Your workspace is a folder on your machine.

A vault is a local folder. Nothing in it is uploaded by default. Ordinary Markdown, chart projection, and editor-sidecar reads are capped at 16 MiB per file. App-owned document and sidecar operations reject hardlinks, symlink or reparse-point paths, and parent or target identity swaps instead of following a sync race outside the vault. Wrengle binds operations to the exact vault root opened and refuses a linked .app layout. Its rebuildable search/RAG index lives in private OS app data outside vault sync, can contain derived note text, and rejects symlinked or hardlinked database targets. Deleting it rebuilds search content but resets local-only index preferences and workspace layout metadata.

Prompts and context stay on device when the selected model runs locally. Current local meeting-report backends wait until after Stop when they cannot prove that cancelled generation has quiesced before local transcription resumes. Provider preparation is logically cancellation-aware and bounded to 8.5 seconds for explicit Ollama or 20 seconds for other routes; Ollama model discovery uses one direct, no-proxy request capped at three seconds and 1 MiB. Non-abort-safe setup already inside synchronous platform code, such as a managed-local cold load, may continue quiescing after a timeout releases logical capture ownership.

Before the workspace opens, Wrengle requests macOS microphone and screen/system-audio capture access and preloads configured app-owned Keychain items through one serialized native lane. The preflight opens no capture stream, contacts no provider, refreshes no OAuth grant, verifies no account, and runs no workflow, action, agent, or plugin. OAuth/provider consent, plugin capability grants, agent permissions, workflow/action approvals, note-write proposals, and file/folder pickers remain contextual. Denied or unavailable supported access produces granular Limited mode; local vault and note work remains available, and feature buttons never trigger a later operating-system permission prompt. The current unpackaged Windows build cannot reliably request or report per-app microphone or system-audio permission, so startup reports native capture access as Not required without probing a device or the global desktop-app microphone switch. It does not enter Limited mode merely because that switch is off. A later device-open attempt can fail prompt-free, and Privacy always links to Windows microphone Settings for recovery.

The built-in assistant defaults to Auto. It prefers the most recently connected or successfully verified AI provider whose key Wrengle can read from the operating-system keychain, then OpenAI and Anthropic, before Wrengle Local. This availability check does not validate the key with the provider. Prompts, selected notes, and workflow context can be sent to the effective cloud provider shown in the UI. Explicit Local and provider choices remain sticky. Settings → Meetings → Reports → Cloud meeting report access discloses the exact resolved provider, effective model, and destination before report input is dispatched there; configuration remains under Settings → Models. Selecting a cloud model is your consent to send bounded transcript excerpts or text, bounded user-owned meeting-note text, and meeting title/prompt context to that provider; switch to a local model to keep report generation on device. Report requests send text, not meeting audio. Changing the resolved provider, model, or destination cancels an in-flight request bound to the old route. Each during-recording cloud request is durably claimed before dispatch; an unproven completion is not automatically replayed and requires explicit manual retry. Before a new post-Stop provider is prepared, Check note and retry performs a provider-free edited/malformed-region check; unresolved review makes no provider request. Meeting routing remains separate from voice and assistant Auto defaults.

After Stop is the clean-install final report-preparation default. Independent local final-transcript preparation is on by default when the device has enough decode capacity and continues in Manual report mode. Auto additionally requires Automatic generation, a saved note target, local final transcription with sufficient background decode capacity, and a capture-safe report route. Committed captions immediately produce a bounded, read-only Live draft without a provider, and refinement corrects the same caption; Report preparation Auto can supersede it with a validated Live AI draft for an eligible Automatic meeting. Both previews are process-memory-only and may change. They remain available through Stop and a UI reload while the active desktop process retains the session, but are never written to recovery, another disk file, logs, or telemetry. Rolling updates are serialized and source events coalesced. Physical Stop closes ordinary rolling dispatch. The bounded Stop drain lets an ordinary request admitted before Stop settle. If complete final coverage is still missing, a prewarmed provider may then receive at most one full six-field report request as the canonical tail when the entire bounded remainder fits one update. Prepared state is used only when the final frontier, schema, revision, exact route, destination, and note bindings match. Before a tail starts, an invalid remainder uses the canonical saved-transcript fallback, complete through 32,000 transcript characters and then five beginning/interior/end windows. Once a tail starts, Wrengle sends no second automatic request; ambiguous exposure or changed note context requires manual review and retry. User-owned note context is complete through 8,000 characters and uses the same five-window strategy above that cap. The report context is labelled Condensed whenever either cap applies. Choosing After Stop makes no report-provider request during capture. Cloud preparation can make several text requests, so provider billing, logging, and retention can apply even after a fallback. A content-free .app/live exposure claim is written before each cloud dispatch and marked complete after it settles; an ambiguous claim stops automatic provider work at Manual retry required. Automatic Ready follows the durable report-region and recovery-metadata writes; recovery cleanup and the best-effort whole-vault Git snapshot do not gate the UI.

After finalization, the bounded canonical transcript display state can remain in process memory for up to 30 seconds so a UI reload crossing immediate recovery cleanup can converge. Vault retirement revokes the handoff and its renderer stream; expiry and desktop restart also clear it. The handoff is not added to logs or telemetry.

