How DictaType Is Built: A Look Under the Hood

When you install a small utility that listens to your microphone and types for you, you’re placing a lot of trust in whoever built it. Where does your audio go? What’s stored, and where? Can you believe the “private” on the marketing page?

We think the best answer to those questions is to simply show you how DictaType is built. This is a genuine, engineer-to-reader tour of the architecture — the good decisions, the hard problems, and the trade-offs. No hand-waving.

The big picture

DictaType is three separate pieces:

1. The desktop app — a native Windows application that records your voice, sends it to OpenAI for transcription, and pastes the result into whatever app you’re using.
2. The license manager — a small backend service that issues and validates license keys and free trials.
3. The website — the marketing site and trial signup you’re reading right now.

The important thing to understand up front: your audio never touches our servers. The desktop app talks directly to OpenAI using your own API key. Our backend only ever deals with license keys and anonymous counts. We’ll come back to why that matters.

The desktop app: Tauri + Rust + React

The app is built on Tauri 2 rather than Electron. That choice drives almost everything else.

Electron ships an entire copy of Chromium with every app — hundreds of megabytes of browser for what is, ultimately, a small utility. Tauri instead uses the WebView already built into Windows (WebView2) and pairs it with a native Rust backend. The result is a dramatically smaller download, lower memory use, and — crucially for a tool that simulates keystrokes and installs global hotkeys — direct, safe access to the operating system.

So the split is:

• Frontend: React 19 + TypeScript, styled with Tailwind CSS v4 and shadcn/ui components, bundled by Vite.
• Backend: Rust, which handles everything the web layer can’t — audio files, global hotkeys, clipboard, keyboard simulation, the system tray, and talking to OpenAI.

The recording pipeline

Here’s what actually happens when you hold your hotkey and speak:

1. Capture. Recording happens in the WebView using the standard browser MediaRecorder API (getUserMedia → audio/webm). Audio is collected in 100 ms chunks so stopping feels instant.
2. Hand-off to Rust. When you release the key, the audio blob is passed to the Rust backend, which writes it to a temporary file in the app’s data directory.
3. Transcription. Rust POSTs that file as a multipart upload to OpenAI’s Whisper API (whisper-1) using your API key, with a generous timeout for longer recordings.
4. Insertion. The returned text is placed on your clipboard and (optionally) pasted into the active window.
5. Cleanup. The temporary audio file is deleted.

The hardest part: global hotkeys

This sounds trivial and absolutely is not. Windows offers a standard API called RegisterHotKey for claiming a keyboard shortcut system-wide. It works well — until you want a shortcut that includes the Windows key, or one that is only modifiers (like holding Ctrl + Win). RegisterHotKey simply can’t reliably claim those.

So DictaType ships two hotkey backends and picks the right one automatically:

• For normal combinations, it uses Tauri’s standard global-shortcut plugin (backed by RegisterHotKey).
• For Windows-key or modifier-only combinations, it falls back to a low-level keyboard hook (WH_KEYBOARD_LL) written directly against the Win32 API.

That low-level path has its own war stories. The keyboard hook can silently stop firing on some machines when focus is inside the WebView, so the code also polls key state at roughly 100 Hz and treats the poll as the source of truth, keeping the hook around for zero-latency detection and for suppressing the keystroke during recording. Windows also uninstalls any hook whose callback takes longer than ~300 ms, so that hot path is kept strictly free of memory allocation, locks, and I/O.

This is the kind of unglamorous engineering that makes push-to-talk “just work” in every app you use.

Getting text into any application

Once we have your transcription, how does it end up in Slack, or your email, or a code editor? DictaType writes the text to the clipboard (using the arboard crate) and then simulates a Ctrl+V keystroke (using enigo). Because it uses the OS’s own paste mechanism, it works in essentially any application that accepts pasted text — no per-app integrations required. You can also turn auto-paste off and just have transcriptions copied to your clipboard.

The floating overlay windows

That little status indicator that appears while you’re recording isn’t part of your app — it’s a separate, frameless, transparent, always-on-top window that DictaType positions on your screen. In fact there are several of them, each a tiny self-contained web page: recording, transcribing, post-processing, success, and error states, plus an optional draggable floating record button.

Splitting them into distinct windows means the “Post-processing…” indicator shows the correct message the instant it appears, instead of flashing the wrong state for a frame. Details like this are why the app feels polished.

