How VocaBoba is built

Last updated: 26 September 2026

VocaBoba is a small, independent project. Here's what it runs on, and why.

Where it runs

• On my own computer at home: a Mac Studio (Apple M4 Max). No cloud hosting, which keeps it free to run.
• Cloudflare delivers the website securely and handles email sign-in with a one-time code (Cloudflare Access). You can also sign in with Google. Either way, the app then keeps you signed in with its own session. The connection from Cloudflare to the Mac is an encrypted tunnel, so the Mac isn't exposed to the internet directly.
• The app runs in containers (OrbStack), each with a strict limit on memory and processor use, so it can't slow down anything else on the machine.

The app

• Website and app: React and TypeScript, built with Vite and served by nginx. It can be installed on your home screen (a progressive web app).
• Server: Python (FastAPI).
• Database: PostgreSQL 17, with row-level security, so each account can only ever read its own rows, even if the app made a mistake.
• Live pitch while you record is worked out in your browser, on your own device.

Voice analysis

• Praat (through Parselmouth), the standard tool in speech science, measures pitch, resonance (formants) and the vocal-weight hints on the server after each recording.
• NumPy and ffmpeg handle the audio processing, and the clips you share. WORLD makes the target-voice previews.
• All of this, and the AI below, runs in Foreman, a separate program on our Mac that takes the heavy work one piece at a time and only while the computer has room, so it never slows the website down. The app reaches it through our own AI gateway (another of our computers) over Cloudflare, so the website itself could later move to a cloud server without moving the processing.
• Everything is compared with your own starting recording, never with other people or a "target voice".

AI (optional, off by default)

All AI runs on our own computers. Nothing is sent to an outside AI service, and your recordings are never used to train anything.

• Transcription: OpenAI's Whisper large-v3 turbo model, run with WhisperKit on the Mac's Neural Engine. MLX Whisper is the fallback.
• Coaching notes: Qwen3.5 9B (a small open model from Alibaba's Qwen team), run with Apple's MLX in Foreman, and reached through our own AI gateway (another of our computers) over Cloudflare, so the app can later move to a cloud server. It only gets facts from your own measurements. Its notes are checked before you see them: made-up numbers, anything like a diagnosis, and any "how feminine/masculine" judgement are thrown away.
• Resource limits: one AI model at a time, and only while the computer has memory to spare.

Your data

• Encryption: your recordings, transcripts and notes are encrypted with a key that belongs to your account alone (AES-256-GCM). Deleting your account deletes the key.
• Storage: recordings live on a dedicated drive in the Mac.
• Backups: every night to a second, separate drive, encrypted, kept for up to 8 weeks, and regularly tested by restoring them.

More about what's collected and who can see what is in the privacy policy.

What it doesn't use

• No ads, no analytics or tracking scripts, and no third-party cookies. The only cookies are for signing in: the app's own session, and Cloudflare's if you sign in with email.
• YouTube videos in the coaches' library use YouTube's privacy-enhanced mode, and load only when you press play.

Thanks

VocaBoba is built on open-source work, including Praat, Parselmouth, WORLD, Whisper, WhisperKit, MLX, Qwen, PostgreSQL, FastAPI, React and nginx. Thank you to everyone who builds and maintains them.