Privacy

This page describes what txscribe actually does with your data. It is written to be accurate rather than comprehensive, and it is not a substitute for legal advice.

What we store

The files you upload, the transcripts produced from them, and any summaries, translations or corrections you generate, and any marks and notes you add while recording, and a record of how many minutes you have used and, for a transcript bought without an account, how many times an anonymising list has been requested for it. When you ask questions about a recording, we keep the questions, the answers and any thumbs up or down you give an answer with that transcript, until you start a new chat or delete it; and we keep any summary templates you write until you delete them. If you make study materials from a recording (notes, flashcards and a quiz), we keep them with that transcript until you delete it or make them again; making them again replaces the old ones. If you mark moments in a recording, while recording it or while listening to it, we keep the marks and any note you write on one with that transcript until you delete them or it. They are never shown on a public link. If you add images to a recording while you make it, in the app or on the website, we keep them with that transcript until you delete them or it; we remove their location and other camera details before storing them, and they are never shown on a public link.

When you delete your account, we keep a record of its free allowance: the free minutes or free lectures it was given and the minutes and lectures it had used, up to what it was given; how many times it had made study materials for free; whether it had started a free week; and when it was deleted. We keep it under one-way fingerprints of the account’s sign-in ID and email address, and of those of any deleted account it started from, each made with a secret key only we hold — never the IDs or addresses themselves — so that signing up again with any of them does not give the free allowance again.

If you report a summary, a translation or a chat answer in the phone app, we keep the report (what it is about, the reason you picked, the text you reported and when you sent it) with that transcript until the transcript is deleted, so that we can look into it.

When your phone makes the transcript itself, we store the text it sends us in the same way as a transcript we make, together with a note of which engine made it.

When you sign in, we store what your sign-in provider gives us:

• Google (on the website, in the desktop app and in the phone apps) — your email address, your name, and the address of your Google profile picture.
• Sign in with Apple (in the iPhone app, and on the website and in the desktop app) — your email address and your name. Apple lets you hide your email address; if you do, what we receive and store is a relay address Apple creates, which forwards to you, and we never see your real address. Apple gives your name only the first time you sign in, and only if you choose to share it; if you don’t, we store no name.
• Microsoft (on the website and in the desktop app), with a personal Microsoft account or a work or school one — your email address and your name. For a work or school account, these are the ones your organisation has set for you.
• A sign-in link by email (on the website) — your email address, and nothing else. Firebase Authentication makes a one-time link that signs you in, and it is emailed to you either by Google’s Firebase or through Resend, our email provider. When we send a link ourselves, or try to, we keep a keyed fingerprint of the address and of the network the request came from — a one-way hash, not the address itself — to limit how many links we send to one address and for one network, and we delete it within a day of the last link. While you wait for the link, the address is kept in your own browser’s storage, so that opening the link there can finish without asking again; it is removed once you have signed in, and not used after a day. It is never put in the link itself.

We also keep the account identifier the sign-in service assigns you, which is how your recordings are tied to your account. Each time you sign in we update your email address, name and picture if your provider reports a change.

If you buy Pro before you have an account — from the trial or the pricing page, on Stripe’s page — we make your account when Stripe’s checkout goes through, from the email address you gave Stripe. That address becomes your account’s email address and the way you sign in: we give it to Firebase Authentication, so that a sign-in link emailed to that address opens your account on any device. We send it what we send any account’s address — the notice before a charge (for a free week, as soon as it starts: the day it ends and what will be charged then), the transcript emails you have not turned off, and the sign-in links you ask for — and Stripe may send its receipts there. With the checkout, Stripe receives the id of the account it is for and the random identifier our analytics gave your browser, so that we can tell which visit led to the purchase.

If the address you gave Stripe already belongs to another txscribe account, or cannot be made your sign-in when you pay, it does not become your account’s: we keep it with the account only to show it back to you and to offer it for signing in, and we send nothing to it ourselves unless you ask us to email a sign-in link there. Until you add Google or an emailed link on the page you return to after paying, only the browser you paid in can open that account, and its subscription does not renew — Pro ends when the first week or month you paid for ends, and nothing more is charged. If you add one too late for the notice before a charge to go out in time, Pro still ends then, and you can renew it under Plan and billing. If Pro starts with a free week, nothing is charged at checkout: without a sign-in the week ends with nothing charged, and once you add one, the week runs at least seven days from then. Once you add a sign-in, that account’s email address is that sign-in’s.

