Web Teleprompter — Self-Hosted PWA with Browser-Only Speech Sync

The user need was concrete: prepare a script on a laptop, send it to a phone or tablet, and present from that device in fullscreen — without installing an app, creating an account, or trusting a SaaS with the script.

Three constraints made the existing market useless. (1) Cloud tools stop working offline. (2) Multi-device tools require a shared backend, which means an account, which means the script lives on someone's server. (3) Voice-following teleprompters relied on cloud speech-to-text, which streams your audio to a vendor — a non-starter for anyone presenting confidential or embargoed material.

A Vite + React 19 PWA for the editor and player, a tiny FastAPI service for the optional relay, Redis for the relay store (5-minute TTL, delete-on-read), and Caddy as the reverse proxy with full security headers. No database, by design.

The recommended day-to-day flow is intentionally simple:
1. Open the app on a computer — the public instance or your own deploy.
2. Load the script by uploading a file or pasting text; it is kept in the browser's local storage, not as a permanent server file.
3. Hand off to the phone: open Handoff, generate the QR code(s), and scan them with the mobile device. For typical scripts this uses single QR or multi-QR, so the script is encoded in the URL fragment and never stored on the server.
4. Read on the phone: the player opens, and you tune speed, font size, theme, and mirror to the room.
5. Optional speech sync: tap the language control (ES / EN) and Chrome's built-in Speech Recognition scrolls the text as you speak. No streaming ASR service is required or bundled.

Four handoff modes with automatic fallback cover edge cases:
- Single QR — payload embedded in a URL fragment, never sent to the server. The usual case for small scripts.
- Multi-QR — scan codes in any order for scripts past the single-QR limit.
- LAN link — same Wi-Fi, no server hop at all.
- Relay + OTP — for very large scripts, the server holds the payload briefly with a one-time password.

For public hosts, server-assisted modes can be disabled entirely (DISABLE_SERVER_HANDOFF=true), leaving only QR-based handoffs and guaranteeing that no user script touches the server.

Markdown is rendered through markdown-it + DOMPurify with raw HTML stripped at input. A full GitHub Actions CI gate runs lint, typecheck, unit, and Compose validation on every push.

Shipped as v0.5.0 and live at teleprompt.aiepic.app. The app is free, public, and MIT-licensed; anyone can self-host it in one 'docker compose up'. The player precaches via service worker so it works offline after the first load, and two e2e handoff scripts ('bin/e2e-handoff.sh', 'bin/e2e-offline.sh') gate every release.

The privacy posture is still the feature people cite first: no account, no database, and the usual QR path means your script never leaves the browser encoding. Speech sync reinforces the same guarantee — it runs through the browser's own recognition engine, not a cloud API — so "my mic never leaves the device" is not a marketing line, it is the architecture.