Privacy, without the fog

Policy version: 2026-09-28. This version covers the public website and a reviewed engineering snapshot of the unreleased desktop app; it does not announce a desktop release.

Voice practice and the microphone boundary

Some exercises ask you to make Take A and Take B. On the current website, that recording happens in a recorder you choose outside Ptichi. The website does not capture, upload, analyze, score or automatically save that audio because it never receives it.

Your recorder, operating system or other app has its own storage and privacy behavior. Ptichi cannot clear a recording that was made outside the website.

This describes the website that is public now. It is not a promise about an unreleased desktop build or a future optional integration. Those boundaries must be documented when the corresponding capability is actually released.

Why local-first is part of the practice design

Privacy can sound like paperwork added after the product is built. For voice practice, it changes the practice itself.

The most useful material is often the material you would least like to upload casually: a difficult explanation before a meeting, an awkward first attempt, a second-language answer, a story involving another person, or a work message that is not meant to become training data for anything.

If every useful rehearsal begins with:

Upload your recording.

people have to solve a privacy problem before they can solve the speaking problem.

Ptichi's desktop direction is therefore local-first by default: raw audio, derived personal state and real-work text are intended to remain on the device unless a future feature has a clear, explicit boundary that says otherwise. That is current product design, not a claim that an unreleased desktop build has already passed every platform/release test.

Local-first makes ugly first takes easier to keep ugly

A useful Take A is allowed to be unfinished.

It may ramble. The wording may be rough. You may restart. You may say a client's name by mistake and immediately decide that the recording should not exist anymore.

The product should make that feel like practice, not publication.

This is one reason local delete/export/reopen controls matter. They are not glamorous features, but they support a psychologically useful boundary: this attempt belongs to the session unless you choose to move it elsewhere.

That boundary is especially relevant for a product whose job is to capture versions you may not be proud of yet.

Local-first also keeps the feedback problem smaller

Cloud analysis can be useful when it is justified. It can also encourage a product to collect everything because collection is technically convenient.

Ptichi is taking the opposite direction for the core rehearsal loop. If the useful question can be answered from local replay, a bounded local metric or a listener task, the product should not need a remote service merely to make the workflow look more intelligent.

This forces a useful design discipline:

• what does the person actually need to know after Take A?
• what evidence is necessary for that decision?
• can the product show less rather than collect more?

A smaller data path often creates a smaller feedback path too.

“Local” does not mean magically invisible

A local-first product still has to be precise about what it owns.

The operating system may keep recent-file traces. Backups may copy application data. An exported WAV is outside the application's managed deletion boundary. A user can paste rehearsal text into another app. A future optional integration may have a different network boundary.

So “local-first” should not become a slogan that means “nothing can ever leave this computer.” It should mean the default rehearsal path does not silently require your speech to leave the device, and the product states clearly when that boundary changes.

That is a much more boring promise. Boring promises are easier to audit.

Text you enter during practice

The cue card and rehearsal notes work in the current tab without an account. Ptichi does not upload, interpret or automatically save what you type there. Use non-confidential examples; the page does not check the facts in your message.

“Start over” clears the card and comparison fields. Copy actions put text on your device clipboard only after you press them. Clearing the page does not erase a clipboard copy or text you already pasted into another app.

What the website does

The current site has no sign-up form or checkout. Optional Google Analytics is managed through Google Tag Manager and stays off until you consent to page statistics. Before that choice, the site sends no analytics request to Google. A denied or granted choice is stored in your browser so the site can respect it. Fonts, illustrations and other site assets are served as part of the website.

Opening a webpage still sends a network request. Hosting infrastructure receives information needed to deliver and protect the service, such as an IP address and request details. Ptichi uses Vercel; its privacy notice describes the provider's practices. This page does not promise that hosting logs are absent or assign them an unverified retention period.

You can change your saved choice in the analytics controls at the end of this page. Turning analytics off reloads this page to stop scripts already loaded here. Other open Ptichi tabs ask you to reload; copy any rehearsal notes first. This stops future analytics loading in those tabs after reload, but does not delete information already sent to Google.

What the desktop engineering snapshot currently does

The desktop app is still unreleased. In the reviewed engineering snapshot, recordings, session state, settings and a bounded product-event ledger stay in the application-managed local profile. There is no production remote analytics adapter, crash reporter, update client or user-content upload path.

Those data classes have separate controls. Managed recordings and sessions can be deleted; future product-event writes can be paused and their history deleted separately; the Microphone Passport has its own deletion control. Language preferences are not silently erased when recordings are deleted.

Recording export and diagnostic export happen only after an explicit user action and destination choice. Exported WAV or diagnostic files, operating-system backups and synced copies are outside Ptichi's managed profile, so an in-app delete action cannot remove them. No secure-erasure claim is made.

For a worked example, read what deleting a voice recording should remove. It separates a saved practice, an exported WAV and copies held elsewhere, with a small retention check you can try in your own recorder. The Ptichi details describe reviewed development source, not a public desktop release.

This is a source-reviewed boundary, not proof of packaged Windows/macOS behavior or public availability. It must be checked again before a release manifest can offer an installer.

Website, search engine, desktop app

These are different boundaries. Search engines can discover public page addresses through a sitemap or a URL submission. That does not require sending a reader's voice or rehearsal text.

There is no public Ptichi desktop release today. The website must not present private development plans as released capability. If a future desktop build or optional service sends content elsewhere, its public release information and privacy explanation must state that boundary before use.

Contact and external links

The contact page shows current contact availability. This website does not currently offer a private upload channel. Do not send recordings, client material or credentials through unrelated external links.

Following an external source takes you to another service with its own policies. A link is not an embedded tracker on this page.

Changes and questions

If a future feature needs accounts, uploads or feedback collection, this explanation must change with that feature. The review date records the version described here, not a permanent guarantee. Contact availability is stated on the contact page.