When you buy before you have an account, the browser you pay in keeps a cookie for a day holding a random value: it is what lets that browser open the account it paid for. The checkout at Stripe carries a one-way hash of that value — never the value itself — so that the page you come back to can tell it is the browser that paid. We also keep that hash with the account, and with any account you move the purchase into, for one thing: when months of Pro paid at once and a Pro subscription, or two lots of months, are bought from that browser on two accounts, before its cookie runs out and while the first still runs, we stop the second and refund it in full. Our copy is deleted with your account, and your data export includes it.

If you open the invite section of your account page, we give your account a short code, which is the end of your invite link, and count how many people signed up through it and how many of them earned you minutes. Someone who follows the link gets a cookie, tx_ref, holding that code and nothing else, for up to 30 days; it cannot be read by scripts on the page. When they sign in, or come back to this website after buying Pro without signing in, the cookie is cleared, and if the link counts (see the terms) we record on their account whose link it was — that account’s internal identifier and code — and when. To decide whether it counts we compare the two accounts’ email addresses and the random identifier our analytics gives a browser, and, when their payment that counts goes through, we ask Stripe whether the card it was made with is one the inviting account has paid with or saved there, to stop people inviting themselves; nothing new is collected or kept for it, and IP addresses are not used. If Stripe shows the same card, we note on their account that the link was refused. When a payment of theirs that counts goes through, we add the extra minutes to their account, and to yours unless you have reached the month’s limit, each with a note of why. We keep a record of that reward — the two accounts’ internal identifiers, the code, the identifier of that payment and the minutes given — apart from both accounts, so that if the payment is refunded or disputed the reward can be taken back even after one of them is deleted; deleting an account takes its identifier off that record. If a payment is refunded or disputed before any reward for it, we note that payment’s identifier, so that none is given. Deleting your account deletes your code and counts; an account you invited keeps your account’s internal identifier and code in its record of the link, and an account you make later is neither rewarded for it nor has minutes taken back for it.

Everyone who handles your data

This is the whole list of the companies we use, not just the ones that touch recordings. Each gets only what the job needs. A service you connect yourself is not on it; what it receives is described under What we do not do.

