FluentPrivacy and safety
Know what stays local, what leaves, and what can act.
Fluent separates raw signals, planner context, and Windows actions so each boundary can be inspected.
- 10 minute disclosure
- Last reviewed
- Raw speech stays local
- No camera, no eye tracking
- Hosted planning is disclosed
Is Fluent private and safe?
Fluent keeps raw speech audio on the Windows device for local transcription. It sends the resulting text request and relevant structured context to the hosted planning provider configured by the user. Fluent has cancellation, action visualization, safety classification, and confirmation mechanisms, but its published research record identifies unresolved consequence-approval and product-hardening gaps. It should be treated as preview software, not a finished safety guarantee.
Speech stays local until it becomes text
The Fluent wake listener and command transcription run on the Windows device. A bundled whisper.cpp runtime converts captured command audio into text. No cloud speech API receives the raw audio.
Local transcription does not make the whole task offline. The resulting text request is sent to the hosted planning provider selected by the user. That provider may also receive textual UI context needed to plan the requested action. Users should review the provider's own retention, account, and data-use terms.
The screen is read as structure first, pixels last
Fluent resolves what you name against the Windows accessibility tree of the focused window — accessible name, role, process and bounds — rather than against a picture of the screen. That is more reliable than pointing at coordinates, it is cheaper, and it keeps the pixels on the device.
A screenshot is only taken when the accessibility tree is not enough to complete the request, and it is masked before it is sent: detected text regions and fields whose label marks their contents are painted over first. If the masking cannot be completed, the capture is discarded and the run falls back to the accessibility tree rather than sending the original image. Masking narrows what a vision model receives; it is defence in depth and not de-identification.
Fluent has no camera path and no eye tracking of any kind.
Visible action does not equal complete safety
Fluent displays action progress, supports cancellation, redacts sensitive action previews, classifies tool risk, and includes confirmation behavior. Those controls are meaningful, but the current product audit found that consequential actions can still bypass the intended approval story through some generic automation paths.
The alpha gate requires all consequential-action fixtures to pause and denial to execute zero times. Until that gate is demonstrated on an installed build, users should avoid sensitive, irreversible, financial, publishing, account, or system-changing tasks.
Preview rule: do not give Fluent a task whose mistaken execution would cause unacceptable harm. Read this disclosure and the research scorecard before testing.
The release standard is user ownership
The release scorecard requires legible activity, memory, logs, diagnostics, bounded retention, and export and deletion controls before public release. It also requires secure provider setup, signed distribution, update and rollback behavior, and an accurate public privacy contract.
The public website counts page views and intentional clicks, and what the notice decides is whether that count is tied to you. Until you choose "Accept", nothing is written to your device at all: no cookie, no local storage, no session storage. The identifier lives in memory and is gone when you close the tab, so a second visit cannot be recognised as the same person. Rejecting is one click in the same place, is remembered, and keeps that same anonymous counting. A browser sending Do Not Track or Global Privacy Control is treated as a refusal already given, so the notice never appears and the analytics client is not loaded at all.
Accepting stores that identifier in your browser — local storage, not a cookie — so repeat visits are not counted as new people, and it turns on the measurements that need a session to be meaningful: scroll depth and click positions, dead and repeated clicks, page performance timings, and JavaScript errors. Autocapture and session replay stay disabled either way, so the text of what you click is never recorded and no recording of your screen is ever made. Your IP address is not sent as a property, and PostHog is configured to discard it rather than store it.
Current developers should keep API keys in an untracked .env file, use the example configuration, avoid sensitive test data, and review generated logs and activity.
| Data or action | Current handling | Important limit |
|---|---|---|
| Speech audio | Captured for one command and transcribed locally with whisper.cpp | The transcript can contain sensitive spoken content |
| Text request | Sent to the configured hosted planning provider | Provider terms, retention, and security still apply |
| Screenshots | Only when the accessibility tree is not enough, and masked before they are sent | Masking narrows what a vision model receives; it is not de-identification |
| UI observations | Automation can inspect Windows accessibility information needed for the task | Visible app content may be sensitive |
| Credentials | Credentials sealed by the OS keyring, never readable | Product-grade setup and credential storage remain release-gate work |
| Actions | Executed through bounded Windows automation tools with visible feedback | Not every consequential path is fully hardened yet |
| Activity and memory | Preview features exist in the app | Export, deletion, retention, and diagnostics controls remain release gates |
| Website analytics | Optional PostHog analytics load only when a project token is configured; autocapture and session replay are disabled; visitors who have not accepted are counted cookielessly, with no identifier stored on the device; Do Not Track and Global Privacy Control stop all measurement | Pageviews, intentional interaction events, campaign attribution, browser, and device metadata can reach the configured PostHog host |
Questions
Does Fluent upload my microphone recording?
No cloud speech service receives the raw recording. Command audio is transcribed locally. The transcript is then used by the configured hosted planner.
Does Fluent use a camera or eye tracking?
No. Fluent has no camera path and no eye tracking. It takes voice and typed requests and reads the screen through Windows UI Automation, falling back to a masked screenshot only when the accessibility tree is not enough.
Can Fluent perform a harmful action by mistake?
Any automation preview carries risk. Fluent has safety and cancellation controls, but this disclosure lists unresolved approval bypasses. Avoid high-consequence tasks until the relevant gates pass.
Where should API keys be stored?
Credentials a person stores for Fluent to sign them in are sealed with an operating-system key and have no read path: no tool, no automated action and no log line can retrieve one. If the keyring is unavailable, storing is refused rather than falling back to plaintext.
Keep reading
- Does Fluent have a VPAT or accessibility conformance report?A self-assessment that names its gaps is more useful than an audit-shaped document that claims everything. This is the first kind.
- Can voice control be used on a workstation that displays PHI?The interesting question is not what the software can do. It is what it refuses to send, and whether you can prove it afterwards.
- Which should you choose?Windows Voice Access is the mature default. Fluent explores a different natural-language layer.
Sources
- Accessibility conformance report — The self-assessed ACR, including its open gaps.
- Windows voice control guide — Local speech transcription and hosted planning disclosure.
Fluent For All, Inc. · Last reviewed