device speech recognition: converts a saved clip to text on the phone.

These are parts of the Android platform on your devices, and their handling of data is governed by Google's own privacy policy for those platform services.

Children

Hindsight is not directed at children, and is not designed or marketed for use by anyone under 13. The app collects no data centrally, so there is no children's data for us to hold or to delete.

Changes to this policy

If the app's handling of data changes, this page is updated in the same release, and the date at the top changes with it. The app is open source, so the behaviour described here can be checked against the code rather than taken on trust.

Contact

Questions about this policy, or about what the app does with a recording, can be sent tohello@nerdev.org. The source is public atgithub.com .