46 lines
2.6 KiB
Markdown
46 lines
2.6 KiB
Markdown
# ADR-0009 — Optional audio recording & consent
|
|
|
|
- **Status:** Accepted
|
|
- **Date:** 2026-06-30
|
|
- **Context source:** User request (2026-06-30); design doc §"Audio Capture and Privacy"
|
|
|
|
## Context
|
|
|
|
WA captures system audio to transcribe it. Transcription needs audio only transiently — the design
|
|
already treats `audio.wav` as the source of truth for crash recovery. However, **persisting** a
|
|
full meeting recording is a distinct, higher-stakes choice: it is more sensitive than a transcript,
|
|
and recording conversations without consent is **illegal in some jurisdictions** (e.g. all-party /
|
|
two-party consent regions). The user wants recording to be a deliberate opt-in, saved as `.wav`,
|
|
with a clear legal caution.
|
|
|
|
## Decision
|
|
|
|
1. **Recording is OFF by default.** A per-meeting and a global default toggle ("Record this
|
|
meeting") control whether the captured audio is **retained** after processing.
|
|
2. When recording is **off**, audio is still written to a working file during the session (so
|
|
transcription and crash recovery work), but that working audio is **deleted** when the meeting
|
|
is finalized — only the transcript/notes persist.
|
|
3. When recording is **on**, the working audio is kept as the meeting's permanent `audio.wav`.
|
|
4. **Consent notice.** The first time a user enables recording (and surfaced near the toggle
|
|
thereafter), WA shows a non-blocking notice: *"Recording conversations without the consent of
|
|
participants may be illegal in your region. Check your local recording laws."* The user must
|
|
acknowledge once; the acknowledgment is stored. This is a caution, **not legal advice**.
|
|
5. The recording indicator (FR-CAP-4) already makes active capture obvious; when retention is on,
|
|
the UI additionally indicates the meeting is being **saved**.
|
|
|
|
## Consequences
|
|
|
|
- **Positive:** privacy-respecting default (transcript-only); users opt into the heavier artifact
|
|
knowingly; the legal caution reduces the chance of inadvertent unlawful recording; reuses the
|
|
existing working-audio path, so little new machinery.
|
|
- **Negative / care:** the "delete working audio on finalize" path must be robust and must not race
|
|
with crash recovery — deletion happens only after the transcript is successfully finalized
|
|
(audio remains the source of truth until then, ADR-0006); retention/sync must treat a non-recorded
|
|
meeting as "no audio artifact exists".
|
|
- **Interaction with sync (ADR-0010):** only **retained** recordings are eligible to upload; a
|
|
non-recorded meeting can still sync its transcript/notes.
|
|
|
|
## Revisit if
|
|
We add region detection to tailor the consent copy, or a "record microphone too" feature (separate
|
|
consent considerations).
|