Privacy Model

Privacy Model

Zerm is designed so privacy boundaries are explicit and, on the default path, everything stays on your Mac.

On-device by default

The recommended configuration uses all three local models — Whisper (STT), Kokoro (TTS), and Gemma (LLM). On this path:

• Microphone audio is transcribed locally and never uploaded.
• Selected text read aloud is synthesized locally.
• Smart-reading cleanup and AI enhancement run locally via Gemma.
• No API keys are required.

Models download once from public sources, then run fully offline.

When data leaves the device

Only when you opt into cloud providers:

Feature	Cloud option (opt-in)
Transcription	OpenAI, Gemini, Deepgram, …
Read Aloud voice	Deepgram, ElevenLabs, OpenAI, Gemini, …
AI enhancement / naturalization	Anthropic, OpenAI, Gemini, Groq, Mistral, …

Cloud providers require explicit configuration (and usually an API key) before they can be used.

Stored data

• History and stored request payloads may contain dictated text — treat them carefully.
• API keys: in normal builds, stored in the Keychain; in LOCAL_BUILD ad-hoc builds, in UserDefaults (so the ad-hoc app can read them).
• All app data lives under ~/Library/Application Support/com.arcusis.zerm/, outside the app bundle.

Permissions

• Accessibility — read the current selection and paste at the cursor.
• Screen Recording — Power Mode / screen-context features.
• Microphone — dictation.

Ad-hoc local installs reset these (TCC) on each make install, so they must be re-granted.

See: The Three-Model Platform · Build & Release