• Firebase Authentication (Google) — checks your sign-in with Google, Apple or Microsoft, and makes the one-time link when you sign in by email, which is emailed either by Firebase itself or through Resend. It holds what your provider gives us, including your email address, name and account identifier — and, for an account made by buying Pro before you had one, the email address you gave Stripe when it becomes that account’s sign-in, which we give it so that a sign-in link to that address opens the account.
• Google Cloud Firestore — our database: your account, including your email address, name, plan and minutes used, and the details of each transcript, such as its title and language.
• Google Cloud Storage — stores the files you upload and the transcripts made from them. When you make a visual summary of a video, it also keeps still frames taken from that video; they are deleted with the recording.
• Google Cloud Speech-to-Text — does the transcribing, except where your phone has already done it (see below). Your recording is sent to it. While you record with live captions on, the audio is sent to Google Speech-to-Text as you speak, through our own caption service, which keeps neither the audio nor the captions.
• Transcribing on your iPhone — on iPhones that support it (iOS 26 or later, on compatible devices and languages), Notaula makes the transcript on your phone using Apple’s built-in speech recognition. Apple states that this feature does not send your voice audio to Apple’s servers. The first time you use a language, your phone may download Apple’s speech model for it; the model comes to your phone, and your recording does not go to Apple. The recording is still uploaded to us, as with any recording, so you can play it back, and the transcript is sent to us with it. When the phone can’t transcribe it, Google Cloud Speech-to-Text does, as described above. When the student app transcribes a lecture on your iPhone, it also keeps a record of how loud the recording was, moment by moment (not the sound itself), to tell you if parts were hard to hear. It stays on your phone, is never sent to us, and is deleted when the transcription is done or the recording is deleted.
• Google Gemini on Vertex AI — produces summaries, translations, answers and study materials (notes, flashcards and quizzes), and, when you anonymise a transcript, a list of names and other details you can choose to replace. The transcript is sent to it. Some recordings are sent to it as well, to be transcribed in place of Google Cloud Speech-to-Text. We use its transcript only when the recording is in Portuguese or Spanish; otherwise, or if it can’t transcribe one, Speech-to-Text does. When you anonymise a transcript, its title is sent as well, and when you ask questions across your recordings, their titles are. While you record with live captions, if you ask about the recording or update its outline, the captions so far are sent to it too; we don’t keep the questions, the answers or the outline. When you paste an agenda, a syllabus or another document into your vocabulary and ask for the terms in it, the document’s text is sent to it to pick out the names and terms, which you choose whether to add; we don’t keep the text.
• Telling speakers apart — when you ask for speaker labels in a language Google Cloud Speech-to-Text can’t label, our own server does it. It measures the voices in that one recording to work out who spoke when, and uses that only to label its transcript. The measurements are not kept, the record of who spoke when is deleted once the transcript is made, and nothing is compared with your other recordings or anyone else’s. No other company receives your recording for it.
• Stripe — takes payments. It receives your card details and we never do. When a free week starts, we keep the fingerprint Stripe gives the card — an identifier Stripe derives from the card number, not the number — and the id of that week’s subscription, so that each card has one free week. We keep both after an account is deleted, for that reason only. When a paid first week starts, we ask Stripe whether that card’s fingerprint has paid an introductory price before; we keep nothing from the answer, and use it only to give each card one first week.
• hCaptcha — only where Pro can be paid for inside the trial’s pages: once you press to pay there, Stripe’s script may load it, to tell people from bots. What that script does is under Payments, below.
• Apple — takes payments for subscriptions bought in our iPhone apps and in our Mac app. It receives your payment details and we never do. Apple sends us signed records of the subscription, including its price, country and dates; we keep its identifiers, dates, whether it renews and any refund, and which of our accounts it belongs to. When you delete your account we remove which account it belonged to but keep the identifiers, dates and refunds, so a refunded purchase can’t be used again, and so a subscription Apple is still billing can be restored into a new account from the Apple ID that pays for it. Deleting your account does not cancel an Apple subscription; cancel it in your Apple ID settings.
• Google Ads — only if you arrived from one of our ads and agreed: the ad’s click identifier, and whether it led to a sign-up, a subscription (and its first full-price payment) or — if the question you answered named it — the start of a free week or the purchase of a single transcript, when, and a subscription’s or a purchase’s price.
• OpenAI — only if you arrived from one of our ads in ChatGPT and agreed: the ad’s click identifier, and whether it led to a sign-up, a subscription or — if the question you answered named it — the start of a free week or the purchase of a single transcript, when, and a subscription’s or a purchase’s price.
• Resend — delivers the email we send, listed under Email below. It receives each recipient’s address and the text of that message, which for a transcript-ready notice includes the transcript’s title and a short preview of it. It never receives your recordings. The preview is the summary’s overview cut to 400 characters, or else the transcript’s first 200 characters, so a transcript shorter than that reaches it whole.
• Webshare — a proxy service. When we fetch something for you from a video site — a video’s details, audio or captions, or the list of videos on a playlist or channel — our server’s requests may go out through Webshare: usually for YouTube, and for another site only after that site has blocked a direct request. Webshare can see which sites our server contacts, when, and how much data passes; it cannot read what is inside an encrypted (https) connection, but could read an unencrypted one in full. Our server does not add your account, name, email address or IP address to these requests.
• YouTube, Vimeo, Facebook, Instagram, TikTok and Loom — only on the page of a transcript made from one of their videos: that site’s own player loads there, from that site, so your browser connects to it. We send them nothing about you.

What we do not do

We do not use your recordings or transcripts to train models, we do not sell them, and we do not share them with anyone other than the processors above and the services you connect yourself. Nobody at txscribe reads your transcripts as a matter of course.

If you connect txscribe to another service — with an API key, a webhook, our Zapier integration, or an AI assistant you connect (such as Claude or ChatGPT) — we send that service what you set it up to receive, such as a transcript’s details and text when it finishes, to the address you gave. That service then handles it under its own terms. You can remove a key or a webhook under Plan and billing at any time.

If you connect Zoom, we receive from Zoom the cloud recordings of the meetings you host, each meeting’s topic, and the name and email address of the participants Zoom gives an address for (up to 200 for each recording), and we keep them with the transcript as we keep a recording you upload. If you connect Slack, we post to the one channel you choose a summary of, or a link to, each finished recording (or only each finished meeting, if you set it so); we cannot read anything in your Slack workspace. Disconnecting either one under Integrations stops it and deletes the access tokens we were given.

