# DeskCapsule privacy policy

Last updated: 14 August 2026. DeskCapsule is not yet a public production release. This document describes the intended product behavior and the release gates for cloud processing.

## Summary

DeskCapsule is local-first. Media state, clipboard history, managed screenshots, notes, local translation, Local Whisper audio and local transcription are processed on the current Windows device. DeskCapsule does not sell user data and does not add advertising trackers.

Network processing occurs only for an explicit SOVREST license operation, update check or user-initiated Pro cloud action. DeskCapsule does not accept personal Groq or other provider keys and does not contact Groq directly.

## Local data

| Data | Location and retention | User control |
|---|---|---|
| Settings | `%LOCALAPPDATA%\DeskCapsule\settings.json` | Edit in Settings or local wipe |
| Clipboard text | Local SQLite database | Capture opt-in, pin, delete, clear, retention setting |
| Screenshots | Managed PNG files and SQLite metadata | Capture opt-in, copy, delete, clear, retention setting |
| Notes | Local SQLite database and bounded crash-recovery state | Create, edit, pin, delete, export, wipe |
| Local Whisper models | `models\whisper` | Explicit download and delete |
| Local translation packs | Dedicated local model directory | Explicit download and delete after catalog is approved |
| License state | DPAPI CurrentUser protected file | Deactivate or include in explicit wipe |
| Diagnostics | Bounded scrubbed JSONL | Inspect and delete locally |

The technical safety maxima are 500 clipboard entries, 100 pinned entries, 250 screenshots and 500 notes for every license state. User-selected age retention may remove older clipboard entries and screenshots earlier.

SQLite and screenshot files are protected by current-user filesystem access controls but are not fully encrypted. Other processes running as the same Windows user, backup tools and administrators may be able to read them.

## Clipboard and screenshots

Capture is disabled by default and is controlled separately for text and images. Password and privacy markers exposed by supported Windows clipboard formats are honored where available. DeskCapsule cannot infer whether arbitrary unmarked text is sensitive.

Clipboard images are decoded with size and format boundaries and saved as managed PNG files. Image content is not placed in text history. Neither collection is sent to SOVREST.

## Media

DeskCapsule reads the current Windows system media session to show title, artist, playback state and an optional session-provided thumbnail. It does not search for artwork online. Media metadata and decoded artwork remain in UI memory and are not added to DeskCapsule databases.

## Translation

Free local translation processes RU/EN text on the device with a user-installed, verified model pack. Source text and translated text are not automatically persisted.

Pro AI translation is an explicit cloud operation. After the user presses Translate, DeskCapsule may send the following to SOVREST over HTTPS:

- source text;
- source language or automatic-detection choice;
- target language;
- public application identifier;
- short-lived SOVREST bearer token;
- bounded protocol metadata required for reliability.

DeskCapsule does not send clipboard history or notes implicitly. If a user pastes such content into the translator, it becomes part of the explicit request.

When SOVREST AI translation is unavailable because of connectivity, timeout, rate limiting or an upstream failure, the client may fall back to an installed local model. Authentication, entitlement, invalid-request and policy failures must not be hidden by a cloud retry. The interface must identify the actual processing mode.

The SOVREST integration contract states that translation text is not stored. Request metadata such as language pair, volume and status is retained for 90 days for billing and abuse protection. Production cloud translation remains blocked until SOVREST enables the final DeskCapsule application and paid plan and the remaining processing-region and subprocessor disclosures are approved.

## AI Chat

AI Chat is a Pro-only explicit cloud feature. The application keeps conversation history only in process memory. A request may contain the current prompt and the bounded in-memory context needed to answer it. Closing the application or starting a new chat removes that in-memory history.

AI Chat does not automatically attach clipboard entries, screenshots, notes, files, media metadata or diagnostics. The SOVREST integration contract states that message and reply text is neither stored nor logged. Token volumes, request status and license/application identifiers are retained for 90 days for billing and abuse protection. Production enablement requires server-side paid entitlement enforcement for `/api/ai/chat` and approval of the remaining region and subprocessor disclosures.

## Voice input

Microphone capture starts only after the user enables voice input and activates the selected keyboard or mouse gesture. The interface provides a visible recording state and signal feedback.

Free Local Whisper keeps audio in process memory, processes it on the device and inserts the resulting text into the previously validated writable target. Normal operation does not save the WAV or transcript to disk.

Pro cloud voice sends the completed in-memory recording to SOVREST only after an explicit recording action. The request uses `POST /api/ai/transcribe`, the documented audio formats and a 15 MB maximum. Optional language and spelling prompt fields may accompany the recording. The SOVREST integration contract states that audio and transcript text are processed in memory and are neither stored nor logged. Duration, status and license/application identifiers are retained for 90 days for billing and abuse protection. There is no automatic local-to-cloud switch. Live use remains fail-closed until the final DeskCapsule application metadata is embedded, STT is enabled for the approved paid plan and the remaining region and subprocessor disclosures are approved.

DeskCapsule does not request or store a personal Groq API key. A legacy development credential file is deleted during migration without reading its contents.

## Keyboard-layout assistance

Double Shift and automatic RU/EN correction are opt-in local features. The low-level monitor observes bounded key categories required to recognize a completed physical RU/EN token. It does not create a general keystroke log. Replacement is attempted only in a validated foreground text target. No typed content is sent to SOVREST by these features.

## Licensing and updates

License calls may include public app and SKU identifiers, license key for activation, installation UUID, OS/app metadata and short-lived tokens. License credentials are protected with DPAPI CurrentUser. SOVREST license calls do not contain clipboard, screenshot, note, translation, chat or voice content.

Update checks may expose normal HTTPS metadata such as IP address, timestamp, user agent and requested package version to the configured update host.

## Diagnostics

Diagnostics are bounded and scrubbed. They may contain timestamps, event categories, exception type and HRESULT. Logger APIs reject user content, full paths, tokens, license keys, audio, transcripts, prompts, translations and response bodies. Support should request the smallest redacted artifact necessary.

## Deletion and export

Settings provides a preview before local wipe. The user can delete selected collections or the complete DeskCapsule profile. License state is removed only when explicitly selected. Deleting local files does not delete records held by SOVREST; server-side deletion follows the approved SOVREST policy and support process.

## Contact

Privacy and deletion requests: [SOVREST support](https://sovrest.com/profile/support). Never include a license key, bearer token, private note, screenshot, audio recording or full diagnostic archive in the first message.
