Int. server room — continuous
The security review, on one page.
A desktop app that needs no account, no server and no analytics. Its data is one folder. It makes one optional download. Everything it touches is listed below.
Here is the short version of the security review. There is no account, and no server to stand up.
Recordings, scripts and projects live in one folder on the device. Captions are made there too. The one download is a speech model, fetched once, and you can put it in place yourself. The rest is on this page.
- Accounts
- None needed
- Servers to run
- None
- Analytics and crash reports
- None
- Where data lives
- One folder per user
- Downloads after install
- One, optional
- Programs it starts
- Its own ffmpeg
Int. the firewall — night
What leaves the device.
| What the app does | Where it happens | Network |
|---|---|---|
| Records camera, microphone and screen | On the device, written to disk as it goes | None |
| Edits, renders and exports video | On the device, with the ffmpeg it ships with | None |
| Makes captions and transcripts | On the device, with Whisper (whisper.cpp) | One download of the speech model, the first time |
| Follows a voice, takes dictation | The platform's recognizer, or Whisper on the device | It depends on the platform: see speech engines |
| Signs in to a Lectern account | Only if someone chooses to (for Pro, or a seat in your organization's plan). Nothing needs one | HTTPS to Lectern's servers, and only after someone has signed in on that device |
| Reports usage or crashes | It doesn't | None |
| Updates itself | It doesn't yet. A new version is installed over the old one. Planned | None |
The one download
The first time someone makes captions (or, on Linux, reads with voice follow),
the app fetches the Whisper base model: one file, ggml-base.bin, 148 MB, over HTTPS from huggingface.co (which hands the download on to its file host). It's checked against a SHA-256
pinned in the app before it's used.
Or put it there yourself
On a network that blocks the download, place the file at speech-models/ggml-base.bin in the app's data folder.
The app finds it and doesn't ask for it again. Until it's there, captions and
Whisper's voice follow say they need it; everything else works.
Int. the microphone — close
Speech engines, platform by platform.
Voice follow and dictation listen to the microphone. Which engine does the listening, and whether it needs a connection, depends on the platform.
| Platform | Engine | Works offline |
|---|---|---|
| macOS, iOS | Apple Speech | Yes, when the language's on-device model is installed |
| Android | The system's SpeechRecognizer | Yes on Android 12 and later, with an on-device recognizer |
| Windows (default) | Windows dictation | No. It needs Windows' online speech recognition turned on |
| Windows (chosen in Settings) | Whisper, on the device | Yes, once the model is in place |
| Linux | Whisper, on the device | Yes, once the model is in place |
| Browser | The browser's Web Speech API | It depends on the browser. Chrome sends audio to Google |
Captions and transcripts of a finished recording always use Whisper on the device, on every desktop platform. Scrolling at a set speed uses no speech engine at all.
Int. the file system — day
One folder of data, one of cache.
| Platform | Data | Cache |
|---|---|---|
| macOS | ~/Library/Application Support/com.jacobrunge.teleprompter/ | ~/Library/Caches/com.jacobrunge.teleprompter/ |
| Windows | %APPDATA%\com.jacobrunge.teleprompter\ | %LOCALAPPDATA%\com.jacobrunge.teleprompter\ |
| Linux | ~/.local/share/com.jacobrunge.teleprompter/ | ~/.cache/com.jacobrunge.teleprompter/ |
In the data folder
library/Everything a user makes:Recordings/,Scripts/,Projects/,Exports/andTrash/. Scripts are text, projects are JSON, media is ordinary video and audio files.speech-models/The Whisper model, once it's been downloaded or put in place.
In the cache folder
previews/Thumbnails and waveforms for the editor's timeline. Safe to delete: they're made again when needed.
Back up or redirect library/ and you have a user's work. The trash
empties itself after 7, 30 or 90 days, as the user sets.
Int. the operating system — a dialog appears
What it asks the system for.
| It asks for | To | Scope |
|---|---|---|
| Camera and microphone | Show the preview and record | The devices the user picks |
| Speech recognition | Follow the reader's voice | macOS and iOS ask; elsewhere it comes with the microphone |
| Screen recording | Record a display, a window or a region | The system's own picker chooses what's shared, each time |
| Files | Keep the library and the timeline's cache | Those two folders only. Saving an export elsewhere goes through the system's save dialog |
| Other programs | Convert and render video | Only the ffmpeg inside the app |
| A local port (Linux only) | Play the library's media in the web view | 127.0.0.1, a random port and token each run, library files only |
Int. the installer — unpacked
What's inside it.
- Tauri 2, and the system's web view. WebView2 on Windows, WKWebView on macOS, WebKitGTK on Linux. No browser is bundled, so it's patched with the system.
- ffmpeg, an LGPL build. No x264 and no other GPL parts. H.264 comes from the system's encoders (VideoToolbox, Media Foundation) or OpenH264.
- whisper.cpp, with OpenAI's Whisper base model, which knows many languages.
Where it runs
- macOS Apple silicon. Screen recording needs macOS 15 or later.
- Windows With WebView2, which Windows 11 includes.
- Linux With WebKitGTK 4.1 and the GStreamer plugins for camera and playback.
- iOS, Android and the browser With fewer features. The phone apps aren't out. Planned
Int. the deployment console — soon
Rolling it out. Not all written yet.
| You'll want | Where it stands |
|---|---|
| Signed and notarized macOS builds | Being set up Planned |
| Signed Windows installers | Not yet: installers are unsigned Planned |
| Automatic updates | Not yet Planned |
| Silent install and MDM notes | To be written Planned |
| An accessibility conformance report (VPAT) | To be written Planned |
Int. change advisory board — Tuesday
Asked before it's approved.
Does it collect student data?
Not unless someone signs in. The app needs no account, and nothing a user records, writes or answers leaves the device. An account (for Pro, or a seat in your plan) holds a name, an email address, a password (stored hashed), the devices signed in with their network address, and what was bought; your plan's admins see members' names, email addresses and the storage they use. Anyone can download or delete their account from the app. Links for sharing projects are planned; with them, viewers' answers would be stored for each viewer, and documented here before they ship.
Can we block its network access entirely?
Yes. Recording, editing and export don't notice. Captions need the speech model, which you can put in place yourself. On Windows, choose Whisper in Settings so voice follow stays on the device.
Is the app itself accessible?
Its text and controls are held to WCAG AA contrast, and every change is checked with automated accessibility tests. A formal conformance report hasn't been written.
Who do we talk to?
Write to hello@lecternvideo.com. For the rest of the product, start at the front page.