Optional AI post-processing

DictaType can run a second AI step after transcription: you write a prompt once (say, “format this as a professional email” or “remove filler words”), and every dictation is reshaped before it’s pasted. This runs against OpenAI’s gpt-4o-mini using — again — your own key.

There’s a subtle but important safety measure here. Your dictation is wrapped in tags and the model is explicitly instructed to treat that text as data, not instructions. Without this, saying “help me write a poem” out loud might cause the model to write a poem instead of reformatting your words. It’s a deliberate defense against prompt-injection-style confusion.

History and updates

Your transcription history is stored as a plain JSON file on your own machine — no database, no cloud sync, nothing leaves your computer. You can search it, re-run post-processing on past items, export to JSON/CSV/TXT, or set it to auto-delete after a number of days.

Updates are delivered through Tauri’s updater, and every update is cryptographically signed (minisign). The app verifies that signature before installing anything, so a tampered update can’t be pushed onto your machine.

Privacy and security by design

This is the part we most want you to be able to verify for yourself, so here it is plainly:

• Bring Your Own Key (BYOK), direct to OpenAI. Your audio goes from your machine straight to OpenAI’s API using your key. It does not pass through any DictaType server. We literally cannot see or store your audio or transcriptions — there’s no code path for it.
• Everything stays local. Your API key, settings, and full transcription history live in files on your own computer.
• Your machine ID is hashed. For license activation, DictaType needs to recognize your device. Instead of sending identifying details, it computes a SHA-256 hash of your machine’s characteristics and sends only that hash. We never receive your hostname, username, or hardware serials.
• A locked-down content policy. The app enforces a strict Content Security Policy that only permits network connections to a short allow-list (OpenAI, the update feed, and our license server). It’s not free to phone home anywhere.
• Anonymous, opt-out telemetry. We collect basic anonymous usage counts (things like “a recording completed”) to understand what to improve. It’s tied only to the hashed device ID, never includes your prompts, audio, or transcribed text, and you’re asked about it on first run and can turn it off.

The license manager: Elixir + Phoenix

The backend that handles licensing is a small Elixir/Phoenix JSON API, backed by PostgreSQL. Elixir runs on the battle-tested Erlang VM, which is built for exactly this kind of always-on, concurrent, reliable service — it’s the same technology lineage that has run telephone networks for decades.

A few design decisions worth explaining:

• License keys are validated by lookup, not magic. A key is a random, opaque string stored in our database. When the app validates it, we look it up and check its status and expiry. Simple and revocable.
• The clock starts on first use. For trials, your “4 hours” is usage time measured from your first activation, not a countdown that starts the moment the email is sent. Buy a lifetime license and it simply never expires.
• Offline grace period. The desktop app validates online, but if our server is briefly unreachable it honors a 7-day offline grace window so a network hiccup never stops you mid-sentence.
• Fair trials without spying. To prevent one person from claiming unlimited free trials, we check for one trial per email and per device. But the device fingerprint is SHA-256 hashed before it’s ever stored — we keep a hash, not your device.
• Purchases are webhook-driven and replay-protected. When you buy, our payment provider notifies the backend, which issues your license and emails it to you automatically. Those webhooks are signature-verified with a timestamp-tolerance check to reject replayed or forged requests, and all security-sensitive comparisons use constant-time functions to avoid timing leaks.

Emails (your trial and purchase license keys) are sent through Swoosh via Brevo. License-issuing is idempotent, so a retried or duplicated webhook never creates two licenses for one purchase.

The website

The site you’re on is built with Astro and Tailwind CSS v4, and deployed on Cloudflare Pages. Astro ships almost no JavaScript by default, which keeps the pages fast; the few interactive bits (like the trial signup form) are React components that hydrate only where needed. The trial signup itself runs on a Cloudflare Pages Function that talks to the license manager.

The stack at a glance

Why we’re telling you all this

Voice-to-text only works if you’re comfortable using it for the things you actually say all day — messages, emails, notes, code. That comfort has to be earned, and we’d rather earn it with transparency than with adjectives.

If you’ve read this far, you now know as much about how DictaType works as we do. The design goal running through all of it is simple: do the useful thing, keep your data on your machine, and never make you take our word for it.