Say you want to change how your voice sounds before you send a clip — keep your own words, borrow someone else's pitch and timbre. The obvious way is a server: upload your audio, a model converts it, you get a file back. The obvious way is also the way that leaks. Your voice, on someone's disk, in someone's logs, for as long as they keep it.
The alternative is to never send it anywhere. Run the whole conversion — a text frontend, a carrier-voice model, pitch tracking, a retrieval index, and the generator that actually swaps the voice — inside the tab, on whatever laptop happens to be open. RVC, the method underneath this, normally runs as a Python script with a GPU next to it. Getting it into ONNX Runtime Web meant re-exporting every stage as fixed-shape, browser-compatible graphs: a pitch model (RMVPE), a speech-feature model (ContentVec), and a similarity index that's normally hundreds of megabytes of FAISS, shrunk down to a compact per-voice index built only from coarse centroids (5–7 MB, measured, per voice).
Three sources — the voice pack's card, the runtime's card, and the live page itself — describe the identical five-stage pipeline. A direct fetch of the live page reads "your text and audio stay on this device," badge: "WASM · local inference." An unrelated internal audit, done for other reasons, says the same thing independently: the static host doesn't receive text or audio. We also read the demo's own client-side JavaScript directly and found no outbound call anywhere — no upload path exists in the code itself, which is stronger evidence than card text alone.
It's heavy, though. A cold run — before the browser has cached anything — took 32.7 seconds to generate a 6.15-second clip from text, and 45.2 seconds to generate a 9.38-second clip from an uploaded recording, on one unnamed desktop Chrome install. (There's no microphone button on this demo — it's upload-only, a text box or a file picker, not a record control.) The two shared model files add up to 370 megabytes; the default text-to-voice tab pulls in a third, a 77-megabyte carrier-voice model, for about 448 megabytes before you've even picked a voice — converting an uploaded recording instead skips the carrier model and stays at 370. All of it comes from Hugging Face model repos, not from the small Space page that hosts the demo itself — that page stores barely 38 megabytes, just the script and a manifest pointing elsewhere. A leaner INT8 export exists, but the team's own notes call it a "synthetic calibration probe" that still needs real feature calibration and listening tests — it is explicitly not what the live demo serves today. Desktop Chrome is the first supported target; a phone is someone else's problem for now.
The four voices on offer were trained on recordings from IndicVoices-R, a public Indian speech dataset. The model's own card cites a CC BY 4.0 licence for that data. Ampixa's internal review caught what the card doesn't mention: the dataset's two official sources disagree — but not because AI4Bharat itself is unsure. AI4Bharat's own channels, the paper that introduced the dataset and its own Hugging Face card, consistently say CC BY 4.0. It's a different, third-party source, India's AIKosh government portal, that labels the same dataset CC BY-ND — no derivatives. By the usual meaning of that word, a trained voice-conversion model would count as one. Nobody has reconciled the two labels, and the audit's own instruction is not to pick one off a portal page and move on.
Separately, and this is the part that outweighs any licence box: nothing on either side says the people whose voices these were ever agreed to have their voice turned into a model a stranger can load in a tab and drive with a slider. The dataset card doesn't address it. The voice pack's one consent-adjacent line is an instruction to downstream users about the audio they feed in — not a statement about what the four original speakers agreed to. Those speakers are identified only by opaque dataset IDs in every document reviewed, never by name — but the same IDs key into the upstream dataset's own per-speaker rows, which carry age group, district, and occupation. That's a narrower shield than "anonymous" sounds. Either way, it is not consent.
The engineering claim checks out, cleanly. The rights claim doesn't.
Next is not a launch. It's pinning the actual upstream dataset version, getting a straight reconciliation of AIKosh's label against AI4Bharat's own, and, separately, finding out — not assuming — whether the four speakers were ever asked. Nothing found says they were asked and said no; nothing found says they were asked at all.