SwarLocal is a local-first macOS application designed to prioritize user privacy and on-device data processing. Below are the key security and privacy mechanisms implemented.

• On-Device Only: API keys for external services (OpenAI, Google Gemini, Open WebUI) are stored locally in the .local/settings.json file.
• Git Excluded: The .local directory is listed in .gitignore and is never committed to version control.
• UI Masking: API keys retrieved from settings are masked at the API boundary before rendering (e.g. sk-a...3456). Input fields display masked visuals to prevent visual leakage.
• Local Deletion: Users can remove keys at any time through the Settings interface or REST calls (DELETE /settings/openai-key or DELETE /settings/gemini-key), which completely wipes the stored credentials from local storage.

• Zero Audio Uploads: Voice audio captured via the browser's microphone is processed and transcribed entirely on-device by the local Faster Whisper model.
• Local Synthesis: Text responses generated by the LLM are synthesized into speech on-device by Piper TTS.
• Transcripts Only: If a cloud provider (OpenAI or Gemini) is selected, only the text prompt is sent to the cloud. Audio recordings are never transmitted to OpenAI, Gemini, or any other cloud endpoint.

• Ephemeral Turns: By default, turn-by-turn conversation audio recorded for processing is immediately deleted after transcription is complete.
• Explicit Logging: Audio is only persisted if keep_turn_audio is manually enabled by the user in settings, in which case the files are kept offline in .local/audio_cache/.

• Local Dataset: Voice training samples recorded in Voice Studio are stored exclusively in the offline .local/dataset directory.
• Consent Signature: Recording requires explicit confirmation and signing of a consent form. Training workflows remain completely user-owned.