About · security · license

A local tool should be auditable.

VoiceSynth Studio is a Python orchestration layer around open TTS models. This page describes what it does with your data, what it downloads, and what it deliberately does not do.

What this project is

A local-first TTS workstation: a backend interface, an inference manager, a PyQt6 studio and a CLI. It is a unified front end for external model families, not a new TTS model. The repository contains roughly 12,725 lines of Python across 52 files, with 21 core modules.

The design goal is a predictable local workflow: choose a backend, provide a reference voice if you want cloning, synthesize, review the waveform, save audio. Batch and profile management are support features, not cloud services.

AT A GLANCE

Version
0.1.1
License
MIT
UI
PyQt6
State
SQLite + JSON
Site host
tts.danubelabs.net
Repository
GitHub

Security model

Data flow, stated plainly.

DataWhere it goesPersisted?
Text you synthesizeLocal process memory, then the selected model backend. No remote TTS API.Only if you save a text file; the app does not log text content beyond a character count.
Reference / cloned audioLocal filesystem and the model process.Path and transcript may be stored in your profile database if you save a profile.
Generated WAVLocal output path you choose.Yes, by definition.
Speaker profilesSQLite at ~/.config/voicesynth/profiles.db.Yes; export/import is a JSON .vsp file.
Model weightsHugging Face Hub on first use.Cached under ~/.cache/huggingface/hub.
Logsstderr/stdout.Backend names, progress and errors; no telemetry upload.
This websiteGitHub Pages.No analytics scripts, no cookies, no third-party fonts or trackers.

No authentication or server surface

The desktop app opens no HTTP port. It does not ship an API server. There are no credentials or API keys to manage.

Third-party model trust

Weights and model code are downloaded from Hugging Face and installed from upstream Git repositories. You are trusting those projects and the integrity of your network. Pin revisions where it matters to you.

File paths are user-supplied

Reference audio, text files, adapters and output paths come from the user. The app writes where you point it; it does not sandbox paths.

Placeholder fallbacks are intentional

Some backends return tones instead of failing. This is a usability choice, not a security boundary; check logs if audio is unexpected.

Voice cloning and consent. Clone only voices you have permission to use. Synthetic speech can be mistaken for a real person. The project does not add watermarks or provenance metadata to generated audio, and the MIT license grants no rights to third-party voices or model weights.

Reporting a vulnerability

Open a private security advisory on GitHub, or contact the maintainer via the repository. Do not publish exploitable details before a fix is available. See SECURITY.md for scope and expectations.

License

The source is released under the MIT License. Model weights, vocoders and third-party repositories retain their own licenses: F5-TTS, GPT-SoVITS, Fish Speech, ONNX Runtime, OpenVINO, TensorRT, llama.cpp and vLLM.

ACKNOWLEDGEMENTS

Listing a project does not mean its backend is complete here. See the matrix.

Repository map

Where things live.

main.pyEntry point; argparse CLI and PyQt6 launch.
core/Backend contract, registry, backends, inference manager and support services.
ui/PyQt6 studio panels, waveform widget, GPU monitor and styles.
utils/NVML GPU monitoring helpers.
scripts/Weight setup plus the deterministic site generator.
training_workspace/F5-TTS dataset preparation and training launcher.
site/ + docs/Site source and generated GitHub Pages output.
tests/Model-free pytest coverage for core behaviour and the site build.