WHAT LEAVES YOUR DEVICE
Abhyas is architected as a local-first, zero-telemetry application. We have no user accounts, no tracking scripts, and no intermediary AI proxy servers.
1. Core Tenets
- Zero Telemetry: No analytics SDKs, tracking pixels, crash telemetry, or session recording.
- No User Accounts: No sign up, no passwords, and no cloud profile database. State lives solely in your browser's IndexedDB.
- Direct AI Egress (BYOK): Your API key sends requests directly from your browser to your chosen AI provider origin. Prompts never pass through an Abhyas backend.
- Self-Hosted Assets: All typefaces (Pixelify Sans, Instrument Sans, JetBrains Mono, Caveat), stylesheets, and scripts are bundled and served strictly from our own origin. No third-party font CDNs.
- Local Fallback: When using local models (via Ollama or WebGPU), zero network calls leave your computer during practice sessions.
2. Data Classification & Storage Inventory
The following audit details every piece of user information handled by Abhyas, where it is stored, and where it may be transmitted:
| Data Element | Sensitivity | Storage Location | Retention / Lifecycle | Destination |
|---|---|---|---|---|
| Provider API Keys | Critical | IndexedDB (settings), optional WebCrypto AES-GCM encryption | Persistent locally until deleted; decrypted only in memory during session | User-selected provider origin only |
| Resumes & Job Descriptions | High (PII) | IndexedDB (documents) | Persistent locally; user can delete at any time | User-selected provider (in structured prompts) |
| Structured Candidate Profile | High | IndexedDB (profiles) | Persistent locally; exported or purged on demand | User-selected provider (in prompt context) |
| Spoken Audio (Push-to-Talk) | High | Browser SpeechRecognition API (ephemeral memory) | Ephemeral buffer; discarded immediately after transcription | Browser speech recognition service |
| Interview Transcripts & Answers | High | IndexedDB (turns, sessions) | Stored in local database; never uploaded to Abhyas servers | User-selected provider (for scoring) |
| Evaluation Feedback & Scores | Medium | IndexedDB (evaluations, skillStats) | Stored in local database | Local client only |
| Application Settings & Theme | Low | IndexedDB (settings) | Persistent locally | Local client only |
3. Outbound Network Allowlist
In strict accordance with our Content Security Policy (CSP), network requests from Abhyas are cryptographically restricted to this explicit allowlist:
| Destination Origin | Protocol | When Used | Data Transmitted |
|---|---|---|---|
Own Origin ('self') | HTTPS | Always | Application bundle, self-hosted fonts, static icons, Web Workers |
https://generativelanguage.googleapis.com | HTTPS | When Gemini provider is selected | Prompts (candidate profile context, questions, candidate answers) |
https://api.openai.com | HTTPS | When OpenAI provider is selected | Prompts (candidate profile context, questions, candidate answers) |
http://localhost:*, http://127.0.0.1:* | HTTP | When local Ollama or OpenAI-compatible runner is active | Prompts (local loopback on your device only) |
4. Storage, Voice Recognition & Deletion
Data Deletion
You retain complete sovereign ownership of your data. You can export a full JSON archive of your profiles, turns, and evaluation histories at any time from Settings, or click "Delete all data" to instantly purge the entire IndexedDB database from your browser.
Voice Recognition Privacy
Push-to-talk audio is captured through the standard Web Speech API. Audio buffers are kept solely in browser memory during capture and are discarded as soon as the transcribed text is returned. You have the opportunity to review and edit any transcription before it is submitted. If you prefer not to use speech, text mode offers identical functionality.
Company Research & Static Packs
Company research packs in Abhyas are precompiled, static JSON bundles verified during our build process. Selecting a company does not contact that company, nor does it send telemetry to any third party.