Persona

Persona runs on your machine without an account. Apart from optional bug reports, we don't collect, upload or analyze your personal information, face data, or models such as Live2D and VRM, and the app has no usage analytics. It initiates only update checks and bug reports. Other requests come from content you add or plugins you connect; see Outbound Requests

• Process isolation: the renderer runs sandboxed with context isolation on and Node integration off. It reaches the rest of the application through a restricted, typed bridge
• No filesystem access from the renderer: model and asset files are served over a custom persona: protocol that resolves opaque identifiers to files, with a containment check that follows symlinks rather than comparing path strings. The renderer never receives a real path
• Asset paths are allowlisted: a scene references content by registry id, and only a file registered through the native file dialog or a plugin folder can be served — so no setting written by the renderer can turn an arbitrary path into a readable URL
• Settings stay on disk: window bounds, scenes, tracking preferences and API keys are stored locally, with tokens held in the operating system's secure storage. What a plugin stores over the API stays local too, isolated per key and deleted with it
• The diagnostic log is written locally: errors and warnings always go to logs/main.log in the settings folder, and nothing ever uploads it. Attaching it to a report is your call. A webpage layer's address is never logged — only its id and host, because a streaming overlay URL often carries a token
• Tracking never leaves the LAN: the face and pose tracking receivers speak only to a device on your local network
• Camera and microphone input stays in the app: webcam tracking and lip sync process frames and audio in memory, and Persona never records or uploads them. See Camera and Microphone
• The Plugin API is off by default: when enabled it listens on loopback only, requires a key, and reaches the network solely if you turn local network access on yourself
• Update checks: Persona asks downloads.vrp.moe whether a newer build exists, on launch and when you click the version number. Nothing is sent about you, and nothing downloads until you choose to
• Bug reports: crashes and errors are reported to help diagnose application problems. Report contents, including possible webpage URLs, are described below. The Send Bug Reports switch in Settings turns it off entirely

Outbound Requests

The table below lists Persona's outbound requests. Update checks and error reports are initiated by the app; webpage and audio requests come from content you add or plugins you connect. The data involved is described for each request:

The interface’s scripts, fonts and icons are bundled with the app and require no network requests. Links open in your system browser. Tracking and the Plugin API communicate directly with the devices you configure

Webcam tracking and lip sync make no network requests — everything they run ships with the app. Webcam tracking is built on Google's MediaPipe library, which tries to upload usage metrics to odml.pa.googleapis.com as it loads each tracking model; Persona cancels that request before it is sent

The Update Check

Update checks fetch the same static release manifest for every user and compare versions locally. The request contains no installation identifier. Release notes are included in the manifest, so opening the update dialog needs no additional request. The installer is downloaded only after you choose Update

The app has no setting to disable update checks. To prevent them, block downloads.vrp.moe. Windows .msi installations do not check for updates because they cannot update themselves

Bug Reports

Reports go to Sentry, on their US ingest endpoint — see Sentry's Privacy Policy. The renderer never talks to Sentry itself: an event crosses into the main process first, so reporting is controlled in one place. With Send Bug Reports off the reporter is never created, and renderer events are not uploaded. The setting is read from settings.json while the app starts, so turning it off applies from the next launch

Reports do not explicitly attach an account, name or address, and the SDK’s screenshot feature is disabled. File paths are rewritten relative to the app to keep your home directory out of stack traces. Reports still include recent app events, which may contain webpage layer URLs. If an overlay URL contains a token or other sensitive information, turn off bug reports

Connections You Configure

A webpage layer runs in a browser session and makes its own network requests, so the sites it loads can see your IP address. Persona does not proxy these requests. It uses isolated, in-memory sessions that are cleared when the app closes, denies all permission requests, and uses a Chrome User-Agent with a LAPLACE-Persona/<version> token

speech.play loads audio through the Plugin API. A plugin passing an https: URL makes Persona fetch that clip; a data:audio/* payload is inline and touches no network

Camera and Microphone

Webcam tracking and lip sync are off by default. Once turned on, they process camera frames and microphone audio in memory, inside the app. Persona never records, saves or uploads the frames or the audio, never passes them to the Plugin API, and never plays microphone audio through your speakers. It works only with the values derived from them — head pose, expressions, and hand and body movement from the camera; volume and vowel shapes from the microphone — and does not save those either

The settings record which camera and microphone you chose, and their options; webcam calibration is not saved. Voice calibration keeps no recording either: from each two-second take it keeps only twelve spectral coefficients (MFCCs) per analysis frame, and saving stores these, with the microphone's name, in settings.json in the settings folder, one profile per microphone. This is voice-derived calibration data, not an audio recording. It stays on this computer (and in any backup you make of that folder) until Reset Profile removes it for the selected microphone; other microphones keep theirs