Sharing

A transcript is private until you add it to a team workspace or create a share link for it. Everyone in a workspace can open the transcripts added to it; what else they can do depends on the role the workspace gives them, and taking a transcript out of the workspace, or a person off it, ends their access on their next request. A share link is an unguessable URL that anyone holding it (and its password, if you set one) can open without signing in — treat it as public. You choose whether the recording itself and the summary travel with the link, or only the transcript. A visual summary’s still frames travel with a link only when you also share the recording.

When you create a link you can choose when it expires — after 1, 7 or 30 days, or never — and you can put a password in front of it, so that holding the URL is not enough on its own. A link stays open until it expires, you turn sharing off or you delete the transcript, and any of those stops it working — including for people who already have the URL. We do not list share links anywhere or allow search engines to index them, but a link that has been forwarded cannot be un-forwarded, so the only reliable way to close one is to revoke it or let it expire.

While you record with live captions you can also make a live link: anyone who has the link can read the captions as they appear, without the audio, without signing in and without a password. For that we keep the captions with the link, and, to count viewers, a random code each viewer’s browser makes. The link stops showing them 30 minutes after the recording ends, or 30 minutes after the recording’s page stops sending (for example, when its tab is closed), and at the latest 9 hours after it was made; our hourly clean-up then deletes them. Turning the link off, discarding the recording or deleting the transcript (moving it to Trash included) deletes them at once. A live link never shows the transcript made after you stop; sharing that is the share link above.

Dubbing

To dub a recording, its transcript is translated by Google Gemini on Vertex AI and read aloud by a voice model that we run in our own Google Cloud project. The text is sent to that model only to be spoken. It is not written to its logs, which record only lengths, timings and a short one-way fingerprint of the text.

We store a dub’s audio (MP3), its script, its timing and the clips of any lines you had said again: about 4 to 5 MB per minute of dub. They are kept with the transcript, deleted when you delete the transcript or your account, and not included in an account export.

For a free account’s one dub preview, we keep the time of the preview and a one-way fingerprint of the account’s email address (or, for an account without one, of its sign-in ID), made with a secret key only we hold. We keep these after the account is deleted, so that signing up again with the same address does not give a second free preview. The address itself is not stored with them.

Before your first dub we ask you to confirm the sentence below, and we keep it with the time you confirmed. It is included in your account export.

I have the right to translate and re-voice the recordings I dub, including the voices and words of other people in them, and I will say a dub is AI-generated when I publish it.

Each dub carries AI-generated metadata and an inaudible watermark when we deliver it. Both can be removed by editing the file.

Voice recognition (off unless you turn it on)

People recognition is off until you turn it on in your account, under People, where you are asked to agree first; we record when you did. While it is on, we measure the voices in your transcripts that have speaker labels — from recordings you uploaded or made, never from videos imported from sites such as YouTube — and in any voice samples you upload, and keep a voiceprint for each: a list of numbers describing a voice. Voiceprints are biometric data.

They are used for one thing: suggesting who is speaking in your own transcripts, by comparing voices with the people you have named. They are never shared, sold or used to train models, and never compared with anyone else’s. The measuring is done by our own service on Google Cloud; no other company receives your audio for it. It uses the WeSpeaker ResNet34-LM model, published under the Creative Commons Attribution 4.0 licence.

Deleting a person deletes their voiceprints and samples; deleting a transcript deletes the voiceprints measured from it; “Delete all voice data” deletes everything and turns recognition off; deleting your account deletes everything. Uploaded samples leave storage on the same seven-day delay as your other files.

How long we keep your recordings

Recordings in an account are kept until you delete them. There is no automatic expiry: a recording you uploaded a year ago is still there, and so is its transcript. That includes transcriptions that failed — they stay in your library, holding the audio you uploaded, so that you can retry or delete them.

This is a deliberate choice rather than an oversight, and it cuts both ways: nothing you rely on disappears without you asking, and nothing you have forgotten about is cleaned up for you.

When you record while signed in on Android or on the website and have minutes left, the recording is sent to us in pieces as it is made, so that what has reached us is safe even if your phone or computer is lost or breaks before you stop. Those pieces are kept only for that recording: they become the file you transcribe when you stop, they are deleted when you discard it, and a recording that is never finished is deleted about seven days after the last activity on it. They use none of your minutes.

The trial is an exception, and it goes the other way. A recording made without an account is deleted automatically, on the clock described below.

