Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/voxlen/pull/46

Full product audit + overhaul

Why the Windows app "downloads but doesn't work" — root causes fixed

1. The Rust backend did not compile (is_disconnected() doesn't exist on crossbeam Sender), so CI could not produce a new build at all. Fixed with proper session-liveness tracking.
2. The "account key" was a Google OAuth access token that expires after ~1 hour. Users connected the app and it silently died an hour later. The dashboard now mints a stateless, signed 180-day desktop token (VOXLEN_TOKEN_SECRET env on Vercel — set this before launch); every API endpoint accepts both token types and falls back gracefully.
3. Onboarding never got users a key: the Connect step linked to voxlen.ai/#download (the downloads section) instead of the dashboard, and silently accepted invalid keys when the API was unreachable. Now: step-by-step instructions, link to voxlen.ai/dashboard, and an honest "unverified" state instead of fake validation.
4. The batch STT proxy was broken end-to-end: the desktop sent multipart form fields the server never read, while Deepgram received raw multipart bytes labelled as WAV. Now a raw-body + header contract, with custom vocabulary included.
5. Stale error messages told users to add Deepgram/Anthropic keys — a path that no longer exists. All errors now point to Settings → Account.

Dictation accuracy ("absolutely perfect listening")

• Custom vocabulary was silently ignored: Nova-3 requires keyterm prompting; the legacy keywords param does nothing on Nova-3. Fixed on streaming, batch, and proxy paths.
• High-pass filter coefficients were computed for 16 kHz but ran at the device rate — at 48 kHz that turns an 80 Hz rumble filter into ~240 Hz, cutting male voice fundamentals. Now computed per-device-rate (RBJ biquad).
• Filter state reset every audio callback, injecting a click into the audio many times per second. State now persists across callbacks.
• The noise gate hard-muted quiet frames, chopping soft onsets and trailing consonants. Now −46 dBFS threshold, soft knee, 400 ms hangover, attenuation instead of muting.
• URL-encoding of vocabulary mangled non-ASCII names (e.g. "Müller"); now UTF-8-byte-correct.
• Privacy: mip_opt_out=true on every Deepgram request — customer audio is never used for provider model training.

Dictation screen polish

• The screen showed nothing during the first utterance (interim transcript only rendered after the first finalized segment). Now live text appears from the first word.
• start_dictation failures were swallowed and the UI pretended to be "Listening". Now the real error shows inline with a retry path, and the mic button recovers from the error state.
• Flywheel time-entry deletions now persist across restarts.

Branding & trust

• Purged all "Marco Reid" branding: site footer copyright, support email, privacy text, the entire legal pack (Terms, EULA, DPA, Sub-processors, etc.), developer docs, and the CI release workflow (releases were titled "Marco Reid Voice v…").
• De-cyberpunked the landing page: glow orbs and floating animations removed, animated gradient headline made static, neon card rings replaced with hairline borders, prefers-reduced-motion respected, leftover marcoreid Tailwind token renamed.

Every claim on the site is now true

A systematic pass over all 20 pages (home + 18 SEO pages + dashboard):

• Privileged Mode / offline dictation presented as coming soon everywhere (it is not implemented) — prose, FAQs, JSON-LD, comparison tables
• BYOK setup instructions replaced with subscription-included wording
• "Never touches Voxlen servers" corrected to zero-retention transit wording (the account proxy does transit requests); legal pack and sub-processor list updated to match (Deepgram/Anthropic/OpenAI/Vercel now correctly listed)
• Accuracy claims unified at a defensible 95%+

SEO & conversion

• Footer now links all 18 SEO pages in a four-column directory (crawl paths + internal linking)
• Waitlist forms POST to a new /api/waitlist endpoint (Vercel KV and/or Resend when configured; always logged) instead of localStorage-only
• All 18 SEO pages verified present in sitemap.xml with valid JSON-LD

⚠️ Before launch (decisions needed)

1. Set VOXLEN_TOKEN_SECRET on Vercel (any long random string) so 180-day desktop keys work.
2. Verify voxlen.ai/api/ is deployed* — the desktop app depends on it entirely now.
3. Testimonials appear fabricated (named lawyers/accountants who may not exist). For a legal-audience product this is a serious FTC/credibility risk — recommend replacing with real beta-user quotes or removing.
4. Stripe placeholders intentionally left as-is per instructions (no live payment code until everything is verified).
5. Builds are unsigned — Windows SmartScreen warns on install. Code-signing cert recommended before paid launch.
6. Cut a new release (v1.0.10) once merged — v1.0.9 predates all of these fixes and is still titled "Marco Reid Voice".

Verification: cargo check clean, tsc --noEmit clean (app + landing), 114/114 tests passing, landing production build passing.

https://claude.ai/code/session_01JtiMGLaMnEEAZNxpH3HgVd

Generated by Claude Code