How Veery works

When you save takes to a lesson, each take is encrypted in your browser with a fresh per-lesson key, and that key is wrapped under an account key that is generated in your browser and stored there as a non-extractable key. The raw account key is shown once as a recovery code; we never see it and cannot recover it for you. On a new device you paste the code.

What is stored in the clear: your email address, the display name you choose, organisation names, lesson titles, take labels, session codes, durations, sizes, timestamps, and your account’s plan and preferences. Sealing titles and labels client-side is a known follow-up. The exact scheme is documented in docs/STUDIO.md.

A Studio session is one WebRTC connection between two browsers with two data channels: control messages and lossless PCM audio. Our server only relays the signaling that sets the connection up (a handful of small offer / answer / ICE rows). When two networks cannot reach each other directly, a TURN relay carries the packets — and a relay only ever sees ciphertext, because WebRTC keys live in the two browsers.

Every analysis widget reads frames from a worker running in your browser: pitch tracking, spectrogram, third-octave bands, formants, level. Nothing audio-shaped is sent to a server for analysis. The local transcriber (Whisper) also runs in the browser; the model file is downloaded once and cached.

• Off — no models run. Transcription and partner features stay hidden.
• On-device only — models such as Whisper run in your browser. Audio stays on the device.
• Allow cloud — also permits plan-gated cloud partners. Nothing is sent unless you chose this mode and press the button for that one action.

No cloud provider is configured on this deployment yet; the setting exists so the promise is in place before any provider is.

If you opt in, you can mark individual takes as research contributions from the save dialog. Each one is sealed in your browser to the research programme’s public key — encrypted to the programme, not to us — with minimal metadata (duration, task label). The sealed file carries no identifier and sits under a random name; the server keeps one row linking it to your account — with the duration and task label in the clear — only so your account page can list it and you can withdraw it. Consent is versioned: if what is collected ever changes, the number changes and you are asked again. Withdrawing deletes every contribution from storage and clears your consent.

Veery is not a medical record and does not ask for diagnoses. For clinics that must operate under HIPAA: audio is never on our servers in the clear, instructor notes, goals and metrics are sealed between instructor and student, the server sees ids, statuses, timestamps, counts and sizes, plus emails, display names and organisation names, and deletions remove storage first and fail closed. Business associate agreements are a deployment matter between a clinic and whoever hosts their instance of this open-source software.

The app describes sound, not gender: brighter / darker, lighter / heavier, higher / lower, more forward / more back, warmer / thinner, softer / firmer. Targets are yours to define; nothing is pre-labelled “feminine” or “masculine”, and there is no passing metric anywhere.

You will not find a score out of 100, a match percentage, a ring to fill or a streak to keep. Plots show your target band, where you are relative to it, trends over time with their uncertainty, and provisional markers when there is not enough signal to say.

The whole application — the crypto, the DSP, the server routes — is published under the GNU Affero General Public License at github.com/timhegberg/mira. The design and product contract lives in docs/VEERY.md.