Recordings still in your browser

When you record on the website while signed in, your browser saves the recording on your own device as it is being made, so that a closed tab or a crash does not lose it — though after a crash or a closed tab, the last few seconds before it closed may be missing. It stays there only until it has finished uploading to us, or until you discard it, and is then deleted from your browser. If, when you stop, your browser cannot read all of it back, so that what is uploaded is missing part of it, the copy is kept after the upload too, and your library offers it, for you to transcribe again or delete. If the upload never finishes, your library offers the recording back the next time you open it, for you to transcribe or delete. Any marks and notes you make while recording are saved with it, and deleted with it. So are any images you add while recording; if some of them could not be uploaded after the recording itself, it stays until they have been or you delete them, and your library offers to upload them.

It is offered only to the account that made it, and only in the browser that made it. Signing out leaves it where it is, so that signing back in can finish it. Deleting your account here deletes every recording this browser was keeping for it; deleting your account from another device cannot reach them, and neither can we. Clearing this site’s data in your browser removes them too. Until then a recording is on that computer like anything else a website keeps in your browser, so on a shared computer, let it finish uploading or delete it before you leave.

While you record signed in and have minutes left, the website also sends the recording to us in pieces as it is being made, so that less is left to upload when you stop. The copy in your browser is still kept until the whole recording has reached us. The pieces are used only for that recording: when you stop, they become the file you transcribe; if that can’t be done, they are deleted and the whole recording is uploaded instead. When you discard the recording, or delete the copy your library offers back, we delete them then. If a request to delete them doesn’t get through, they are deleted about seven days after the last activity on that recording, as are the pieces of a recording that is never finished. They use none of your minutes.

When you record without signing in, on the trial page, your browser saves that recording in the same way, in this site’s storage on your device, so that a link you follow, a crash or a phone closing the tab does not lose it — though after a crash or a closed tab, the last few seconds before it closed may be missing. It is kept until it has finished uploading to us, or until you delete it. If neither has happened 48 hours after you made it, it is no longer offered, and it is deleted the next time you open the trial page or your library in this browser — only this site can delete it, and only while it is open. Until then, if the upload never finished, the trial page offers the recording back when you next open it, with a button to transcribe it and one to delete it — or, once your trial has been used, to download it or delete it. If, when you stop, your browser cannot read all of it back, so that what is uploaded is missing part of it, the copy is kept after the upload too, and offered in the same way until you delete it or those 48 hours have passed.

It is never offered to an account, and the trial page never offers an account’s recordings. Clearing this site’s data in your browser removes it too. Until it is gone it is on that computer like anything else a website keeps in your browser, so on a shared computer anyone who opens the trial page in the same browser is offered it: let it finish uploading, or delete it, before you leave. So that the trial page looks for such a recording only where one was made, your browser also keeps a note of when one was last started there, and nothing else; the trial page removes the note when it opens and finds none left.

The Chrome extension

The txscribe extension for Chrome records the sound of a browser tab, and your microphone too if you leave “Include my microphone” on, only after you press Record this tab, and only that tab. It does not read or change what is on any web page and it does not see the sites you visit. It reads the tab’s title once, to name the transcript.

While it records, the extension saves the recording in its own storage in your browser every few seconds, so that what was saved can be recovered after a closed browser or a crash. When you stop, it uploads the recording to us, and from then on it is handled like any other recording you upload here. The copy in your browser is deleted once the upload has finished and its transcription has started, or when you discard it; until then it is kept, so that a failed upload can be tried again. Uninstalling the extension deletes anything it still keeps.

You connect the extension on this site, signed in the way you always are; the extension itself never signs in. We give it a key of its own that can only upload recordings to your account (and ask how much of one has arrived), start their transcription, read your name, email address and minutes left, and disconnect itself. The key expires after 90 days. Your account page lists it, and Disconnect there stops it working at once. The extension sends nothing to anyone but us and the storage address we issue for each upload, and it carries no analytics.

Trying it without an account

You can transcribe one recording without signing in. We give that visit an identifier of its own — a random value in a cookie, holding no name, no email address and nothing from your recording — so that we know which transcript is yours to read back. It is not linked to any account, and it is not used to recognise you anywhere else.

What the trial makes is deleted 48 hours after you make it. That covers the file you uploaded, the transcript produced from it and everything stored alongside it, in every place we keep it — the same deletion the button in your library performs, including the seven-day storage delay described above. It runs on a schedule rather than waiting for you to ask, and it happens whether or not you come back.

