Local only means local when the selected workflow runs locally.

Prompts and context stay on your machine when the selected model actually runs locally. Selecting Local explicitly remains sticky when keys change. Local Whisper keeps dictation and meeting audio on the device, and local voice analysis keeps command and cleanup text there too. Current local report backends wait until after Stop when they cannot prove that cancelled generation has quiesced before transcription resumes.

Dictation speech, voice analysis, and the built-in assistant default to Auto. Connected keys that Wrengle can read from the operating-system keychain make cloud routes eligible without another setup toggle. Speech prefers the most recently connected or successfully verified speech provider, then OpenAI, Deepgram, and ElevenLabs before Local Whisper. Analysis and the assistant prefer the most recently connected or successfully verified AI provider, then OpenAI and Anthropic before Wrengle Local. Keychain availability does not validate the key with the provider. The effective provider is shown; explicit Local and provider choices and turning Cloud voice features off remain sticky. If a routing-critical saved preference cannot be read, assistant and voice starts pause behind a retryable settings error instead of displaying a guessed Local or Off preference.

Provider credentials stay in the operating-system keychain. Before the workspace opens, Wrengle enumerates allowlisted configured provider, speech, account, OAuth, action, current-plugin, and workflow secure items from non-secret metadata and loads successful reads into a Rust-only zeroizing process-session cache. The renderer receives readiness, never secrets. This preflight contacts no provider, refreshes no OAuth grant, verifies no account, and runs no workflow, action, agent, or plugin. Only connected keys that were successfully read from the keychain qualify for Auto; denied or unavailable items limit dependent capabilities. Provider validity is checked only when a request is made, so invalid, revoked, or quota-limited keys can still fail then. Settings → Meetings → Reports → Cloud meeting report access discloses the exact resolved provider, effective model, and destination before report input is dispatched there; configuration remains under Settings → Models. Selecting a cloud model is your consent to send bounded transcript excerpts or text, bounded user-owned meeting-note text, and meeting title/prompt context to that provider; switch to a local model to keep report generation on device. Report requests send text, not meeting audio. Changing the resolved provider, model, or destination cancels an in-flight request bound to the old route. Each during-recording cloud request is durably claimed before dispatch, and an unproven completion requires explicit manual retry; it is not replayed automatically. Before a new post-Stop provider is prepared, Check note and retry performs a provider-free edited/malformed-region check; unresolved review makes no provider request. Cloud dictation separately streams microphone audio to the selected speech provider, and cloud voice analysis sends only the documented text context.

After Stop is the clean-install report-preparation default. Independent local final-transcript preparation is on by default for eligible devices and does not authorize report or network work. Auto additionally requires Automatic generation, a saved note target, local final transcription with sufficient background decode capacity, and a capture-safe report route. Committed captions immediately produce a bounded, read-only Live draft without a provider, and refinement corrects the same caption; Report preparation Auto can supersede it with a validated Live AI draft for an eligible Automatic meeting. Both previews are process-memory-only and may change. They remain available through Stop and a UI reload while the active desktop process retains the session, but are never written to recovery, another disk file, logs, or telemetry. Calls are serialized, source events coalesced, and state bound to the exact route. Physical Stop closes ordinary rolling dispatch. An ordinary request admitted before Stop may settle. If complete final coverage is still missing, a prewarmed provider may then receive at most one full six-field canonical tail when the entire bounded remainder fits one update. Wrengle accepts prepared state only when coverage, schema, revision, route, destination, and note bindings still match. Before a tail starts, an invalid remainder uses the canonical saved-transcript fallback, complete through 32,000 transcript characters and then five beginning/interior/end windows. Once a tail starts, Wrengle sends no second automatic request; ambiguous exposure or changed note context requires manual review and retry. User-owned note context is complete through 8,000 characters and uses the same five-window strategy above that cap. The report context is labelled Condensed whenever either cap applies. Choosing After Stop makes no report-provider request during capture. Provider preparation is logically cancellation-aware and bounded to 8.5 seconds for explicit Ollama or 20 seconds for other routes; Ollama model discovery uses one direct, no-proxy request capped at three seconds and 1 MiB. Non-abort-safe setup already inside synchronous platform code, such as a managed-local cold load, may continue quiescing after a timeout releases logical capture ownership.

The bounded canonical final transcript display state can remain in process memory for up to 30 seconds after terminal cleanup. It is available only to the exact open-vault epoch, clears on vault switch, expiry, or desktop restart, and is not added to logs or telemetry.

Wrengle can include the current note, selection, or workspace context in a prompt when that workflow needs it.

ACP file tools are scoped to the vault, but the agent command runs as a local subprocess with normal OS permissions.

Hosted behavior depends on the selected service and is not a local-only workflow.

Privacy-minimized desktop telemetry uses a random process-scoped identifier, defaults on, and can be turned off. Website analytics and diagnostics stay off until a visitor explicitly accepts them. The optional PostHog and Sentry flows are content-free or redacted and never collect note content, transcript text, or vault data.