Privacy, in plain words

Halo runs in your browser. Faces, photos and face fingerprints stay on your phone. There is no account, no analytics and no server that holds your people. This page says exactly what is kept and what can leave, and a test in the code fails if the app ever drifts from it.

What is kept, where, and for how long

The people you add: Name, your note, the line it whispers, cue notes, where you met, whether they’re a child or “never whisper”, when and how they agreed, 3 to 8 face fingerprints (128 numbers each, from the photos you take) and one small picture (160 by 160 pixels). In this browser’s IndexedDB on your phone, encrypted with AES-GCM using a key the browser creates and won’t let any code read out. Kept until you delete that person or everything; nothing is deleted on a timer. After a year, Halo reminds you to ask them again.
Today’s list, practice, the privacy ledger, wrong-match reports: In the same encrypted store, until you clear them or delete everything.
Settings: Voice, volume, theme, quiet hours and similar, in the browser’s local storage. No names, notes or faces. If you set a passcode, only a salted hash of it is kept, never the code.
The app itself: Code, fonts, face models and WebAssembly, cached by a service worker so Halo works offline. No personal data is in that cache.
In memory only: Camera frames and the fingerprints of faces in view are compared with your list and dropped straight away; they’re never written down. “Who was that?” keeps the last five whispers until you close Halo.
Photos: Not kept. A photo is turned into a fingerprint and thrown away; only the small picture for your list remains.

What leaves your phone

By default, nothing about your people. The page’s Content Security Policy allows connections only to its own address (connect-src 'self'), and the only requests are for the app’s own files.

Enhanced mode is off unless you turn it on, and asks first. Then, and only while you’re online, Halo sends these requests to its own server at the same address, and lists each one under “What has left this phone” in the app:

/api/session: nothing personal; it starts a one-hour session.
/api/voice: the exact line Halo will whisper (up to 200 characters) and its language, to make a natural voice, once per person.
/api/translate: the line (up to 300 characters) and the language you chose, to translate it.
/api/write: a name and the note you typed (up to 60 and 500 characters), only if you turn on the cloud writer.

The server runs Cloudflare Workers AI models, keeps nothing, and logs no request content. Its code also has a /api/transcribe route for short voice notes, which this version of the app doesn’t call.

Dictation is optional. If you tap the microphone, your browser’s own speech recognition may send the audio to the browser maker (Google, in Chrome) to turn it into text. Typing stays on the phone.

Links you choose to send, a consent question, an answer, or a helper’s card, carry text inside the link after the #, which browsers never send to a server. Whatever app you send the link with can read that text. Links never contain photos or face fingerprints.

Backups are a file locked with a passphrase you choose. Where you keep it is up to you.

The website host sees ordinary request logs, as for any website: your IP address, the time, and which file was asked for. Never your people.

What is never sent

Faces, camera frames or photos.
Face fingerprints or the small pictures.
Your list of people, today’s list, practice or reports.
Anything to advertisers or analytics: there are none.

Whose consent it is

The consent belongs to the person you add. Halo asks them to read the exact line it will whisper and agree on your phone, or answer by link on theirs. It records when and how they agreed, but it can’t check that it was really them. They can change their mind at any time: remove them in one tap, and their fingerprints, note and picture are gone from your phone. If you add a child, ask a parent or carer first; Halo will only ever suggest “Could be” for a child.

Deleting

One person: open them, then Remove.
Everything: Settings, then Your data, then Delete everything. The data and the key go together.
Wipe now: one button in Your data clears the store, the offline cache, the service worker and settings at once, and closes Halo.
Clearing this site’s data in your browser does the same.

Locking

You can lock Halo with a passcode or your phone’s own screen lock (fingerprint or face, through the browser). The lock stops someone who picks up your unlocked phone from opening Halo. It doesn’t add a second layer of encryption: your data is already encrypted with the browser’s key, and a person with full access to your unlocked phone and its developer tools could still reach the browser’s storage.

This page describes the app as it is in this repository. If the code changes what leaves the phone, a test (tests/unit/privacy-drift.test.ts) fails until this page is changed too.