Persona

LAPLACE Persona is a local-first desktop application. The current release does not feature user accounts. Except for optional Error Reporting, Persona never collects, uploads, or analyzes personal information, face tracking data, or Live2D/VRM model files, and contains no user behavior tracking. Outgoing requests initiated by the application are strictly limited to update checks and diagnostic error reporting (both fully user-configurable). All other network traffic originates from user-added layer assets or connected third-party plugins, as detailed under Outgoing Requests.

• Process-Level Sandbox Isolation: The renderer process runs in a sandboxed execution context with Context Isolation enabled and Node.js integration disabled, communicating with the main process exclusively via a type-safe, whitelist-bounded IPC bridge.
• Direct Filesystem Access Prevention: Model and media assets are served securely via a custom persona: protocol scheme using opaque identifiers, verifying symlink containment at the kernel filesystem level rather than relying on naive path string checks. The renderer process never receives absolute local file paths.
• Whitelist Asset Registration: Scenes reference assets strictly by registry IDs. Only paths explicitly opened via system file dialogs or registered through Plugin Directories are served, preventing arbitrary local filesystem reads through crafted scene files.
• Local Persistence for Preferences and Credentials: Window geometry, scene layouts, tracking parameters, and API configuration remain stored on local disk; sensitive API tokens are secured within OS-level credential stores (Keychain / Credential Manager). Third-party plugin storage via the API is likewise confined locally and partitioned by API key, and is permanently purged upon key revocation.
• Local Diagnostic Logs: Runtime error logs and warnings are written strictly to logs/main.log in the local preferences directory and are never uploaded automatically. They may include personal details, so share them only when a developer asks, and never post them publicly. Web layer URLs in logs are sanitized to record only layer IDs and hostnames, preventing streaming overlay tokens from appearing in plain text.
• Local Version History: When version history is turned on for a model, its saved versions are kept only in the history/ folder of the local preferences directory and are never uploaded. Persona never pushes or fetches these Git repositories, and commits are authored by LAPLACE Persona, never your system account name.
• Local Network Boundary for Tracking Data: Facial tracking and motion capture receivers communicate exclusively with devices on your local network (LAN) and never forward capture streams to the internet.
• Ephemeral Camera and Microphone Streams: Camera video and microphone audio are processed entirely in volatile memory for feature extraction; raw video and audio are never recorded, saved, or uploaded, as described under Camera and Microphone.
• Disabled-by-Default Plugin API: The Plugin API is disabled by default; when enabled, it binds exclusively to the local loopback interface and enforces API key authentication. External devices cannot connect unless local network access is explicitly toggled on.
• Transparent Update and Catalog Queries: Persona queries downloads.vrp.moe upon startup and when clicking the version display to check for new releases, and queries marketplace.laplace.live when opening the Control Panel or checking for updates to fetch the public content catalog. Neither request transmits user, machine, or installed-item identifiers, and app installers or catalog asset archives are downloaded from downloads.vrp.moe only when you explicitly click to download or update.
• Configurable Diagnostic Reporting: Application crashes and unhandled exceptions are captured to assist troubleshooting. Users can disable diagnostic error reporting at any time via Send Error Reports in Settings.

Outgoing RequestsCopy Anchor Link

The following table summarizes all potential network connections from Persona. Software update checks and error reports originate from the desktop client; web layers and audio streams originate from user-configured assets or authorized plugins:

All UI scripts, fonts, and vector icons are bundled directly within the application binary and load without network access. External documentation links open in the system default browser. Tracking receivers and the Plugin API communicate directly over configured local socket ports.

Webcam Tracking and Microphone Lip Sync operate entirely offline once installed. Webcam tracking uses Google's MediaPipe library, downloaded on demand as a SHA-256-verified add-on from downloads.vrp.moe, which by default tries to send telemetry to odml.pa.googleapis.com when initializing its model; Persona intercepts and cancels this request before it leaves the app.

Update ChecksCopy Anchor Link

Update verification retrieves a static JSON manifest identical for all clients, and version comparison is performed locally. The request carries no unique hardware or user identifiers. Release notes are embedded directly in the manifest, eliminating secondary network queries; installers download only when you click Update.

Automatic update checking cannot be disabled in application settings, but can be blocked at the network perimeter via downloads.vrp.moe. Enterprise .msi installations on Windows omit the auto-update subsystem entirely.

Error ReportingCopy Anchor Link

Diagnostic crash reports are transmitted to Sentry's ingest endpoints located in the United States, in accordance with the Sentry Privacy Policy. Unhandled exceptions from the renderer process are sanitized and dispatched through the main process. Disabling Send Error Reports unregisters the Sentry SDK instance completely, stopping all event collection. This setting is saved in settings.json and takes effect the next time you launch the app.

Crash reports do not collect user names, account IDs, or email addresses, and screen capture features are disabled. File paths in stack traces are normalized to relative application paths to avoid exposing operating system user folder structures. Because recent UI breadcrumbs may log layer interactions, users whose web overlay URLs contain access tokens should disable error reporting.

User-Configured ConnectionsCopy Anchor Link

Web Layers execute in isolated browser sessions with direct network connectivity, exposing the client's public IP address to the destination server. Persona does not proxy or inspect this traffic. Sessions remain in-memory and are cleared upon closing the application; all hardware permission requests (such as camera, microphone, and geolocation) are rejected automatically. The User-Agent header uses standard Chrome identifiers with a LAPLACE-Persona/<version> tag appended.

speech.play allows plugins to trigger audio playback. If a plugin supplies an https: URL, Persona downloads and streams the remote asset; data:audio/* Base64 URIs are decoded and played entirely in memory without network traffic.

