BlitztextLinux stores only the configured API-key environment-variable name in:
~/.config/blitztext-linux/config.json
That file is written with restrictive permissions (0600) so only the current user can read it. The API key itself is read from the configured environment variable or from ~/.config/blitztext-linux/secrets.env, which must use permissions 0600.
- Local transcription workflows stay on the machine.
- LLM workflows optionally send the transcribed text to OpenAI, OpenRouter, or a configured custom endpoint for rewriting.
- Temporary audio files are created during processing and are removed when the workflow finishes or is cancelled.
- Workflow output may be placed on the clipboard so you can paste it into another app.
Do not store secrets in custom prompts, notes, or other free-text fields. If you work with sensitive content, review the repository code, your OpenAI account settings, and your own privacy requirements first.
The old macOS preview stored its API key in Keychain. That is not the Linux storage model.