Privacy and data

Bristlenose runs on your machine. There is no Bristlenose account, no Bristlenose server, and no usage tracking sent anywhere. Transcription runs locally. The recordings, transcripts, and finished report stay on your computer.

When data leaves the machine

Data leaves the machine only in these cases:

• You use a cloud provider. The transcript text is sent to the provider you configured, using your own API key. Audio and video are never sent.
• You open the AI settings. A small check confirms the key is valid. No transcript is sent.
• A transcription model is downloaded. The first time a Whisper model is needed, it is fetched once from its host.
• A run starts (command line). A single-token request confirms the key works before the run begins. No transcript is sent, and it can be skipped.
• You choose Export → Send to Miro. Selected quotes are uploaded to your Miro account. This is the only feature that sends content to a third party, and only when you trigger it.

With a local model (Ollama), the analysis pass sends nothing at all.

The local activity log

Bristlenose keeps a record of AI calls inside the output folder (.bristlenose/llm-calls.jsonl): timing, token counts, cost estimate, model, and participant codes. It does not contain transcript text, quotes, or prompt content. Because it could help re-identify participants when combined with the transcripts, it stays in the hidden .bristlenose/ folder and is never included in an export. Turn it off entirely with BRISTLENOSE_LLM_TELEMETRY=0.

Serve mode

bristlenose serve listens on 127.0.0.1 only — the loopback address, not reachable from the network. Its API requires a token generated at startup. This is a barrier against other processes on the same machine; the real boundary is the operating system's process isolation, not the token.

Credential storage

API keys are stored in your operating system's credential store — Keychain on macOS, Secret Service on Linux — never in plaintext. If no credential store is available, Bristlenose falls back to environment variables or a .env file.

The anonymisation boundary

Bristlenose keeps two identity layers. Speaker codes (p1, p2) are the public-facing identity and the anonymisation boundary. Display names — first names you add for your team — stay internal. Quote attributions, spreadsheet exports, and the clipboard show codes only.

The report HTML file and the people.yaml file in the output folder do contain display names, as a working aid for the research team. When you share a report with Export Report, the option to remove participant names from labels is on by default.

To redact personal data from the transcript text itself — including names spoken aloud within quotes — use PII redaction, which is a separate, analysis-time step.

Reporting a vulnerability

Email security@bristlenose.app. Please do not open a public GitHub issue for security reports.