What stays here, and why.

Your score, your topic, and Zen's reply are saved only in this browser's IndexedDB. They never reach a server. The streak counter, the Recent panel, and the on-device coach all read from that local store. Clearing the journal in Settings deletes it.

When you are online, the spoken voice is generated by Google's Gemini TTS via a small Vercel function. We send the text Zen would say, the chosen character (Zen → Charon), and a pace bias (calm if the mood sensor reports elevated stress). We do not send your name, your check-in history, your IP, or any identifier. The audio is cached locally so the next playback is instant and works offline.

If you opt in to "Let Zen see", camera frames are processed in WebAssembly on this device by Google's MediaPipe Face Landmarker. Frames never leave the browser. Only the derived label (calm / steady / elevated) and three numeric signals (blink rate, brow tension, head motion) are read by the rest of the app, and even those stay local. Tap Stop to release the camera; it is also released automatically when you navigate away.

Two surfaces ask for your microphone, both opt-in, both stay local:

• Live-mic box breath at /anxiety. The breathing circle follows your actual breath envelope (Web Audio analyser reading time-domain RMS). The number we keep is a single smoothed scalar between 0 and 1.
• CPR practice mode at /emergency/drill. The phone listens for your tap on a hard surface so it can score your tempo against the 100-120 BPM target. The only state we keep is a list of peak timestamps.

We never record a buffer to disk, never upload a sample, never run speech-to-text. The audio stream and AudioContext are released the moment you tap Stop or navigate away.

Optional. If you tap "Enable Gemma 4 E2B", the browser downloads Google's official Gemma 4 E2B Web `.task` file (~1.9 GB) from a public Hugging Face mirror. Once cached, the model runs entirely in WebGPU on this device. We never see prompts or replies.

Online: each protocol step is paraphrased by Gemma 4 (cloud) and audited by Gemini Flash. We send only the verbatim Red Cross / AHA / WHO step text and the candidate paraphrase, no user identifier. Offline: the page reads verbatim protocol from a local cache. Either way, the spoken voice tries the cached Charon WAV first and falls back to the browser's Web Speech only if no cached audio exists for that step.

On first visit we make exactly one HTTPS request to ipapi.co/country/ to determine the right emergency-services number (112, 999, 911, etc). The response is a two-letter country code and is cached in localStorage so subsequent visits do not re-query. No precision lookups, no city-level data.

No analytics. No third-party trackers. No advertising SDKs. No cookies that survive the session beyond the localStorage entries listed above. No A/B testing tools. No session recording. No crash-reporting service. The Vercel logs retain access timestamps and IPs for 24 hours per Vercel's standard policy; those logs are not joined to any user identifier we hold.

Visiting /emergency/aed asks your browser for one-shot location. That lat/lon is sent exactly once per page mount to OpenStreetMap's Overpass API to query nodes tagged emergency=defibrillator. We do not log or store the location on a server. The result caches locally so a return visit shows something instantly while the fresh lookup runs in the background. Clear it from Settings > Clear practice history.

Zen is a coach, not a clinical device. The emergency mode reads verbatim from open-licensed Red Cross / AHA / WHO protocols; it is a tool to support a bystander, not a replacement for emergency services. Always call 112, 999, 911, 119 (or your local equivalent) first.

Zen is one character in the Aqi library, designed to feel calm, low-energy, and ADHD-aware. Charon (the voice) and the mascot's mood-reactive face are part of how the product earns trust: a face you have heard thirty times this month is a face you do not freeze in front of when something goes wrong. Other characters for chronic-pain, anxiety grounding, and kids' first-aid are in v0.2 roadmap; they share the same on-device runtime.