Camera and MicrophoneCopy Anchor Link

Webcam Tracking and Microphone Lip Sync are disabled by default. When enabled, video frames and audio buffers are processed in memory solely for real-time feature extraction. Persona never records, saves, or uploads raw camera footage or microphone audio, never exposes raw media streams to the Plugin API, and never plays microphone input back through your speakers. It passes only derived tracking values (such as head pose, facial blendshapes, skeletal points, and volume in decibels), which are not saved either.

Settings retain only hardware device identifiers and user-configured sensitivity parameters. Real-time camera calibration parameters are not stored on disk. Microphone voice calibration similarly discards all recorded audio: the 2-second calibration sample is processed via short-time Fourier transforms to extract 12 Mel-Frequency Cepstral Coefficients (MFCC) per frame, which are written alongside device identifiers to settings.json in the configuration directory. This spectral calibration data remains on your local machine until cleared via Reset Profile.

Disabling Enable Webcam Tracking releases the camera hardware handle immediately. Microphone input remains active as long as Enable Lip Sync is toggled on, or if an active Automation uses a Microphone Volume trigger. To revoke hardware access at the operating system level, adjust camera or microphone permissions in system privacy settings.

Authorized Plugin API clients can toggle tracking states, enumerate audio devices, and subscribe to real-time blendshape streams and audio volume levels, but cannot access raw media streams or spectral calibration profiles. In rare native crash scenarios, memory minidumps captured by optional Error Reporting might contain residual memory artifacts present at the moment of the crash.

LAPLACE Persona Tracker (iOS)Copy Anchor Link

This section is the privacy policy for the LAPLACE Persona Tracker app for iPhone and iPad. The app uses Apple ARKit face tracking (TrueDepth API) to drive avatars in LAPLACE Persona on your computer. The app contains no user accounts, requires no registration, and transmits zero data to LAPLACE servers. Desktop update checking and error reporting mechanisms do not run within the iOS client.

Face Data Collected by the AppCopy Anchor Link

With camera permissions granted, the application uses the front-facing TrueDepth camera via ARKit to capture and calculate the following face data:

• 52 standard facial expression blendshape coefficients (including eye gaze, eyebrows, mouth, and tongue movements);
• Head orientation quaternions, 3D translation vectors, and face tracking presence flags;
• Facial mesh geometry and eye gaze points (used exclusively to render the real-time on-screen preview wireframe);
• Neutral reference calibration values (4 orientation components and 3 translation components) generated upon tapping Calibrate.

The application never records, stores, or transmits raw camera images, video streams, or depth map buffers, and never transmits face data to LAPLACE servers or third parties.

Use of Face DataCopy Anchor Link

Face data is used only to render on-screen preview wireframes, establish neutral rest calibration, and transmit live blendshapes across your local network to drive avatars within LAPLACE Persona. Face data is never used for biometric identification, authentication, advertising, profiling, data mining, or machine learning model training.

Consent and ControlCopy Anchor Link

The application requests iOS system permissions before accessing the camera or scanning the local network. Face tracking data leaves the device only after you tap Connect and select a destination computer. The app remembers this host configuration and streams tracking data while open until disconnected manually.

The application requests no additional device permissions (such as microphone, photo library, contacts, or location). Without camera access, face tracking cannot function; without local network access, on-screen previews continue operating locally, but data cannot reach your computer.

You may revoke consent at any time:

• Tap Change → Disconnect to halt data streaming and purge host connection credentials;
• Revoke Camera permissions in iOS Settings to terminate the tracking engine;
• Tap Calibrate again to replace the stored neutral rest pose, or delete the app to remove it. There is no separate reset, and the app never sends this pose off your iPhone.

Disclosure and Sharing of Face DataCopy Anchor Link

The application transmits face tracking data exclusively to the user-selected computer running LAPLACE Persona: 52 blendshape values, head pose coordinates, face presence flags, and protocol sequence headers. It never transmits image buffers, video streams, depth frames, facial point clouds, or eye coordinates. LAPLACE Persona processes these values strictly in volatile memory. UDP broadcast discovery packets contain only device model strings (such as iPhone) without face data.

The iOS application integrates no third-party SDKs, advertising trackers, analytics libraries, or external crash reporting tools, and never shares or sells face data to advertising networks or data brokers.

On your computer, third-party software can receive tracking values only if you explicitly enable the Plugin API and authorize the client; data received by such clients is governed by their respective privacy policies.

Storage and Retention of Face DataCopy Anchor Link

Face tracking data exists solely in volatile memory (RAM) on the mobile device and receiving computer during active tracking sessions; neither application maintains tracking history databases. The only face data stored persistently on the iOS device is the neutral rest pose calibration profile saved in local application preferences. The app does not sync this data to the cloud, though it may be included in encrypted device backups created via iCloud or Finder. LAPLACE has no access to these backups.

Retention and DeletionCopy Anchor Link

• Live Face Data: Retained in volatile RAM only during active tracking and discarded immediately when the application closes;
• Neutral Rest Pose Calibration: Retained locally until you calibrate again, which replaces it, or delete the app; there is no separate reset. Using the iOS "Offload App" feature preserves this configuration.

LAPLACE retains no face data on its servers. For privacy-related inquiries, contact s@laplace.live.

Other Configuration DataCopy Anchor Link

Beyond calibration parameters, the application stores only recent host IP addresses and toggle states for Save Energy and Normalized Face Mesh in local preferences. The app does not collect personal names, email addresses, or contact information, performs no cross-app tracking, and never merges face data with external data sets.

SecurityCopy Anchor Link

Face tracking data is transmitted directly to the user-specified local IP address over a private local network (LAN/Wi-Fi). Because raw UDP motion packets are unencrypted, streaming should be restricted to trusted private network environments.