The core privacy claim I want to preserve is that raw transcripts are analyzed locally on the user’s machine and are not uploaded to Polymath servers, nor are any reports unless the user approves them. The supabase project receives a hash of the analysis stages in a chained manner to make sure the reports have some lightweight tamper-resistance. The report content is not recoverable from those hashes, but I agree this still counts as outbound telemetry and should be documented clearly.
Will also fix the things you mentioned asap 1. API keys/secrets being redacted before sending transcripts 2. Readme and package copy being explicit about the tamper-prevention telemetry 3. Auto update behaviour disabled
Thanks for your feedback!
The core privacy claim I want to preserve is that raw transcripts are analyzed locally on the user’s machine and are not uploaded to Polymath servers, nor are any reports unless the user approves them. The supabase project receives a hash of the analysis stages in a chained manner to make sure the reports have some lightweight tamper-resistance.
The report content is not recoverable from those hashes, but I agree this still counts as outbound telemetry and should be documented clearly.
Will also fix the things you mentioned asap
1. API keys/secrets being redacted before sending transcripts
2. Readme and package copy being explicit about the tamper-prevention telemetry
3. Auto update behaviour disabled