Jake
3770815fbf
Closes the code-side v0.1 ship gate. All quality gates green: cargo fmt/clippy/test (~327 tests), npm check (0/0), vitest 13/13, scripts/dogfood-rebrand-drill.sh 8/8. Phase F — first-run onboarding promoted to v0.1 - FirstRunPage with skip-to-main + failure recovery + event recording - Six onboarding commands (record/list/has-completed + lumotia_events) - Storage migration v17 (onboarding_events + lumotia_events tables) UI hardening (in-scope items from v0.1-ui-hardening.md) - StatusPill + PostCaptureCard components, 21st preview entry - Sidebar recording-as-sacred-state (opacity + aria-disabled, reduced-motion) - Settings 6-section regroup + Help section + Activation log + Privacy toggle - Error-state copy sweep (DictationPage + SettingsPage, plain-language) - Global :focus-visible rule, textarea outlines restored - Ctrl+K / Ctrl+, / Escape bindings in +layout LLM resilience - rule_based_extract_tasks (regex-free imperative-verb extractor) + extract_tasks_with_fallback wrapper — task extraction never returns zero - tokio::time::timeout(120s) wraps cleanup/tags/tasks commands Release artefacts - LICENSE (canonical AGPL-3.0), CHANGELOG (Keep-a-Changelog format) - v0.1-release-notes, privacy-and-ai-use, install-warnings, tester-onboarding-kit, tester-acceptance-runbook, code-signing-setup, apple-silicon-rb08-runbook, virtual-audio-setup, v0.1-contrast-audit - Workspace versioning + AGPL spdx; npm exact-pin (10 ranges removed) - AppImage SHA-256 sidecar in build.yml - README v0.1 section + Reporting-issues; canonical repo slug Closure pass — items moved from human-required to code-complete - KI-02 Linux idle inhibit: zbus 5 → org.freedesktop.login1.Manager.Inhibit - KI-03 Windows sleep prevention: SetThreadExecutionState(ES_CONTINUOUS|...) - acquire/release_idle_inhibit Tauri commands, wired in DictationPage - Diagnostic-bundle frontend wire-up (Settings → Help button) - WCAG-AA contrast fix via .btn-filled-text utility (no token changes) - 8 destructive-action sites wrapped in plain-language confirm() guards - KNOWN-ISSUES.md + v0.1-known-limitations.md updated (KI-02/03 fixed) Scripts - pre-tag-verify.sh, tag-day.sh, smoke-linux + driver - parse-diagnostic-bundle.sh, parse-activation-log.py Per-item audit trail: docs/release/v0.1-completion-status.md Remaining: W-01…W-08 (signing certs, hardware probes, smoke matrix, tester recruitment) — see docs/release/v0.1-known-limitations.md.
108 lines
5.8 KiB
Markdown
108 lines
5.8 KiB
Markdown
---
|
|
name: privacy-and-ai-use
|
|
type: release
|
|
tags: [release, v0.1, privacy, trust, ai-use, disclosure, user-facing]
|
|
description: "User-facing privacy + AI-use disclosure for Lumotia v0.1. Lists what stays local, what optionally reaches the network, what NEVER leaves the machine, the AI use disclosure (local LLM + AI-assisted implementation), the MCP server caveat, the opt-in activation log, crash-dump policy, and the open-source licence framing. Linked from README + Settings → Privacy + v0.1 release notes."
|
|
---
|
|
|
|
# Privacy + AI-use disclosure
|
|
|
|
Lumotia v0.1 — last reviewed 2026-05-14.
|
|
|
|
---
|
|
|
|
## What stays local
|
|
|
|
Every piece of data the app creates or captures lives only on your machine:
|
|
|
|
- Audio recordings (captured, processed, then discarded from memory — not persisted to disk by default)
|
|
- Raw transcripts (exactly what the speech engine heard, always recoverable)
|
|
- Cleaned transcripts (LLM-formatted versions; the raw is always preserved alongside)
|
|
- Extracted tasks and subtasks
|
|
- MicroStep breakdowns and focus-timer state
|
|
- Transcript and task history (SQLite database in your app-data directory)
|
|
- Downloaded speech models (Whisper, Parakeet) and LLM model files (GGUF)
|
|
- Custom vocabulary and profile terms
|
|
- Activation log events (if you opt in — see below)
|
|
- Onboarding state and preferences
|
|
|
|
Nothing in this list is ever transmitted automatically.
