# Cost, Privacy and On-Device

Course: [Multimodal AI](https://www.devtutorials.ai/learn/multimodal-ai) · Section: Listening, Speaking and Generating
Source: https://www.devtutorials.ai/learn/multimodal-ai/listening-and-generating/cost-privacy-on-device

> Keep personal data on the device: run OCR and speech locally, send text not photos, redact text, blur faces and plates, keep data only as long as needed, and delete it on request.

## What This Lesson Is About

**Personal data** (also called PII, personally identifiable information) = anything that can identify a person: a card number, an email address, a phone number, a home address.

In this lesson, you will decide what may leave the customer's phone, and what each choice costs.

Asha sends a kettle claim: a receipt photo and a 12-second voice note. The receipt shows her card number. In the voice note, she reads out her phone number. The first version of the app sends the photo and the audio to three cloud services.

Press **Play**, or use **Next** to go one step at a time.

- **Frame 1:** what the claim contains, with the personal data marked.
- **Frame 2:** every upload, and the personal data inside each one.

**Simple lesson:** every upload is a copy of the customer's data on someone else's computer.

### A Real-World Example

Think about posting a document to your bank.

- You cross out your full card number before you photocopy the letter.
- You do not send your passport when they only asked for your address.
- You read the letter at home; you do not hand it to a stranger to read it to you.

A private pipeline does the same:

- **Crossing out the card number** = redaction.
- **Sending only what was asked** = send text, not the photo.
- **Reading at home** = run OCR and speech to text on the device.

**Simple lesson:** read raw media on the device, and send only clean text.

## What You Will Learn

By the end of this lesson, you will be able to:

- list everything that leaves the device
- move the steps that see raw photos and audio onto the device
- redact personal data before upload
- compare the cost and time of cloud and device steps
- check that a device can run the models

## Move Steps onto the Device

Step through all four frames.

- **Everything in the cloud:** 23 pieces of personal data leave the device across 6 claims.
- **OCR on the device:** the receipt photo no longer goes to cloud OCR.
- **Speech on the device:** the audio stays too.
- **Send text, not the photo:** only the text goes to the LLM, plus the two damage photos. Some personal data is still in them.

**You cannot redact a photo or audio with text rules.** If the receipt photo goes to the cloud, the card number goes with it. That is why the step that sees raw media must run on the device, before anything else.

**Simple lesson:** the step that sees the raw media is the step that must stay local.

## Redact Before You Send

**Redaction** = replacing personal data with a tag, like `[CARD]` or `[PHONE]`, before the text leaves the device.

Step through both frames.

- **Frame 1:** the text before and after redaction.
- **Frame 2:** with every setting on, nothing personal is uploaded.

| Data | Pattern idea | Tag |
|---|---|---|
| Card number | 13 to 16 digits, with spaces or dashes | `[CARD]` |
| Email | something@something.something | `[EMAIL]` |
| UK mobile | 07 or +44 7, then 9 digits | `[PHONE]` |
| Street address | a number, a name, then Street, Road or Lane | `[ADDRESS]` |

**Patterns miss things.** A card number read out as words, or an address with no street type, can slip past a regular expression. Test your rules on real examples, and use an on-device model for names and addresses in production.

## Cost and Time

Step through both frames.

- **Frame 1:** one claim, cloud against device.
- **Frame 2:** every claim, device-first.

| Choice | Cost | Time |
|---|---|---|
| Cloud OCR, speech and photo to the LLM | about 1.8¢ per claim | about 4.0–5.5 s |
| OCR and speech on the device, text to the LLM | about 0.35¢ per claim | about 3.1–5.2 s |

Claims with a damage photo cost more and take longer either way: that photo must be judged by a cloud vision model.

On-device OCR is slower than cloud OCR (1.4 s against 0.5 s). But not sending the photo saves more time than that, so the whole claim is a little faster. On-device steps are free per use; the customer's phone does the work. Open the **Settings** tab to see which models your device can run, and whether it has WebGPU.

