Should local-only translation be the baseline?

I use speech-to-speech translation in multilingual meetings, and I think a genuinely local, session-only mode should be a baseline feature—not a premium privacy setting. Raw audio, voice embeddings, partial transcripts, and translation intermediates should remain on the device, with encrypted ephemeral buffers and deletion at session end. The hard part is proving that “not stored” includes logs, retries, diagnostics, and vendor-side processing rather than just the final recording.

The trade-off is real: local models may use too much battery or memory and can struggle more with code-switching, accents, or less-supported languages. Cloud processing may be faster and better, so I understand making it the default in some contexts. But privacy-sensitive meetings need a reliable fallback, even if it is visibly less accurate. Would you accept noticeably worse translations to avoid sending conversational audio to a vendor? I’d especially like examples of tools or architectures that handle this trade-off honestly.

The network-level enforcement matters more than the checkbox. If local mode still permits telemetry, crash uploads, or a cloud retry after a timeout, it is mostly a trust exercise. I’d want the session to fail visibly when a required model is missing—not silently downgrade to remote processing.

I agree with the baseline argument, but I’d be careful about promising deletion as proof of deletion. An inspectable event log can show what the client attempted, not necessarily what a closed device or OS retained. That is still useful; it is just a narrower assurance than many privacy labels imply.

The product problem is that most users will choose the translation that keeps the meeting moving. I’d make local mode one clear session toggle, show the expected language coverage and battery cost, and let teams set it as a policy. Hiding it behind an expensive tier creates exactly the wrong incentive.

Voice embeddings deserve special attention. Even if audio is discarded, an intermediate speaker representation can still be sensitive. My minimum would be no network route in local mode, model files verified locally, bounded memory buffers, and a testable audit trail—not a marketing sentence saying “we don’t store audio.”

A hybrid design seems practical: download language packs, run recognition and translation locally, and offer cloud escalation only after explicit per-session consent. The interface should say which language pair triggered the limitation. That makes quality degradation a visible engineering constraint instead of a surprise privacy failure.