Secret values are not persisted in vault files, app settings, frontend storage, logs, or telemetry. Startup enumerates allowlisted configured provider, speech, account, OAuth, action, current-plugin, Calendar-policy, and workflow secure items from non-secret metadata, reads them serially, and seals successful values in a Rust-only zeroizing process-session cache. It excludes orphaned, revoked, and opposite-environment entries. On macOS, each item can show its own dialog: Allow covers one access, Always Allow remembers the current app identity, and Deny limits only dependent capabilities. Features use the sealed cache and never fall through to another Keychain prompt. Explicit Save, Replace, and Remove actions for AI and transcription keys made while Wrengle is focused may show the item-specific macOS Keychain dialog; denying or canceling fails closed. Background token rotations and automatic cleanup remain prompt-free. Broker failed-mutation tombstones are never used to rediscover an old physical value at startup.

Gmail → Create draft is manual and never sends mail. It currently uses Dry run: upstream AI or Fetch output is simulated, while approving the displayed request creates a real draft. The Action step configures recipient and subject, takes its exact body from upstream output, and shows the complete draft before approval. The upstream body is limited to 100,000 characters, and an oversized full recovery snapshot is refused safely before provider contact. Wrengle durably stores the encrypted prepared intent and complete recovery snapshot before contacting Google. Approval expires after 24 hours and can be reopened after restart only with the same vault open; rejection, cancellation, and expiry make no Gmail request. The workflow/configuration, objective, artifacts and output paths, review/audit state, and exact request can remain encrypted for up to seven days; only the new bridge's content-safe plaintext metadata, opaque keyed bindings, and receipts can remain for up to 90 days. Recipient and subject remain in normal local workflow settings until edited or deleted; legacy preview-authored plaintext configuration can remain until app-data cleanup or uninstall. The action cannot run unattended or on a schedule.

Audio for the explicitly selected and consented final pass is sent to OpenAI or Deepgram. Meeting live captions and the default final transcription run locally; voice and assistant Auto defaults do not change this meeting boundary.

Speech and analysis default to Auto. Connected keys that Wrengle can read from the operating-system keychain select cloud routes without another setup toggle: speech prefers the most recently connected or successfully verified speech provider, then OpenAI, Deepgram, and ElevenLabs; analysis prefers the most recently connected or successfully verified AI provider, then OpenAI and Anthropic. The availability check does not contact the provider, so invalid, revoked, or quota-limited keys can still fail when a request starts. Auto falls back to local models when no eligible cloud route exists. Explicit Local and provider selections remain sticky. Local Whisper and local analysis keep audio, transcribed text, and personal-vocabulary hints on the device. Cloud dictation streams microphone audio; Deepgram and ElevenLabs also receive bounded vocabulary hints, while OpenAI Realtime Whisper does not. Cloud analysis separately sends transcribed utterance text, the active note title, bounded folder and recent-note paths, and the previous sentence when needed for cleanup, but not microphone audio or note bodies, to the effective AI provider. The Cloud voice features setting defaults on when unset; an explicit Off remains sticky, forces automatic voice routes local, and does not disable the assistant. The model-free microphone test stays local.

Strict temporary recovery records live inside the vault under .app/live/. Configured filesystem sync or backup can copy them to its service or another device while they exist. They can contain committed, refined, and final transcript text, selected meeting context, the exact note target and identity, a durable automatic-report request, content-free provider exposure claims, and a contiguous report attempt revision. Replaceable live partial captions remain memory-only. The records contain no raw meeting audio or memory-only prepared report state. A cloud preparation request is claimed before dispatch and marked complete after it settles so an unproven completion can require manual retry instead of automatic replay. A separate content-free owner lease refreshes every 15 seconds through capture, finalization, save, and detached automatic report work. Its monotonic generation and OS file lock fence cooperating Wrengle processes only when they open the same underlying lock-capable filesystem object in one clock domain. Orderly completion attempts release after a bounded helper drain without waiting indefinitely for lock contention or a stalled filesystem; if prompt release cannot finish, recovery becomes eligible when that filesystem's clock observes the last heartbeat as at least two minutes old. Ordinary synced replicas are separate, potentially stale objects, not a distributed lock; independently clocked or future-skewed replicas have no cross-device fencing guarantee. Descriptor-bound meeting-note reads and app-owned meeting-note writes fail closed above 16 MiB. Recovery reads and directory scans are capped; a malformed or oversized session is isolated as unsupported/discard-only, while a session with an unreadable or oversized owner lease stays hidden and fails closed without blocking valid siblings. Records are deleted after successful save/report, recovery, discard, or no-speech cleanup.

Open-note CRDT recovery data lives under the vault app-data area and can restore unsaved local editor state after reload or ordinary crashes. It is not server sync or cross-device collaboration.

Configured agents run as local subprocesses with normal OS permissions and can use their own upstream services. Wrengle scopes its ACP file tools to the vault; that does not OS-sandbox the selected command.

Privacy-minimized telemetry defaults on and can be turned off. If enabled and configured, only content-free product events and diagnostics are sent with a random identifier that lasts for the running app process.

Website telemetry is off until the visitor accepts it. PostHog receives explicit, content-free product event fields using random pseudonymous identifiers that the browser stores only in memory, plus necessary request metadata; public deployment is blocked until its production EU project discards IP data. Sentry receives minimized, redacted errors. Autocapture, pageviews, profiles, feature flags, tracing, and session replay are disabled, and the footer control withdraws consent.