Browser-local speech assets

Unmodified Needle engine (Cactus Compute), revision 93e88ede867e4311c39151285e74df513e4b835b, and Whistle weights, revision ca5287601bef25af26dcf2e1b2bdc0843a7c19e5: Apache-2.0. Full LICENSE accompanies each pinned directory. Sources and SHA-256 hashes are recorded in manifest.json.

Unmodified Transformers.js 3.8.1 (Hugging Face): Apache-2.0. Full LICENSE accompanies transformers-3.8.1. The npm archive's SHA-512 integrity matches tsTk4zVjImqdqjS8/AOZg2yNLd1z9S5v+7oUPpXaasDRwEDhB+xnglK1k5cad26lL5/ZIaeREgWWy0bs9y9pPA==.

The Transformers.js standalone bundle also embeds Hugging Face Jinja (MIT); its full copyright/license is preserved in transformers-3.8.1/JINJA-LICENSE. Embedded ONNX Runtime JavaScript is covered by the MIT license and notices below.

Unmodified ONNX Runtime Web 1.22.0-dev.20250409-89f8206ba4 (Microsoft): MIT. Full LICENSE and upstream ThirdPartyNotices.txt accompany its directory.

Whisper-tiny multilingual ONNX q8 weights converted by onnx-community from OpenAI Whisper-tiny, model revision ff4177021cc41f7db950912b73ea4fdf7d01d8e7: MIT. OpenAI's full LICENSE accompanies the model directory. Tokenizer/configuration files come from that same pinned model revision. Whisper is statistical speech recognition, may hallucinate, and is less accurate for lower-resource languages; it is not a clinical assessment.

Language routing: en/es/fr use Whistle; tr/pt/zh/ar/hi use Whisper-tiny. Whistle itself supports en/de/fr/es/it/nl/pl, not Turkish, Portuguese, Chinese, Arabic, or Hindi.

Privacy source evidence: Cactus's Python SDK needle/_telemetry.py at source revision 3da4261073199444f2e070800854436fbc31fb6a enables anonymous usage telemetry by default and posts to a Supabase telemetry endpoint. That SDK is NOT shipped or called here. Only the pinned WASM/C API is used. The pinned needle.js has no telemetry, Supabase, sendBeacon, WebSocket, or HTTP-domain literals; needle.wasm has no HTTP-domain literals. JavaScript exposes only filesystem/WASI-like imports, not native networking. The worker accepts mono PCM and a language code, never notes, and permits fetch only for allowlisted same-origin speech assets with GET/HEAD, rejects redirects, validates downloaded SHA-256, and disables XHR/WebSocket/EventSource. Transformers.js remote-model loading is disabled, with local_files_only enabled and ONNX WASM paths explicitly set to same-origin assets; no CDN fallback is allowed. Audio/transcript is never included in any HTTP request by this implementation. Actual browser request tracing and model execution are release-verification requirements, not claims implied by this source review.