Privacy and data
What is stored where, what is sent to which engine, and how keys and reviews are handled.
In short
Thesivor is local-first. Your project folder is the record, keys live in your operating system's secure storage, and only the material a step needs is sent to the engine you chose for that step. There is no telemetry.
What is stored where
| Data | Where |
|---|---|
| Your authored work (rounds, notes, claims, documents, versions, literature, reviews) | record/ in the project, tracked in git |
| Fast cache (SQLite) | .thesivor/, gitignored, rebuilt from record/ |
| API keys and tokens | The OS secure storage, never a file, never the renderer |
| Writing-voice samples | The app's user data, never inside a project |
| Voice recordings | In memory only, unless Keep recordings is on |
| Downloads (Python, Tectonic, models) | The app's data folder |
What is sent, and to whom
- Only the material a step needs goes to the engine chosen for that step: the passage for a voice edit, the paper text for a literature note, the crop for a Vault Vision extraction, and so on.
- PDF text is treated as untrusted data, never as instructions, in every prompt.
- A CLI agent gets a minimal environment and its own workspace; Thesivor's keys are never passed to it.
- Review tasks run only on the engine you pick explicitly.
Confidential reviews
Peer reviews are kept out of git by default, never deposited to Zenodo, and never placed in a CLI agent's workspace. There is a per-project toggle to include them in git for private repositories.
Keys
Keys are written with Electron safeStorage, which uses the OS secure storage. If the OS store is unavailable the app refuses to save rather than writing plaintext. The renderer never receives a key.
For technical users
Audio is captured at 16 kHz mono and sent once to the chosen speech provider; nothing is written to disk unless you keep it. The window may open only the microphone. Zenodo deposits never include keys, writing-voice samples, record/ internals or .thesivor/. There is no log file and no diagnostics export in 0.1.0 — the deployment document's promise of local logs is stale; run the app from a terminal to capture output. Nothing is uploaded by this documentation site: it is static, with no analytics.