Your interviews and your chosen services
Privacy policy
This policy covers IdeaForge for the web and Android. Interviews stay on your device, while the content needed for model requests and optional voice services goes to the services you choose. There is no IdeaForge account or sync server.
Developer and privacy contact
IdeaForge is maintained as the open-source jaypetez/ideaforge project. This policy describes the app's data handling, not the independent policies of your model provider, speech service, browser or hosting service.
Privacy contact: jayson@duck.comData accessed and kept on the device
IdeaForge uses the idea, questions, answers, unfinished drafts, extracted facts, coverage, generated write-up, names and tags to conduct, resume, search and export interviews. Whatever you put in an idea can contain personal information; the app does not separate that information from the rest of your text.
| Data | Web app | Android app |
|---|---|---|
| Interviews and library | Unencrypted session records in this browser profile and origin's IndexedDB. | Unencrypted JSON files in the app's private sessions directory. |
| Inference, transcription and speech credentials | An AES-GCM-encrypted keyring in IndexedDB, using a non-extractable Web Crypto wrapping key stored alongside it. | An AES-GCM-encrypted keyring in no-backup private storage, using an app-specific, non-exportable key in Android Keystore. |
| Provider address and model choices | In the credential keyring, per provider. Local inference requires no key, but a nonempty key in the web connection settings can be sent to the loopback server for authentication. | In the credential keyring, per provider. Android local server connections omit credentials, even if a key was configured. |
| Device preferences | Plain localStorage, including theme, finish word, hands-free choice, speaking voice/pace, hosted-speech permission and the non-secret inference destination and acknowledgement identifier. | Plain Preferences DataStore, including those choices and the separate hosted-transcription permission and the inference acknowledgement. |
| Voice recordings and generated speech audio | Temporarily held in memory while the app records, transcribes or plays audio. IdeaForge does not save audio in interviews, backups or a persistent audio cache. Device speech services have their own handling. | |
| AI-content reports | Android’s Report dialog stores the reported generated-text snapshot, category, optional note and report time in the idea. No user-written answers, full transcript, credentials or connection settings are added to that payload; unedited AI suggestions/drafts are generated text and can contain private details. Imported reports are preserved by both platforms and included in that idea’s markdown export and JSON session backup. Report metadata is not sent in model prompts or telemetry. | |
| Backups, exports and shared copies | Created by explicit actions. A JSON backup contains the active and archived interviews, but not the app's credential keyring, device preferences or audio. Text you put in an idea is not redacted. Markdown exports include the idea's document, transcript and any saved content reports. These copies are unencrypted. | |
Android cloud backup and device-to-device app-data transfer are disabled. The app's explicit backup/export actions are separate. The web app caches public app-shell files for offline opening; that cache does not hold provider requests, credentials or interviews. The static guide is outside the app-shell cache.
What goes to a model provider, and when
Before starting or resuming interview work, affirm the unchecked, provider-named interview-text agreement. Web Start shows it at Ready and in Settings Connection; Android shows it in provider details during onboarding and in Settings Connection. Android saves it with the connection; on the web, checking the box saves it. An old installation without an acknowledgement is not treated as having agreed. A successful key check, saved credentials or microphone permission cannot supply it.
Generating a follow-up question or write-up sends interview context to the selected provider: the opening idea, questions and answers (compacted as needed), facts and coverage. The provider returns generated questions, suggestions or a write-up, which become part of the local interview. Connection/key checks and model-list reads also contact the selected service, without sending an interview.
The acknowledgement is a non-secret device preference, excluded from session backups. Changing provider kind, including switching back, or changing a validated local server address requires fresh agreement. Model-only changes do not. Uncheck it in Settings → Connection to block new interview requests, retries and capture immediately. It also gates pending-turn and write-up recovery. Existing local ideas remain readable and exportable. An already submitted request may finish for its original idea; withdrawal cannot recall data already sent.
Unreadable preferences or an acknowledgement that cannot be saved do not authorise inference. A failed withdrawal is reported, not labelled saved: the current page or app process remains blocked, but an old on-disk acknowledgement may remain if storage rejected the change. Fix storage and withdraw successfully before reloading or restarting. Inference agreement is independent of microphone permission and the transcription and speech choices below; their separate checks remain separate.
Hosted inference choices are Anthropic, OpenAI, Groq and OpenRouter. The relevant API key is sent to that provider to authenticate the request. OpenRouter also routes inputs to an underlying model provider; review its provider data practices. Local choices are Ollama (local), LM Studio (local) and Another local server. In the web-only Claude (this viewer) path, the hosting Claude viewer receives the prompt through its sampling capability; no IdeaForge API key is needed.
IdeaForge does not proxy these requests through an application server. Provider logging, retention, training, abuse monitoring and account controls are governed by the selected service and your account settings, not by deleting an interview in IdeaForge. A local address is not a promise about what that server does after receiving your content.
