A conversation model trained only on speech, called Dessa, landed on the Hacker News front page this week with 301 points and 113 comments at the time of listing. It comes from Block, the company behind products like Square and Cash App. Curiosity about what the model can do is natural. But the page we can actually speak to is the one most people skip: the privacy notice for the dessa.com website.
This article won't describe how Dessa works, because the material we have doesn't cover its technology. What it does cover is what Block says about data on the site. That makes a useful case study for a skill worth having: reading an AI tool's privacy notice in about five minutes and knowing what to look for.
What the Dessa privacy notice covers
Per Block's notice for dessa.com, the page outlines what personal, device, and usage data is collected, how it's used, and when it may be shared with affiliates, service providers, or legal authorities.
Those are the standard building blocks of most privacy notices. Seeing them laid out for a specific site helps you ask the right questions of any similar product.
The three kinds of data to look for
The notice groups what it collects into categories. When you read any AI product's policy, sort what you find the same way.
Personal data
This is information that identifies you: the things you type into a form, or details tied to an account. Ask yourself whether you need to give any of it just to look around.
Device data
This describes the equipment you use to visit. It is collected passively, meaning you don't have to do anything for it to be recorded. Simply loading a page can count.
Usage data
This is what you do on the site: what you view and how you interact. For AI products, this category deserves extra attention, because interaction is the whole point of the product.
A useful habit: for each category, find the sentence that says why it's collected. If a policy lists data without a purpose, that's a gap worth noting.
Who else might see your data
The notice says data may be shared with three groups. Each one means something different.
- Affiliates: companies related to the one running the site.
- Service providers: outside companies that help run the product.
- Legal authorities: when disclosure is required by law.
The affiliate piece matters most for Dessa, because of who owns it.
Why Dessa's parent company matters
Dessa sits under Block, and the company's family of products includes Square, Cash App, Afterpay, and TIDAL. That doesn't mean your data from one flows to another. The notice we have describes sharing with affiliates as a possibility, and we can't say from it exactly what is shared or when.
The practical lesson is simpler: when a new AI tool comes from a large company, check how it relates to the parent's other services. A standalone startup and a division of a multi-product company can handle the same data very differently. Look for whether the notice mentions a shared account, a shared policy, or a link to the parent's broader privacy terms.
Why this matters more with speech-based AI
Privacy policies are increasingly a trust signal as AI products rely on user interaction data. That's the reason these notices are getting attention from developers and early adopters testing new tools.
Speech adds a personal layer. Voice can carry a lot about a person. We can't tell you from this material how Dessa treats voice data, and the website notice may not be the whole story. Products often have separate terms once you actually use a service. So treat the website notice as the first document, not the last.
A five-minute checklist before you test any AI tool
- Find the scope. Does the notice cover only the website, or the product itself too? The Dessa notice is described as covering dessa.com.
- List what's collected. Personal, device, usage. Note anything beyond those.
- Check the purpose. Each type of data should have a stated reason.
- Find the sharing section. Look for affiliates, service providers, and legal requests.
- Look for the parent company. Know whose products sit next door.
- Search for separate terms. If you'll speak or type into the tool, look for a second policy covering that.
- Use the least you need. Browse before signing up, and sign up before sharing anything sensitive.
What we don't know yet
It's worth being plain about the limits. The notice we reviewed is about website privacy. It doesn't tell us how Dessa was trained, how well it works, or what happens to conversations with it. Those answers would have to come from Block's own materials on the product.
The takeaway
Before you try the next buzzy AI tool, open its privacy page first, and spend five minutes sorting what it collects, why, and who else gets a look. The tool will still be there when you're done.
