Ratproof — open-source components
=================================

Ratproof runs speech recognition entirely in your browser. To do that it ships
several third-party components to your machine. All of them are redistributed
under permissive licences; this file is the attribution those licences require.

Model weights
-------------

Whisper (base)
  Original model:  openai/whisper-base
  Licence:         MIT
  https://github.com/openai/whisper

  ONNX conversion: onnx-community/whisper-base
  Licence:         Apache-2.0
  https://huggingface.co/onnx-community/whisper-base

  Served from this origin, unmodified. Two files (the encoder and the q4
  decoder) exceed the host's 25 MiB per-file limit and are split into parts at
  build time, then reassembled byte-for-byte before the browser sees them. The
  bytes you receive are identical to the published weights.

Silero VAD
  Model:    silero_vad.onnx
  Licence:  MIT
  https://github.com/snakers4/silero-vad

  Used to find speech before transcription, so silence is never sent to the
  speech model.

Runtimes
--------

ONNX Runtime Web
  Licence:  MIT
  https://github.com/microsoft/onnxruntime

  Served from this origin rather than a CDN, deliberately: a third-party CDN
  would observe every visitor, and this is executable code that handles your
  audio.

sherpa-onnx (WebAssembly VAD build)
  Licence:  Apache-2.0
  https://github.com/k2-fsa/sherpa-onnx

Transformers.js (@huggingface/transformers)
  Licence:  Apache-2.0
  https://github.com/huggingface/transformers.js

Application
-----------

React            MIT   https://github.com/facebook/react
Vite             MIT   https://github.com/vitejs/vite

A note on what "in your browser" means here
-------------------------------------------

Your audio is never uploaded. It is read from disk by the page, decoded in
memory, and passed to the speech model running locally in a Web Worker. The
page's Content-Security-Policy sets `connect-src 'self'`, which means the
browser itself will refuse any attempt by this page to send data to another
server — the guarantee is enforced by your browser, not only promised by us.

The one thing that does travel over the network is the download of the model
and runtime above, on your first visit. After that they are cached and repeat
visits transfer nothing at all.