Turning off Enable Webcam Tracking releases the camera. The microphone stays in use while Enable Lip Sync is on, or while an enabled automation has a Microphone Level trigger — that trigger listens even with lip sync off. To cut off access entirely, revoke Persona's camera or microphone permission in your operating system's privacy settings where available

A Plugin API client you authorize can turn webcam tracking and lip sync on or off, list your microphones, and read the live tracking values and microphone levels, but never frames, audio or calibration data. Optional bug reports can include a native crash memory dump, and we do not claim it excludes camera or microphone data that was in memory at the moment of the crash

LAPLACE Persona Tracker (iOS)

This section is the privacy policy for LAPLACE Persona Tracker, the iPhone and iPad app. The app uses Apple's ARKit face tracking (TrueDepth APIs) to animate your avatar in LAPLACE Persona on your computer. It has no account or sign-in, and sends nothing to LAPLACE servers. The desktop app's update checks and bug reporting described above do not run in the iOS app.

Face Data the App Collects

With your permission, the app uses ARKit and the front camera, which is the TrueDepth camera on devices that have one, to collect the following face data on your device:

• 52 facial expression values, such as eye, eyebrow, mouth and tongue movement
• Head rotation and position, and whether a face is tracked
• Face geometry and eye positions, used only to draw the preview on screen
• If you tap Calibrate, one neutral head pose: four rotation values and three position values

The app does not record, save or transmit camera images, video or depth data, and never sends face data to LAPLACE servers or to any third party.

How Face Data Is Used

Face data is used only to show the live preview, to make your calibrated pose the neutral one, and to animate your avatar in LAPLACE Persona on the computer you choose, including any tracking-based automations you set up there. It is never used for identification, authentication, advertising, marketing, analytics, profiling, data mining or model training.

Consent

iOS asks for your permission before the app can use the camera and before it can reach your local network. Face data leaves your device only after you tap Connect and choose a computer. The app remembers that computer and sends face data to it while the app is open, until you disconnect.

The app asks for no other permissions, such as access to your microphone, photos, contacts or location. Without camera access it cannot track your face. Without Local Network access, the preview still works but face data cannot reach your computer.

You can withdraw consent at any time:

• Change → Disconnect stops sending face data and forgets the computer; the preview keeps working
• Turning off the app's Camera access in iOS Settings stops face tracking
• Reset Calibration, the circular-arrow button next to Calibrate, deletes the saved neutral pose

Sharing and Third Parties

The app sends face data only to the computer you choose, running LAPLACE Persona: the 52 expression values, head rotation and position, and whether a face is tracked, with protocol and sequence information. It never sends images, video, depth data, face geometry or eye positions. LAPLACE Persona is our own app and handles these values under this policy, in memory and without saving them. The discovery messages the app broadcasts to find computers carry the device model name, such as iPhone, and no face data.

The iOS app contains no third-party SDKs, analytics, advertising or crash reporting, and does not share face data with any third party. We do not sell face data or provide it to advertising platforms, analytics providers, data brokers or information resellers.

On your computer, one optional LAPLACE Persona feature can pass tracking values on: the Plugin API, off by default. If you turn it on and authorize a client, that client can read live tracking values, but never images or face geometry. You choose that software, and its own privacy practices apply to what it receives.

Where Face Data Is Stored

While tracking runs, face data is held only in memory: on your iPhone or iPad, and on the computer receiving it. Neither app saves a history of it. The only face data the iOS app stores is the calibrated neutral pose, in the app's local preferences on your device. The app does not sync it, but iOS may include it in iCloud or computer backups, depending on your backup settings. LAPLACE cannot access those backups.

Retention and Deletion

• Live face data stays in memory only while the app using it runs, and is released when that app quits
• The calibrated neutral pose is kept until you tap Reset Calibration, calibrate again to replace it, or delete the app. Offloading the app keeps it, and a device backup keeps its copy until that backup is deleted

LAPLACE holds no face data. For any privacy request, contact s@laplace.live.

Other Data

Apart from the calibrated pose, the app saves only the name and IP address of the computer you connect to, and your Save Energy and Normalized Face Mesh settings. They stay in the same local preferences as the pose until you change them or delete the app, and Change → Disconnect forgets the computer. The app never asks for your name, email address or other contact information, does not track you across other companies' apps or websites, and never combines face data with information from other sources.

Security

The app sends tracking values only to the computer address you choose, which is meant to be on your own local network, and iOS requires your Local Network permission to reach it. The connection is not encrypted, so use a network you trust.