Privacy & Reliability 隱私與可靠性

This is the trust-but-verify page. Everything here is implemented in code you can read at github.com/bobo52310/TypeLate.

• API keys are written to Tauri’s local secure store. They never leave your device.
• Audio is uploaded directly to the provider you configured, over HTTPS, with your API key. TypeLate doesn’t proxy, log, or replay it.
• Text is sent to the LLM provider for enhancement (when enhancement mode isn’t None). Same direct-HTTPS pattern.

External calls TypeLate makes that aren’t about transcription:

What	When	Why	Opt-out
GitHub Releases	When you click Check for Update in About	Pull update metadata via Tauri updater	Don’t click the button
Google OAuth + Drive	Only after you connect Drive sync	Vocabulary sync to your appDataFolder	Don’t connect, or disconnect
Sentry (if enabled)	When an exception happens in production builds	Crash diagnostics — see below	Build from source without VITE_SENTRY_DSN

There are no usage analytics, no fingerprinting, no phone-home heartbeats. The list above is exhaustive.

If VITE_SENTRY_DSN is set at build time (it is, for the official Releases), TypeLate uses Sentry to report crashes and uncaught exceptions only. The configuration:

• sendDefaultPii: false — Sentry’s PII stripping is enabled. Email addresses, IPs and similar fingerprints are scrubbed before send.
• Performance tracing default sample rate: 0 (disabled). Override at build time with VITE_SENTRY_TRACES_SAMPLE_RATE.
• Errors carry context tags — which window the error occurred in (dashboard or hud), which step of the pipeline (transcription / enhancement / DB / etc.).
• Errors do not carry your transcript text, raw audio, API keys, or recording filenames.

There’s currently no in-app toggle to disable Sentry. If that’s a deal-breaker for you, build from source with the DSN env var unset — Sentry initialisation no-ops when the DSN is missing.

Whisper occasionally produces text where there was no speech. TypeLate has a three-layer filter to catch the most common false positives before they get pasted.

Layer 1 — Speed anomaly

If Whisper returns a long string from a recording shorter than its theoretical processing time, it’s a hallucination, not transcription.

• Trigger: audioDuration < 1000ms AND result.length > 10 chars.

Layer 2 — No-speech detection

Three sub-checks combine audio-energy stats with Whisper’s own no_speech_prob (NSP):

Sub-check	Trigger
2a	Peak audio energy < 0.02 (true silence)
2b	Peak 0.02 – 0.03 AND RMS < 0.015 AND NSP > 0.7 (low signal, model agrees)
2c	NSP > 0.9 regardless of peak (model is very confident)

Layer 3 — Known hallucination patterns

A blocklist of ~46 phrases that Whisper often hallucinates from training-data residue (subtitle watermarks, “thanks for watching”, “subscribe to my channel”, various Chinese subtitle artefacts). Matched as exact (whitespace-stripped) or as substring.

What you see

When the filter rejects, the HUD shows a clean No speech detected error. Nothing gets pasted, nothing gets saved as a successful transcription, and you’re not charged for empty results — well, you are charged for the API call to Whisper, but the LLM enhancement step is skipped, saving a second call.

The full filter implementation: src/lib/hallucinationDetector.ts.

API calls are wrapped in two layers of fault tolerance.

Exponential backoff

Each call retries up to 2 times (3 total attempts) on:

• Network errors (failed fetch, timeout)
• 429 (rate limit) and 5xx server errors

It does not retry on:

• 400, 401, 403, 404 (your input or auth is the problem; retrying won’t help)
• AbortSignal (you cancelled)

Delay formula: baseDelay × 2^attempt + random jitter, with baseDelay = 500ms. So the wait sequence is roughly 500–1000ms, then 1000–1500ms.

Source: src/lib/retryWithBackoff.ts.

Circuit breaker

There’s one circuit breaker per provider. If it sees 3 consecutive failures within a 5-minute window, it trips OPEN for 60 seconds, refusing further calls during that cool-down.

After 60 seconds it goes HALF-OPEN — the next call is allowed through. Success closes the circuit; another failure re-opens it for another 60 seconds.

Why this matters: when a provider is having a bad day, you’d otherwise be stuck waiting for retries to time out on every recording. The circuit breaker fails fast and lets you switch providers without staring at a spinner.

User-facing message when the breaker is open: “Service temporarily unavailable, retrying in X seconds.”

Source: src/lib/circuitBreaker.ts.

Before each transcription request, TypeLate reads navigator.onLine. If it’s false, the call is short-circuited and you see a Network error message instantly — no waiting on a hung fetch.

This is a coarse signal (the browser only knows about absence of any network interface, not whether your specific provider is reachable), but it catches the common “I’m on the train and disconnected” case cleanly.

There’s no “queue and retry when online” flow yet — recordings made while offline simply fail. Audio is preserved if your retention policy allows, so they show up in the recovery banner once you’re back online.