Voice Legacy is a web app — also wrappable as iOS and Android via Capacitor — for people who have been told they will lose their voice, and for the families around them. It is, deliberately, one straight-line idea:

Record your voice while you still have it. From then on, type — or tap a saved phrase — and hear it played back in your own voice.

The voice clone is built by ElevenLabs. The app is the considered wrapper around that capability: a recording flow that keeps quality high, a typing surface that respects motor and cognitive limits, a dashboard that gives you control over what you've banked, and an architecture that keeps your audio out of any database under our control.

The name is meant literally. The thing you leave for the people who knew your voice is, in part, your voice.

The product is sharpest for progressive voice loss.

ALS / MND

The canonical case. Bulbar onset can take a voice in months; ALS forums recommend voice banking as one of the first things to do at diagnosis.

Throat / oesophageal cancer

Laryngectomy patients can plan ahead and bank ahead of surgery.

Primary Progressive Aphasia (PPA)

Language fades but cognition remains. Typing surfaces work; conversational AAC apps don't.

Parkinson's

Speech volume and clarity decline; banking gives later-stage prosthesis.

It is less sharp for stroke aphasia (language production is impaired, so typing-as-a-bridge doesn't work) or congenital speech-language impairments (the user never had the voice we're trying to preserve). That distinction matters: the name is misleadingly broad, and the landing copy makes the progressive-loss framing explicit for that reason.

The product has exactly two screens that matter, and they map to two phases of the user's life.

A handful of choices were made on purpose, and they're worth enumerating because they shaped the codebase more than any framework did.

Four tables, every one RLS-enforced. Worth showing because the shape is the product: voices are owned, phrases are scoped, utterances are logged, prefs travel with the user.

What's actively defended. Plus an honest list of what's deferred — because a build journal that lists only successes isn't a build journal.

Actively defended

• Server-only secrets — ElevenLabs API key and Supabase service role never imported into client code
• RLS on every table — the database refuses any row that doesn't match auth.uid()
• Auth on every API route — /api/clone and /api/tts both require a session
• Voice ownership check on every TTS call — you can only speak in voices you own (or premade ones)
• Input validation: text length, file size, file count, MIME types
• HTTPS-only, HttpOnly cookies, SameSite=Lax, Origin check on sign-out
• Strict security headers: HSTS preload, X-Content-Type-Options, X-Frame-Options DENY, Permissions-Policy restricting mic/camera/geolocation
• PKCE magic links — bound to the device that requested them
• No raw audio at rest, anywhere
• Consent gate before any voice clone is created
• No XSS surface — React escapes by default, no dangerouslySetInnerHTML

Known gaps

• No per-user rate limit yet — mitigated by auth gates and upstream cost visibility
• No strict Content-Security-Policy — needs nonce-aware middleware; deferred
• No MFA UI — Supabase supports TOTP/WebAuthn; not exposed yet
• Service-role key reserved for future webhook handlers; unused today

Voice cloning is a dual-use technology. The same model that lets a dying parent leave a message for their child also enables phone-fraud impersonation at scale. The product takes that seriously, and not by accident.

• Consent gate. The user must affirm ownership or consent before any audio leaves the device.
• Identity binding. Voices are owned by accounts; RLS prevents any user from speaking in another user's voice.
• No audio retention. The raw recordings are never persisted on our side — only the resulting ElevenLabs voice_id.
• Two-sided deletion. Removing a voice in the dashboard also deletes the model upstream on ElevenLabs — the artifact, not just the link.

What we don't yet do, and what's on the table if the product moves out of private beta: identity verification (passport / government ID), liveness checks during recording, watermarking on generated audio. Those become essential at scale.

What's shipped. What's coming, in rough priority order. No date pressure — this is the product in private beta, not a public launch.