Local reports and optional developer email
Saving an Android content report sends nothing to the developer or a model provider. It is a local record, not an automatic moderation upload or an acknowledgement of developer receipt. After saving, an optional explicit Open email to developer tap opens your email app to the confirmed privacy contact above, prefilled with only the report’s generated text, category and optional note. Review and send it there; opening the composer does not prove delivery. Your email service has its own data handling. No private report is posted to a public GitHub issue.
Reports remain until the idea is deleted or local app/site data is cleared. Exporting, backing up, copying or sharing an idea also copies its reports without redaction. Delete or secure those external copies separately. See Android reporting controls for categories, retry and question replacement.
Microphone, transcription and spoken replies
Voice input requires microphone permission. Browser recognition and Android's speech recognition service process your audio, on-device where available or through the service's own remote processing. Choosing a device voice or recognizer is not an offline guarantee.
Native New idea and completed onboarding first offer an explicit Voice/Type choice. Merely opening that choice starts no microphone or service. The new-idea Voice setup can be cancelled or denied back to typing; interrupted pending setup is not replayed on return. Already active app-graph voice runs retain the Pause/Exit behavior below.
The web record-and-transcribe path uploads recorded audio to the selected Groq Whisper or OpenAI transcription service, with its transcription key, language and a text hint where used. A hint can contain the current question and earlier transcribed words. On Android, this hosted fallback runs only when native recognition is unavailable or cannot handle the language, and only with its own key and explicit audio-transfer consent. The returned words are stored as interview text, not as audio.
Native/device speech is the default. Optional OpenAI speech sends the text being read aloud to OpenAI, using a separate speech key. That text can contain your idea, questions, examples and refined prompt. Hosted speech requires consent to text transfer, an AI-generated voice and metered usage, plus a successful hosted check/preview. The preview itself sends text to OpenAI. A failed hosted reply can visibly fall back to the device voice; cancellation does not start fallback playback.
In Android hands-free mode, a microphone foreground service keeps the active voice interview listening when the screen is off, with notification controls to pause or exit. Pause cancels the capture and pending transcription, keeping the available native caption and completed transcribed segments as a draft. An unfinished hosted-transcription segment is not added after pausing. Exit preserves captured words.
On the web, Pause releases owned microphone/playback resources, but an already captured recording may finish transcription to preserve a draft. Exit keeps transcribed words and cancels unfinished audio. Neither platform can recall data already sent to a provider. The app does not run a background wake-word listener.
Secure handling and network limits
Hosted model, transcription and speech connections use HTTPS. The web app
permits user-entered model endpoints only on loopback. Android also permits
private-network model servers. A plain http:// connection is not
encrypted in transit: another machine on your LAN can receive interview text,
and network observers may be able to read it. Native onboarding and Settings
show an unencrypted HTTP warning for server addresses outside loopback.
Prefer HTTPS with a certificate trusted by the device and a matching server
name; certificate checks are not bypassed. A local model does not make hosted
voice services local.
Credential encryption does not encrypt your interviews or exports. It does not protect an unlocked device, a compromised operating system/browser or a malicious script already running as the web app's origin. Keep keys scoped, protect your device and treat interview files as sensitive. See Privacy and security for the browser's CSP, storage and encryption boundaries.
IdeaForge contains no analytics, advertising, telemetry, user accounts or application sync service, and does not sell interview data. Hosting and provider services still receive ordinary request metadata, such as an IP address and request headers. The web app also requests its IBM Plex stylesheet and font files from Google Fonts, without interview content or an IdeaForge key in those asset requests. This guide uses local assets and system fonts.
Retention, deletion and your copies
Local interviews have no automatic expiry. They remain until you delete an idea or clear the app's storage; browser storage can also be evicted. Use the library's Delete action for an idea. Browser site-data controls remove that origin's stored data and caches; clearing Android app storage or uninstalling removes its local app data. Back up first if you need it. There is no IdeaForge server copy from which to restore a lost interview.
The web app’s Settings → Your data → Forget keys and Android’s confirmed Forget action remove the saved inference, transcription and speech credentials. They do not delete interviews or revoke credentials at their providers. Revoke a compromised key through the provider's account controls. Non-secret preferences generally remain; permissions tied to hosted speech/transcription are withdrawn.
Android creates a temporary private export file when sharing; older share files are pruned on a later app start or share. A destination app, clipboard, downloaded Markdown or JSON backup is a separate copy outside IdeaForge's control. Delete or secure those copies separately. Deleting locally cannot erase provider-side records or copies already shared. Ask the relevant provider about its retention/deletion options; there is no IdeaForge account to delete.
Adult audience
IdeaForge is intended for people aged 18 or over, not for children. The app does not collect an age field or verify your age.
Changes and questions
Changes to data handling will be reflected on this page and in relevant in-app disclosures. Review the policy when updating the app or changing services. Send privacy questions to the contact address above; do not include a live API key or sensitive transcript in a public issue. The repository records policy changes alongside their implementation.