## Photos You Must Send: Blur First

Some photos cannot stay on the device. A photo of the soaked parcel must go to a cloud vision model, because the on-device model cannot judge damage. But Sam's doorbell photo also shows the courier's face and the van's number plate.

**Blur them on the device first.** A small face and plate detector finds them; the app blurs those boxes; then the photo goes out. The damage is still visible. The people are not.

## Keep Less, Delete Everywhere

Privacy does not end at upload.

- **Retention:** keep claims only as long as you need them (30 days in the lab), then delete them.
- **Deletion on request:** when a customer asks, delete their data everywhere: the claim, the files, the transcripts, and both search indexes (Lesson 12).

**Easy way to remember:** read locally, redact locally, send words.

Click the button and look at the **Pipeline** tab.

- **The uploads list:** every file or text that leaves the device.
- **Red:** an upload that carries personal data.

### Lab Exercise: No Personal Data Leaves the Device

Your task: change the **Ingest**, **Perceive**, **Structure** and **Use** settings, then press **Check**.

Click the button and open the **Pipeline** tab.

- **OCR and speech:** on the device or in the cloud.
- **Send the photo:** on or off.
- **Redact and blur:** card, email, phone and address; faces and number plates.
- **Keep and delete:** how many days, and deletion on request.
- **To pass:** 0 pieces of personal data leave the device, under 0.5¢ per claim, kept at most 30 days, and deleted everywhere on request.

## Build It in TypeScript

```ts
const PATTERNS: [RegExp, string][] = [
  [/\b(?:\d[ -]?){12,15}\d\b/g, "[CARD]"],                                   // 13 to 16 digits
  [/[\w.+-]+@[\w-]+\.[\w.]+/g, "[EMAIL]"],
  [/(?:\+44\s?|\b0)7\d{3}\s?\d{6}\b/g, "[PHONE]"],                         // UK mobiles
  [/\b\d{1,4} [A-Z][a-z]+ (?:Street|Road|Lane|Avenue|Close)\b/g, "[ADDRESS]"],
];

export function redact(text: string): string {
  return PATTERNS.reduce((t, [re, tag]) => t.replace(re, tag), text);
}
```

Click the button and open the **Code** tab.

- **The starter:** returns the text unchanged.
- **Run on the media bank:** your function runs on all 6 claims. Totals must stay in.

## TL;DR

1. **Personal data** = anything that can identify a person.
2. Every **upload** is a copy on someone else's computer.
3. Run **OCR and speech on the device**; photos and audio cannot be redacted with text rules.
4. **Send text, not the photo.**
5. **Redact** card numbers, emails, phones and addresses; **blur** faces and plates in photos you must send.
6. Keep data **only as long as needed**, and **delete it everywhere** on request.
7. Device-first is **cheaper**: each local step is slower, but sending less makes up for it.

## Common mistakes

| Mistake | Wrong idea | Correct idea | What goes wrong |
|---|---|---|---|
| Redacting only the text | "The transcript is clean." | Keep the photo and audio local too. | The card number goes out in the image. |
| Sending the photo "just in case" | "More context is better." | Send text unless the image is needed. | More cost and more leaks. |
| Over-redacting | "Remove all numbers." | Remove personal data only. | The total is gone too. |
| Trusting one regex | "The pattern covers it." | Test on real examples. | "+44 7700 900456" slips through. |
| Ignoring the device | "Every phone can run it." | Check memory and WebGPU in Settings. | The app freezes on older phones. |

## Check Your Understanding

## Exercises

## What to Remember

- Every upload is a copy.
- Read raw media on the device.
- Send text, not photos.
- Redact before you send.
- Keep the values the app needs.
- Blur faces and plates.
- Keep less; delete everywhere.
- Check what the device can run.

## Further Reading

- [ICO guide to data protection, by the UK Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/): what counts as personal data, and data minimisation.
- [WebGPU API, by MDN](https://developer.mozilla.org/en-US/docs/Web/API/WebGPU_API): running models on the device's graphics chip.

Next: **Capstone: Ship the Claims Pipeline**, where every lesson's settings run together on items you have never seen.