Privacy and data — Bristlenose docs

Bristlenose runs on your machine. There is no Bristlenose account and no usage tracking — nothing is sent unless you ask for it, and the one thing that reaches us is the feedback form, described below. Transcription runs locally. The recordings, transcripts, and finished report stay on your computer — including recordings you import from a meeting account, which are downloaded straight to your project folder.

When data leaves the machine

This page documents how Bristlenose handles your data, mechanically. The privacy policy is the formal statement.

Data leaves the machine only in these cases:

You use a cloud provider. The transcript text is sent to the provider you configured, using your own API key. Audio and video are never sent.
You open the AI settings. A small check confirms the key is valid. No transcript is sent.
A transcription model is downloaded. The first time a Whisper model is needed, it is fetched once from its host.
A run starts (command line). A single-token request confirms the key works before the run begins. No transcript is sent, and it can be skipped.
You send feedback. The feedback form posts a rating and your message to bristlenose.app, together with the Bristlenose version. Nothing else — no project, no transcript, no identifier of you or your machine. It is sent only when you submit the form, and BRISTLENOSE_FEEDBACK_ENABLED=0 turns the form off.
You choose Export → Send to Miro. Selected quotes are uploaded to your Miro account. This is the only feature that sends content to a third party, and only when you trigger it.
You connect a meeting account (macOS app). Bristlenose signs in to Microsoft or Google as you, and asks their API which recordings you have. Your sign-in goes to them, not to us. Nothing about your study is sent — the requests ask for your own files and calendar, and carry no transcripts, quotes, or notes.

With a local model (Ollama), the analysis pass sends nothing at all.

The local activity log

Bristlenose keeps a record of AI calls inside the output folder (.bristlenose/llm-calls.jsonl): timing, token counts, cost estimate, model, and participant codes. It does not contain transcript text, quotes, or prompt content. Because it could help re-identify participants when combined with the transcripts, it stays in the hidden .bristlenose/ folder and is never included in an export. Turn it off entirely with BRISTLENOSE_LLM_TELEMETRY=0.

Serve mode

bristlenose serve listens on 127.0.0.1 only — the loopback address, not reachable from the network. Its API requires a token generated at startup. This is a barrier against other processes on the same machine; the real boundary is the operating system's process isolation, not the token.

Credential storage

API keys are stored in your operating system's credential store where there is one — Keychain on macOS, Secret Service on Linux. Where there isn't, Bristlenose keeps them in a .env file under ~/.config/bristlenose/, readable by your user account. That is the normal case on Windows, and on the Snap, which does not ship a Secret Service client — on those two, treat a stored key as you would any file on disk.

Importing from a meeting account

This is a macOS app feature; it does not exist on the command line.

Bristlenose can fetch recordings and transcripts from Microsoft Teams or Google Meet instead of you downloading them by hand. It signs you in on the provider's own sign-in screen — Bristlenose never sees your password — and the access granted is read-only, scoped to your own recordings and calendar rather than to acting as you. Nothing about your study is sent: the requests ask for your own files and meetings, and carry no transcripts, quotes, or notes.

The recordings you tick are downloaded into the project folder you chose, and are ordinary files from that point on. A meeting's invitee list is shown in the import window so you can tell one session from another, and is never written to disk. Your sign-in is kept in the Keychain so you need not sign in every time; Settings ▸ Accounts disconnects an account, which removes Bristlenose's copy but is not the same as revoking access at the provider.

The privacy policy is the full statement — what is read and why, how the stored sign-in behaves if you use iCloud Keychain, and how to revoke access at Microsoft or Google.

The anonymisation boundary

Bristlenose keeps two identity layers. Speaker codes (p1, p2, m1, o1) are the durable identity: every quote cites one, and they travel into everything Bristlenose produces. Display names are the working layer — the readable name your team uses instead of a code.

Anonymisation is the switch between them, and it is off by default. Leave it off and display names travel alongside the codes; turn it on and the names are dropped, leaving codes only. That applies to every export the same way — the offline report, spreadsheet and clipboard exports, and video clips. Codes are never removed, because they are what makes a quote traceable back to a person you can identify from your own records.

Off by default is deliberate: most reports are shared inside the team that ran the study, where names are the point. Turn anonymisation on for the readers who should not have them. It removes participant names only — moderators and observers keep theirs, being the research team rather than its subjects.

The working files in your output folder — the report HTML and people.yaml — always contain display names. They are your team's copy, and anonymisation applies to what you export from them, not to what sits on your own disk.

To redact personal data from the transcript text itself — including names spoken aloud within quotes — use PII redaction, which is a separate, analysis-time step.

Reporting a vulnerability

Email security@bristlenose.app. Please do not open a public GitHub issue for security reports.