{% extends "base.html" %}
{% block title %}What leaves this computer — Video to LLM{% endblock %}
{% block content %}
{#
The badge in the header makes a promise. This is where it is cashed.
Two halves, and the split is deliberate. The mechanisms are properties of the
program that are true whatever you have done with it — each one is enforced in
code and has a test that fails if it regresses. The state below is what is
true on *this* machine right now, read live. Neither is marketing copy: a line
that cannot be checked does not belong on this page.
#}
What leaves this computer
Nothing, unless you ask for it — and here is exactly how that works.
Right now, on this machine
Descriptions
{% if privacy.describing %}
on by default — {{ privacy.default_service }}
{% else %}
off by default. A job that leaves them off makes no network request.
{% endif %}
Pictures sent, ever
{% if privacy.pictures_sent %}
{{ "{:,}".format(privacy.pictures_sent) }}
across {{ privacy.jobs_that_sent }} job{{ "" if privacy.jobs_that_sent == 1 else "s" }}
{% else %}
none — no job on this machine has sent anything to a service
{% endif %}
Videos processed
{{ "{:,}".format(privacy.videos_processed) }}, none of them copied, moved, or uploaded
Keys stored
{% if privacy.services_with_keys %}
{{ privacy.services_with_keys | join(", ") }} — held in this computer's secure store
{% else %}
none
{% endif %}
Address
{{ privacy.bind_address }} — reachable from this computer only
How it is enforced
Each of these is a property of the program, not a policy. Each has a test
that fails if it stops being true.
The interface binds 127.0.0.1, and that is
asserted when the application is constructed. It cannot be configured to
listen anywhere else.
One check runs before every screen and every action: a request claiming a
different host is refused, and so is any write or read arriving from
another origin. Without it, a page you merely had open in another tab
could delete a job or start one that spends money.
No page loads anything from anywhere else — no fonts, no scripts, no
stylesheets, no images from a network. The badge in the header would be
false the moment one did.
Your source videos are read where they are. Nothing is copied, moved, or
altered.
Keys live in this computer's secure store — Keychain on a Mac, Credential
Manager on Windows, the Secret Service keyring on Linux. Where there is no
secure store, storing is refused rather than falling back to a file.
No key is ever shown back to you, not even the first few
characters, and none is written to the database, the logs, a manifest, an
export, or a collection.
There are no accounts, no sign-in, and nothing is measured or reported
about how you use this.
Describing on this computer never quietly becomes describing somewhere
else. There is no automatic fall back to a paid service.
When a service is chosen, it receives the numbered still pictures
and nothing else. Never the video file, never the audio, never the
transcript. You are shown the count and the estimated cost first, and the
run stops at a limit you set.
Checking for yourself
None of the above requires taking our word for it.
Disconnect from the network and process a video. Everything works.
Point a network monitor at this process. With descriptions off there is
nothing to see.
Read docs/SECURITY.md in the repository, which
lists what would count as a bug in any of this.