Persona

Persona runs on your machine without an account. Models, scenes and settings are stored locally, and the app collects no usage analytics. It initiates update checks and optional error reports. Other requests come from content you add or plugins you connect; see Outbound Requests

• Process isolation: the renderer runs sandboxed with context isolation on and Node integration off. It reaches the rest of the application through a restricted, typed bridge
• No filesystem access from the renderer: model and asset files are served over a custom persona: protocol that resolves opaque identifiers to files, with a containment check that follows symlinks rather than comparing path strings. The renderer never receives a real path
• Asset paths are allowlisted: a scene references content by registry id, and only a file registered through the native file dialog or a plugin folder can be served — so no setting written by the renderer can turn an arbitrary path into a readable URL
• Settings stay on disk: window bounds, scenes, tracking preferences and API keys are stored locally, with tokens held in the operating system's secure storage. What a plugin stores over the API stays local too, isolated per key and deleted with it
• The diagnostic log is written locally: errors and warnings always go to logs/main.log in the settings folder, and nothing ever uploads it. Attaching it to a report is your call. A webpage layer's address is never logged — only its id and host, because a streaming overlay URL often carries a token
• Tracking never leaves the LAN: the face and pose tracking receivers speak only to a device on your local network
• The Plugin API is off by default: when enabled it listens on loopback only, requires a key, and reaches the network solely if you turn local network access on yourself
• Update checks: Persona asks downloads.vrp.moe whether a newer build exists, on launch and when you click the version number. Nothing is sent about you, and nothing downloads until you choose to
• Bug reports: crashes and errors are reported to help diagnose application problems. Report contents, including possible webpage URLs, are described below. The Send Bug Reports switch in Settings turns it off entirely

Outbound Requests

The table below lists Persona's outbound requests. Update checks and error reports are initiated by the app; webpage and audio requests come from content you add or plugins you connect. The data involved is described for each request:

The interface’s scripts, fonts and icons are bundled with the app and require no network requests. Links open in your system browser. Tracking and the Plugin API communicate directly with the devices you configure

The Update Check

Update checks fetch the same static release manifest for every user and compare versions locally. The request contains no installation identifier. Release notes are included in the manifest, so opening the update dialog needs no additional request. The installer is downloaded only after you choose Update

The app has no setting to disable update checks. To prevent them, block downloads.vrp.moe. Windows .msi installations do not check for updates because they cannot update themselves

Bug Reports

Reports go to Sentry, on their US ingest endpoint — see Sentry's Privacy Policy. The renderer never talks to Sentry itself: an event crosses into the main process first, so reporting is controlled in one place. With Send Bug Reports off the reporter is never created, and renderer events are not uploaded. The setting is read from settings.json while the app starts, so turning it off applies from the next launch

Reports do not explicitly attach an account, name or address, and the SDK’s screenshot feature is disabled. File paths are rewritten relative to the app to keep your home directory out of stack traces. Reports still include recent app events, which may contain webpage layer URLs. If an overlay URL contains a token or other sensitive information, turn off bug reports

Connections You Configure

A webpage layer runs in a browser session and makes its own network requests, so the sites it loads can see your IP address. Persona does not proxy these requests. It uses isolated, in-memory sessions that are cleared when the app closes, denies all permission requests, and uses a Chrome User-Agent with a LAPLACE-Persona/<version> token

speech.play loads audio through the Plugin API. A plugin passing an https: URL makes Persona fetch that clip; a data:audio/* payload is inline and touches no network

LAPLACE Persona Tracker (iOS): Face Data

This section describes the iPhone and iPad companion app. The desktop app's update checks and bug reporting described elsewhere on this page do not run in the iOS app.

Face Data We Access and Use

With camera permission, LAPLACE Persona Tracker uses Apple's ARKit to process the front camera input on your device. The face data used by the app consists of 52 facial expression values, including eye and mouth movements, head rotation and position, whether a face is tracked, and face geometry and eye transforms for the on-device preview. Camera images and any depth information used by ARKit are processed on the device; the iOS app does not record or transmit them.

We use face data only to show the live face preview, animate your avatar in LAPLACE Persona on the computer you select, and make your chosen head pose neutral when you tap Calibrate. Normalized Face Mesh displays expressions on a generic face; it does not stop face tracking or change the transmitted values. Face data is not used for identification, authentication, profiling, advertising, marketing, analytics, data mining or model training.

Face Data Transmission and Sharing

The iOS app sends numerical expression values, head rotation and position, and tracking status directly to the computer you select for avatar animation. The packets also contain protocol and sequence information. Camera images, video, depth images, face geometry and eye-transform matrices are not transmitted. The selected computer is remembered, so transmission resumes to that computer when you reopen the app until you disconnect or choose another computer.

This connection is intended for your own local network and uses UDP without application-layer encryption. Use a trusted network and a computer you control. Discovery broadcasts contain the device name and protocol information, not face measurements.

The iOS app does not upload face data to LAPLACE servers or third-party services, and includes no third-party analytics, advertising or crash-reporting SDKs. We do not sell face data or provide it to advertisers, analytics providers or data brokers. The direct recipient of the tracking stream is the computer you select. Device backups and optional desktop features are described below.

Face Data Storage, Retention and Deletion

Live camera and face-tracking data are processed in working memory. The iOS app does not save photos, video, facial meshes or a history of expression frames. Current runtime data is updated during use and released when the app process ends; pausing or disconnecting does not immediately erase every runtime buffer.

If you tap Calibrate, the iOS app saves one neutral head pose in its local app preferences (UserDefaults): four rotation values and three position values. This is face-derived calibration data, not a face image, facial mesh or expression recording. It remains across launches, with no automatic expiry, until you tap Reset Calibration to delete it, calibrate again to replace it, or delete the app and its local data. Offloading the app keeps its data.

The app does not implement cloud synchronization. However, iOS may include the saved calibration and other app preferences in device backups, including iCloud Backup or a backup on your computer, according to your backup settings. Existing backup copies are managed through those settings; resetting calibration or deleting the app does not erase an existing backup. Restoring a backup may restore the saved calibration. LAPLACE does not receive or control those backups.

The receiving desktop processes the current tracking values and smoothing state in memory without automatically saving a tracking history. It may retain the latest pose during an interrupted connection. If you separately enable the desktop Plugin API and authorize a client, that client can read live numerical tracking inputs. Any copies made by software you authorize are governed by that software's storage and deletion practices. The desktop also has optional bug reporting to Sentry, including native crash memory dumps, as explained under Outbound Requests and Bug Reports. We do not claim that those dumps exclude all face-related runtime memory. The iOS app has no such reporting feature.

Face Data Controls

Use Change → Disconnect to stop sending tracking values and forget the selected computer; the local preview continues. Moving the app to the background pauses camera tracking. To stop camera access, revoke the app's Camera permission in iOS Settings. Use Reset Calibration, the circular-arrow button next to Calibrate, to delete the saved neutral pose. Disconnecting, backgrounding or revoking camera access does not delete that saved calibration. Manage or delete existing device backups separately in your backup settings.