AI Models & Data Privacy - Char

This page documents every way Char stores and processes your data. Nothing is hidden. Where possible, we include code snippets from the actual codebase so you can verify each claim yourself.

How data is stored

All core data is stored locally on your device as plain Markdown and JSON files — not in a database. This is a deliberate choice. Files are portable, inspectable, and yours. You can open them in any text editor, back them up however you want, or drop them into an existing vault alongside tools like Obsidian. There is no proprietary format or opaque data layer between you and your data. For more on why we believe in this approach, see The Filesystem Is the Cortex.

Nothing leaves your machine unless you explicitly enable a cloud feature.

Directory layout

Char uses two base directories. See Data for the full directory layout.

Global base (shared across stable and nightly builds):

models/stt/ — downloaded speech-to-text model files (Whisper GGUF, Argmax tarballs)
store.json — app state (onboarding status, pinned tabs, recently opened sessions, dismissed toasts, analytics preference, auth tokens)
hyprnote.json — vault configuration (custom vault path if set)
search/ — Tantivy full-text search index

On macOS, this is typically ~/Library/Application Support/hyprnote/. On Linux, ~/.local/share/hyprnote/.

The store.json keys are defined by this enum — nothing else is persisted through the Tauri store:

Vault base (customizable, defaults to the global base):

sessions/ — one subdirectory per session containing recorded audio, transcripts, notes, and attachments
humans/ — contact and participant data
organizations/ — organization data
chats/ — chat conversation data
prompts/ — custom prompt templates
settings.json — your app settings

Application logs are stored in the system app log directory as rotating files (app.log, app.log.1, etc.).

Session files

Each session gets its own subdirectory. Here is how Char loads session content from disk — this shows exactly what files exist per session:

Transcript data uses this structure — word-level timestamps, speaker channels, and optional speaker hints:

Audio recording

When you start a recording session, Char spawns three actors in parallel:

SourceActor — captures audio from your microphone and system speaker
RecorderActor — encodes audio samples into local MP3 recordings
ListenerActor — streams audio to your configured STT provider (cloud or local)

Here is the session supervisor that orchestrates these actors:

Audio is encoded into MP3 files on your local disk when recording retention is enabled. Here is the recorder handling incoming audio samples:

Audio files are stored at {vault}/sessions/{session_id}/audio.mp3 — they never leave your device unless you explicitly use cloud transcription.

Encryption

Char stores data as plain Markdown and JSON files on disk — formats you can read, move, and version-control yourself. Char does not currently add its own encryption layer. Your data is protected by your operating system's file permissions and any full-disk encryption you have enabled (such as FileVault on macOS or LUKS on Linux).

We are actively investigating end-to-end encryption (E2EE) to add an additional layer of protection. This would encrypt your data at rest so that only you can decrypt it, independent of OS-level encryption. We do not have a timeline yet, but it is a priority for us.

Cloud sync (optional)

Char supports optional cloud database sync.

When enabled: Your session data can be synced to a remote database. This is only active if you explicitly configure a cloud database connection.

When not configured: All data stays in local Markdown and JSON files on disk.

How data is processed

The following sections document every case where Char sends data to an external server. If a feature is not listed here, it does not send data externally.

Speech-to-text

Char supports both local and cloud transcription.

Local models run entirely on your device — your audio never leaves your machine:

Cactus models (Whisper Small/Medium in INT4/INT8 quantizations, with Apple NPU variants) — see Local Models
Argmax models (ParakeetV2, ParakeetV3, WhisperLargeV3) — downloaded as tarballs

For local model details and download instructions, see Local Models.

Cloud models send your audio to the selected provider for processing. Here is how the listener actor connects to your configured STT provider:

The ListenerArgs passed to the STT adapter contain the following — this is all the data sent to the provider along with your audio stream:

What is sent:

Your recorded audio (streamed in real-time or sent as a file for batch transcription)
Configured language preferences and keywords
The model name and API key for your provider

Where it goes depends on your setup:

Pro curated models: Audio is proxied through pro.hyprnote.com (our server) and forwarded to a curated STT provider. The proxy does not store your audio.
BYOK (Bring Your Own Key): Audio is sent directly from your device to the provider you selected.

Supported cloud STT providers:

Provider	Privacy Policy
Deepgram	Privacy Policy
AssemblyAI	Privacy Policy
Soniox	Privacy Policy
Gladia	Privacy Policy
OpenAI	Privacy Policy
ElevenLabs	Privacy Policy
DashScope	Privacy Policy
Mistral	Privacy Policy
Fireworks AI	Privacy Policy

Large language models

Char uses LLMs for summaries, enhanced notes, and chat. You can use cloud providers, bring your own key, or run models locally.

Pro Curated Models — Subscribe to Pro for curated cloud AI models that work out of the box.

