The seven promises
These promises are the product. They hold in v1 without exception; a violation is a
P0 defect.
- Audio never leaves the device. Recording, transcription, and minutes generation all run locally.
- Transcripts and minutes are stored encrypted at rest on the device.
- Zero outbound network calls from the core app carrying user content — no telemetry, no analytics, no "anonymous" launch counters. The one narrow, opt-in exception (model download) is described below.
- Exports are user-initiated, one meeting at a time, with a confirmation screen showing exactly what will be sent and where.
- No account is required. No cloud sync. No login.
- An open architecture page (this one) explains exactly what runs where.
- Privacy-critical code is open source, so the claims above are verifiable rather than asserted.
What runs where
| Stage | Where it runs | How |
|---|
| Recording | On-device | Microphone → foreground service → app-private storage |
| Encryption at rest | On-device | AES-256-GCM before anything is persisted |
| Transcription | On-device | whisper.cpp via Dart FFI — no network |
| Minutes generation | On-device | Gemma 4 E2B via LiteRT-LM, or a deterministic Dart extractor fallback |
| Storage | On-device | SQLCipher (encrypted SQLite) + encrypted audio files |
| Export | On-device → where you send it | User-initiated intent, one meeting at a time, with a confirmation screen |
There is no server, no account, and
no cloud sync. On-device minutes generation uses
Gemma 4 E2B via LiteRT-LM where the model is present and RAM allows,
and a pure-Dart deterministic extractor otherwise. Both run locally; neither transmits
your content.
The network posture — the honest part
The core app makes zero outbound network calls carrying user content.
The INTERNET (and ACCESS_NETWORK_STATE) permission
is present in the manifest, and exists for exactly one purpose:
optional, opt-in, Wi-Fi-gated downloads of the on-device AI models from
huggingface.co — the Gemma 4 E2B minutes model and the optional Whisper
small.en transcription model.
Each download is SHA256-verified against a pinned HuggingFace commit,
transfers a public model file down to the device (it never uploads user
content), and after download all inference runs on-device. A privacy regression test
enforces huggingface.co as the only allowed host. No telemetry, no
analytics, no crash reporting that phones home.
SumaFlow Minutes Pro is an optional in-app purchase handled by
Google Play Billing — Google's native channel, which runs below
the app layer. It is user-initiated only, creates no SumaFlow account and contacts
no SumaFlow server (there is none), and carries no audio, transcript, or minutes.
No payment details reach us; your Pro entitlement is derived on the device. The
no-network test above covers the app's own calls; Play Billing runs inside Google
Play services, below that layer.
We disclose this download rather than hide it: shipping a multi-gigabyte model inside
the app would be worse for users, and pretending the permission isn't there would be
dishonest. The permission is present; the line above is exactly what it is for. The app
also sets usesCleartextTraffic="false", so any network use must be HTTPS.
Encryption, in brief
- Audio files are encrypted at rest with AES-256-GCM.
The on-disk format is
[12-byte nonce][16-byte GCM tag][ciphertext], with
a fresh random nonce per file and fail-closed authentication on decryption.
- Transcripts, minutes, and metadata live in a
SQLCipher-encrypted database.
- Keys derive from one per-install 256-bit master key via
HKDF-SHA256, stored in the Android Keystore (using
StrongBox where the device provides one). The master key is non-exportable and never
leaves the device.
The whitepaper covers the file format, key derivation labels, and the threat model in
full detail.
Open source, so you don't have to take our word for it
The privacy-critical code is published under the MIT license at
github.com/SumaFlow-App/sumaflow-minutes-privacy-core.
It contains the AES-256-GCM at-rest crypto layer, the key derivation and management
code, and the no-network test harness — an executable assertion that
the app makes no outbound call to any host outside the huggingface.co
allowlist. You can run that test yourself.
What this design does not protect against
We are explicit about the limits so you can reason about your own obligations:
- A compromised OS or a rooted device with the screen unlocked can read what the running app can read. On-device encryption protects data at rest, not data in use on a hostile system.
- Shoulder-surfing and screen capture by someone with physical access are outside the cryptographic boundary.
- Once you export a meeting, that copy lives by the rules of its destination. The app makes the export explicit and logs it; it cannot recall it.
- There is no recovery path: no cloud backup, no key escrow. Lose the device or its keystore and the encrypted data is unrecoverable — the direct cost of having no server.
For regulated professionals
SumaFlow Minutes is designed for financial advisors, fiduciaries, and other regulated
professionals who cannot route client conversations through a cloud meeting service. An
on-device, no-cloud architecture can help you meet your own confidentiality
obligations by keeping client content on hardware you control, with no
third-party processor in the path. We do not claim certification under,
or compliance with, any regulatory or security framework — compliance is a property of
your practice, not of an app. What we offer is an architecture whose properties you can
verify and reason about against your own obligations.