Skip to content

ADR-011: Zero Telemetry, Offline-Default, Opt-In Cloud

Status: Accepted
Date: 2026-05-18
Deciders: Mohsen Seyedkazemi Ardebili

Context

Sovereign, user-controlled operation is a foundational axis of the YazSes product — not a feature to be added later. The competitive landscape contains two cautionary baselines: Microsoft Recall (2024) demonstrated the reputational and security cost of unencrypted, vendor-controlled personal AI capture; cloud-mediated voice AI products are privacy-disqualifying for regulated-industry users (lawyers, clinicians, journalists, government). YazSes' design commitment is the structural opposite of these approaches. This ADR formalises that commitment as a CI-enforced policy so that no future change can erode it accidentally.

Decision

YazSes v1.0 operates under the following non-negotiable privacy defaults:

  1. Zero telemetry. No crash reporting, no usage statistics, no analytics, no A/B-testing, no feature-flagging that reports to a remote server. Bug reports are user-initiated via yazses bugreport, which produces a local file that the user reviews and attaches manually.
  2. Offline by default. A complete agent-loop turn (hold → ASR → LLM → tool dispatch) completes with all network adapters disabled. Verified by CI integration test on a network-namespace-isolated environment.
  3. No cloud fallback. When on-device inference fails, the daemon returns a clear, actionable error rather than silently routing to a cloud service. Explicit opt-in via ~/.config/yazses/cloud.toml is required for any cloud path.
  4. Opt-in cloud adapters. OpenAICompatibleBackend and any future cloud backend require per-endpoint configuration. The first cloud call in a session triggers a consent prompt with explicit Yes / Yes-for-session / No options.
  5. Open weights only by default. All shipped default models have openly-licensed weights. Users may configure closed-weight models explicitly.
  6. Local-only logs. Daemon logs at ~/.local/share/yazses/daemon.log; never transmitted.
  7. Owner-only IPC. Unix socket mode 0600; Windows named pipe restricted to the calling user.
  8. Personal memory encrypted at rest. SQLCipher with a user-derived key (see ADR-007).
  9. No ambient capture. Recording occurs only when the user holds the hotkey or explicitly commits a transcript. No continuous transcription, no background indexing.
  10. CI-enforced. Any pull request introducing network egress, telemetry, or a cloud fallback must include the opt-in flag, the consent UI, and a CI test confirming the default-off behaviour.

Consequences

Positive: - Defines a defensible position against every shipping competitor that uses cloud-mediated or telemetry-driven AI. - Regulated-industry users (lawyers, clinicians, journalists) can adopt YazSes without a separate compliance review. - Regulatory trends (EU AI Act and successors) favour on-device-only, user-controlled data practices. - Open-source contributors aligned with the sovereignty mission are a natural community fit.

Negative / trade-offs: - No telemetry means no automated insight into real-world usage patterns. Explicit user research (interviews, opt-in surveys) replaces telemetry for product decisions. - No cloud fallback means users occasionally see errors rather than degraded-but-functional behaviour; the error UX must be excellent and actionable. - Some enterprise procurement processes treat vendor-controlled telemetry as an accountability mechanism; YazSes' position is that open source is the accountability mechanism.

Implementation

The no-network-egress CI test lives in .github/workflows/test.yml under the privacy-gate job. It runs the full agent-loop integration test inside a network-namespace-isolated container (unshare --net) and asserts exit code 0. The OpenAICompatibleBackend is gated behind the cloud cargo feature and is off by default. Consent-prompt logic is in yazses-core/src/cloud_consent.rs.