BYOK (Bring Your Own Key) — Enter your own API key for OpenAI, Anthropic, Google, or Mistral.

Local Models — Run models locally using LM Studio or Ollama. See Local LLM Setup. Recommended: Gemma (Google) and Qwen (Alibaba).

When using cloud-based AI features, your session content is sent to the selected LLM provider. When using local LLMs, everything stays on your device.

Here is how the language model client is created — each provider connects directly to its own API:

When auto-enhance runs after a session ends, the enhanced result is stored locally:

An analytics event is also fired when auto-enhance runs — it includes only the provider and model name, not the content:

What is sent:

Transcript text, raw notes, and prompt templates
The content you are asking the AI to process

Where it goes depends on your setup:

Pro curated models: Requests are proxied through pro.hyprnote.com and forwarded to a curated LLM provider via OpenRouter. Nothing is stored by our proxy. We have Zero Data Retention (ZDR) enabled on our OpenRouter account, so all requests are routed exclusively to endpoints where the provider does not store your data.
BYOK providers: Requests are sent directly to the provider you selected (OpenAI, Anthropic, Google, or Mistral).
Local LLMs: Everything stays on your device. See Local LLM Setup.

MCP tools (Pro only)

Pro users have access to MCP tools for web search and URL reading during AI-assisted note generation.

What is sent:

Search queries (for web search)
URLs (for content extraction)

Where it goes:

Proxied through pro.hyprnote.com
Exa — web search
Jina AI — URL content reading

Analytics (opt-out available)

Char collects anonymous usage analytics by default to help improve the product. You can disable this entirely in Settings.

Here is the opt-out check — when disabled, the function returns immediately without sending anything:

What is attached to every analytics event — this is the complete enrichment logic:

What is sent:

Event names (e.g. "session_started", "transcription_completed")
App version, build identifier, git hash, bundle ID
A device fingerprint (a hashed machine identifier via hypr_host::fingerprint(), not your name, email, or IP)
When signed in: your user ID and email (for account-linked analytics)

Where it goes:

PostHog — product analytics. Privacy Policy
Outlit — product analytics

The analytics client sends events to both services:

How to disable: Go to Settings and turn off analytics. When disabled, no analytics events are sent — the is_disabled() check short-circuits the entire flow.

Error reporting (Sentry)

Char uses Sentry for crash reporting and error tracking in release builds. Here is the complete initialization:

What is sent:

Error messages, stack traces, and crash dumps
A device fingerprint (hashed machine ID via hypr_host::fingerprint()) — no name, email, or IP
App version and platform information (hyprnote-desktop@{version})
The tag service: "hyprnote-desktop"
auto_session_tracking is explicitly set to false

Where it goes:

Sentry — error monitoring. Privacy Policy

Network connectivity check

Char periodically checks if your device is online. Here is the complete implementation:

What happens:

A HEAD request to https://www.google.com/generate_204 every 2 seconds
No user data, cookies, or identifiers are included — it is a bare HEAD request
The response is only used to determine if the device is online (boolean)

Model downloads

When you download a local STT model, Char fetches the model file from a hosting server.

These are the supported local models:

What happens:

Standard HTTP download requests to S3 (Whisper models) or Argmax hosting servers
No user data is sent
Downloaded models are verified with checksums before use

App updates

Char checks for updates automatically in release builds and downloads them in the background when one is available.

What is sent:

Your current app version and platform

Where it goes:

CrabNebula — release hosting and update distribution

How often:

An update check runs roughly every 30 minutes while the app is open
If an update is found, the app downloads it and installs it on the next restart

Authentication (when signed in)

When you sign in for Pro or cloud features, Char authenticates via Supabase.

What is stored locally:

Auth session tokens in the local Tauri store (store.json)
Account info: user ID, email, full name, avatar URL

What is sent:

Authentication requests to Supabase during sign-in
Auth tokens to pro.hyprnote.com when using Pro features

Summary

Char does not:

Train AI models on your data
Sell your data to third parties
Collect your audio, transcripts, or notes for any purpose other than the features you explicitly use
Send your meeting content in analytics — analytics only includes event names and app metadata
Lock your data in a proprietary database — everything is plain Markdown and JSON files you can open, move, and use with other tools

To keep meeting content fully local: Use a local STT model for transcription and a local LLM (LM Studio or Ollama) for AI features. Your audio, transcripts, notes, and prompts stay on your device. Background network traffic can still come from the connectivity check, update checks/downloads, analytics if enabled, and crash reporting in release builds.

To maximize privacy:

Use a local STT model for transcription — see Local Models
Use a local LLM (LM Studio or Ollama) for AI features — see Local LLM Setup
Disable analytics in Settings
Do not sign in or enable any cloud features
Enable full-disk encryption on your OS (FileVault, LUKS, BitLocker)

Open source

Char is open source. You can verify everything documented here by reading the code: