diff --git a/README.md b/README.md
index 5c691e030..1eefa2c27 100644
--- a/README.md
+++ b/README.md
@@ -629,6 +629,18 @@ text to an agent. Nothing leaves the computer.
 
 ![Rudder, the offline voice-to-text desktop app, running](documentation/readme-images/deploy5-desktop-rudder.png)
 
+**Rudder's goal, from the start: private voice-to-text that you own.**
+
+- **Offline, with no telemetry and no cloud.** Your own code and your own self-hosted speech model
+  (NVIDIA's open NeMo-Speech.cpp runtime and a small speech model, about 742 MB) run on a modest amount
+  of your computer's CPU. After a one-time download of the runtime and the model, nothing needs the
+  network; a trace of the speech runtime showed zero sockets and zero DNS lookups. The aim is that it
+  works out of the box: today the first-run download is still a manual step.
+- **Be careful who commits to Rudder.** A voice-to-text tool hears everything said near it, so one
+  bad change could turn it into spyware. Take changes to `plugin-designs/rudder-voice/` and
+  `backend/rudder-engine/` only from people you trust, and have a second person read every one.
+- **Planned: an egress monitor** that shows you, as it runs, that Rudder sends no data out to anyone.
+
 **The map app runs as a desktop app the same way.**
 
 ![Desktop app (Tauri), working](documentation/readme-images/deploy5-desktop.png)