2.6 KiB
2.6 KiB
ADR-0009 — Optional audio recording & consent
- Status: Accepted
- Date: 2026-06-30
- Context source: User request (2026-06-30); design doc §"Audio Capture and Privacy"
Context
WA captures system audio to transcribe it. Transcription needs audio only transiently — the design
already treats audio.wav as the source of truth for crash recovery. However, persisting a
full meeting recording is a distinct, higher-stakes choice: it is more sensitive than a transcript,
and recording conversations without consent is illegal in some jurisdictions (e.g. all-party /
two-party consent regions). The user wants recording to be a deliberate opt-in, saved as .wav,
with a clear legal caution.
Decision
- Recording is OFF by default. A per-meeting and a global default toggle ("Record this meeting") control whether the captured audio is retained after processing.
- When recording is off, audio is still written to a working file during the session (so transcription and crash recovery work), but that working audio is deleted when the meeting is finalized — only the transcript/notes persist.
- When recording is on, the working audio is kept as the meeting's permanent
audio.wav. - Consent notice. The first time a user enables recording (and surfaced near the toggle thereafter), WA shows a non-blocking notice: "Recording conversations without the consent of participants may be illegal in your region. Check your local recording laws." The user must acknowledge once; the acknowledgment is stored. This is a caution, not legal advice.
- The recording indicator (FR-CAP-4) already makes active capture obvious; when retention is on, the UI additionally indicates the meeting is being saved.
Consequences
- Positive: privacy-respecting default (transcript-only); users opt into the heavier artifact knowingly; the legal caution reduces the chance of inadvertent unlawful recording; reuses the existing working-audio path, so little new machinery.
- Negative / care: the "delete working audio on finalize" path must be robust and must not race with crash recovery — deletion happens only after the transcript is successfully finalized (audio remains the source of truth until then, ADR-0006); retention/sync must treat a non-recorded meeting as "no audio artifact exists".
- Interaction with sync (ADR-0010): only retained recordings are eligible to upload; a non-recorded meeting can still sync its transcript/notes.
Revisit if
We add region detection to tailor the consent copy, or a "record microphone too" feature (separate consent considerations).