VOQR processes all voice data locally on your machine. No audio, transcriptions, or AI responses are transmitted to VOQR servers — because there are no VOQR servers.

If you discover a security or privacy vulnerability in VOQR, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting to submit a confidential report.

You can expect:

• Acknowledgment within 48 hours
• An assessment of severity and impact
• A fix published to the VS Code Marketplace as soon as possible

This policy covers the VOQR VS Code extension, its bundled STT/TTS components, and the local server. It does not cover third-party AI providers (GitHub Copilot, HuggingFace, AI Toolkit, etc.) — those should be reported to their respective teams.