This addresses the voice data aspect of things, but it is important to note that VoxCommando can interface with all sorts of other programs, so how you configure and use it may have an impact on your privacy and security.
For example if you are using scrape to contact insecure 3rd party websites, then all bets are off!
I am also going on the assumption that the sapi speech recognition engine built into windows is not sending your data anywhere. Of this I cannot be 100% certain but I am 99% sure there is nothing to worry about there. If they are sharing any data it would be "metrics" data and certainly nothing about what you are actually saying. If someone is interested it is probably possible to find out the answer to this question with a bit of searching.