|
|
|
|
---
|
|
|
|
## What optionally reaches the network
|
|
|
|
There are exactly two outbound network paths in v0.1:
|
|
|
|
**1. Model downloads (huggingface.co)**
|
|
|
|
When you pick or download a speech model or LLM in onboarding or Settings → Models, Lumotia fetches the model file from `https://huggingface.co`. The request contains only a standard HTTP GET for a specific file URL (content-addressed, pinned to a commit hash). No account, no user identifier, no transcript content is sent. The download is initiated by your explicit action. Once downloaded, the model runs fully on-device.
|
|
|
|
**2. Update check (stub in v0.1)**
|
|
|
|
Lumotia includes a `check_for_update` command wired to `tauri-plugin-updater`. In v0.1 this function returns immediately with no update available — no network request is made. This will change in a future release; when it does, the check will be user-initiated or clearly disclosed.
|
|
|
|
**What about `npm audit` and supply-chain tooling?**
|
|
|
|
`npm audit` and the supply-chain pre-flight in `run.sh` are development-time tools only. They run when a developer builds from source, not in the installed application. The packaged app contains no npm runtime and makes no npm network calls.
|
|
|
|
---
|
|
|
|
## What NEVER leaves the machine
|
|
|
|
These are hard commitments, not soft defaults:
|
|
|
|
- Your voice recordings
|
|
- Your transcript text (raw or cleaned)
|
|
- Your task content
|
|
- Your extracted MicroSteps
|
|
- Your activation log
|
|
- Your history and search index
|
|
|
|
There is no telemetry system, no analytics pipeline, no crash-reporting service, and no background process that phones home. Crash dumps and logs are stored locally and are only shared if you explicitly bundle and attach them to a support issue (see below).
|
|
|
|
---
|
|
|
|
## AI use disclosure
|
|
|
|
Lumotia uses a local large language model for two narrow purposes: transcript cleanup and task extraction. The model is downloaded once and runs entirely on your device. It never sees data outside those two call sites — there is no chat surface, no persistent conversation history, and no system prompt that accumulates your content across sessions. The raw Whisper transcript is always preserved; LLM output is additive, never destructive.
|
|
|
|
The app itself was built with AI assistance. That process is documented in `docs/release/how-lumotia-is-built.md`, including the audits and guardrails applied to AI-generated code before it was committed.
|
|
|
|
---
|
|
|
|
## MCP server caveat
|
|
|
|
Lumotia includes an optional MCP server (`lumotia-mcp`) you can wire into Claude Desktop, Cline, or any MCP-capable client. It is:
|
|
|
|
- **Read-only.** No tool can create, edit, or delete transcripts or tasks.
|
|
- **Stdio-only.** No network listener. No TCP socket. No Unix socket.
|
|
- **Off by default.** You must explicitly launch it and add it to your MCP client's configuration.
|
|
|
|
The honest thing to flag: when you wire `lumotia-mcp` into an MCP client, that client gets read access to your entire transcript history and task list. There is no per-row permission system in v0.1. Treat it the same way you would treat giving a tool access to a folder of personal notes — only enable it if you trust the client end-to-end.
|
|
|
|
---
|
|
|
|
## Activation log
|
|
|
|
The activation log is opt-in and local-only. It records milestone events — first capture, first export, first task extracted — in the `lumotia_events` table in your local database. It contains no transcript text and no audio. Nothing is sent automatically. You can read it via Settings → Diagnostics → Activation log, and you can clear it or opt out from the same screen.
|
|
|
|
---
|
|
|
|
## Crash dumps and logs
|
|
|
|
Lumotia captures Rust panics and frontend errors to disk so you have something useful to attach if you file a bug report. Files are written to:
|
|
|
|
- `<app-data-dir>/crashes/` — panic and crash dumps
|
|
- `<app-data-dir>/logs/lumotia.log` — runtime log
|
|
|
|
Neither location contains transcript text or audio. The diagnostic-report bundler in Settings → About assembles a redacted snapshot from these directories; it skips transcript content and audio files by default. You decide whether to share the bundle.
|
|
|
|
On Linux, `<app-data-dir>` is typically `~/.local/share/uk.co.corbel.lumotia`.
|
|
|
|
---
|
|
|
|
## Your data, your machine
|
|
|
|
Lumotia is open source. The repository is public. The licence is to be finalised before public beta; current intent is a permissive open-source licence. You can read every line of code that handles your data, run the test suite, and verify the claims on this page yourself. If you find a discrepancy between this document and the codebase, file an issue — we will fix whichever one is wrong.
|