# Privacy

Linnet is designed for sensitive conversations. Medical appointments, HR discussions, legal calls, and family situations where the stakes of surveillance are real. Privacy is an architectural constraint, not a policy.

## Audio

**Audio never leaves your machine.** Transcription runs locally via Whisper. Tone annotation runs locally via a wav2vec2-based SER (speech emotion recognition) model. No audio is transmitted anywhere at any point.

This is true on the Free tier and the Paid tier.

## Session data

Session transcripts, tone timelines, speaker maps, and corrections are stored in a local SQLite database on your machine. The database location is configurable via `LINNET_DATA_DIR` in `.env`.

Linnet does not sync, back up, or transmit session data to CircuitForge servers or any third party.

## Telemetry

Linnet does not collect telemetry by default. No usage analytics, no crash reports, no feature tracking. The docs site uses [Plausible Analytics](https://plausible.io) (privacy-preserving, no cookies, no cross-site tracking) but the application itself does not.

## Correction data

Corrections you make to transcripts are stored in a local dataset and used to fine-tune your local Whisper checkpoint. Correction data is never uploaded to CircuitForge. Retraining happens entirely on your hardware.

## Translation

Translation is the only feature that contacts an external server. When you translate a session, transcript text (not audio) is sent to DeepL. DeepL's privacy policy governs how they handle that data.

If your conversations are sensitive enough that even text transmission is a concern, do not use translation.

## What CircuitForge receives

| Data type | Received by CF |
|-----------|---------------|
| Audio | Never |
| Transcript text | Never |
| Tone annotations | Never |
| Session metadata | Never |
| Correction data | Never |
| License key validation | Yes (key hash only, no session content) |
| Docs site visits | Yes (Plausible, aggregated, no PII) |

## Self-hosting and air-gapped use

Linnet is designed to run on your hardware without any outbound connections. For fully air-gapped operation:

- Pre-download the Whisper and wav2vec2 model weights during setup
- Set `DEEPL_API_KEY=` to blank (disables translation)
- Do not configure a license server endpoint

See the [air-gapped deployment guide](https://git.opensourcesolarpunk.com/Circuit-Forge/linnet) in the repo for full offline setup instructions.