If you sign in and choose to keep the transcript, it moves into your account and that clock is removed — from then on it is an ordinary transcript of yours, kept until you delete it. While the trial page offers Pro to keep the transcript, only an account on Pro can keep it, unless you have bought it on its own. If you do not, it goes. Signing in from a different browser cannot reach it, because the identifier that names it lives in the browser that made it.

If you buy the trial’s transcript on its own, it is kept for 7 days from the moment you pay instead, and the identifier in your browser lasts as long. Keeping it in an account removes that clock too. With it we keep the identifier of the Stripe checkout that paid for it, so that a refund or a question about the payment can be traced; it is deleted with the transcript. From the moment you open Stripe’s page we also keep the identifier of that checkout with the transcript, so that a payment that reaches us after you have left the page, as a Pix payment can, is still matched to it; it is deleted with the transcript too. Only while a payment for it is still being confirmed with Stripe, the transcript may be kept up to 30 hours past its deadline, where no one can open it, and is then deleted.

Counting trials

Transcribing costs us money for each recording, so we limit how many trials can start from one network address — 5 in any 24 hours. To count them we have to be able to tell one address from another.

We do not store your IP address to do it. We store a SHA-256 hash of the address combined with a secret key that only we hold, and a count against that hash. Anyone who obtains that data without the key cannot turn it back into an address. We are not going to pretend it is beyond us as well — we hold the key — but the hash is never attached to your account, your transcript or anything you upload, and nothing we do reads it back as an address. The hash and its counter are deleted once the 24-hour window they belong to has passed, by the same sweep that deletes the trial itself.

When something breaks in your browser

If a page fails in your browser, it sends our own server a short error report, so that we find out without waiting for you to tell us. It goes nowhere else.

A report holds the error message, a shortened trace of where in our code it happened, which page it was — on a transcript's page, which transcript; on any other page, only which page — the version of the site you were running, and your browser and operating system in broad terms, such as “Safari on iPhone”.

It is built to leave your content out. Nothing after the “?” in the address is sent, anything in the message that looks like an email address, a file name or quoted text is removed before the report is kept, and no recording, transcript or file is ever attached. Reports are kept in our server logs for 30 days.

How we count visits

We measure our own site ourselves. There is no analytics company involved and no advertising pixel, and no other company’s script counts visits for us. The counts are written to the same database as everything else described above, in our own project.

There is one exception, and it only applies if you arrived by clicking one of our ads and said yes when we asked. Then, if you go on to create an account, start a free week, buy a single transcript or subscribe, we tell the platform whose ad it was that it happened — Google Ads, or OpenAI for an ad in ChatGPT: the click identifier the ad added to the link (gclid, or on some iPhones gbraid or wbraid, from Google; oppref from OpenAI), which of those things it was, when, and for a subscription or a purchase its price. For a subscription, Google Ads is also told when its first payment at the full monthly price is made, and that price. The start of a free week is told only if the question you answered named it, and the purchase of a single transcript only if the question named a purchase; a yes given before either did covers a sign-up and a subscription and no more. For a purchase, the click identifier and when the ad was clicked are kept with the transcript you bought, and deleted with it. Nothing else — not your email address, your name, your IP address, or anything from a recording. If you said no, or never answered, nothing is sent. You can withdraw that yes from your account page at any time; what was already sent cannot be recalled.

To do it we give your browser two cookies, and a third only if you answer the question about our ad. None of them can be read by scripts on the page.

tx_aid holds a random value and nothing else: no name, no email address, no account, and nothing whatsoever from a recording or a transcript. Your file names never form part of it either.

tx_attr records where you first arrived from (with two exceptions, below):

• the campaign tags on the link you followed, if it had any — utm_source, utm_medium, utm_campaign, utm_content and utm_term;
• if you arrived by clicking one of our ads, the click identifier the ad platform added to the link — gclid, gbraid or wbraid from Google, msclkid from Microsoft, oppref from OpenAI (for an ad in ChatGPT) or fbclid from Facebook;
• the site that linked to you, as its address only, never the page on it;
• the page you landed on, without anything after the “?”, and the time.

We keep that first answer, with two exceptions. They go by five ad click identifiers in the link you arrive on: gclid, gbraid and wbraid from Google, msclkid from Microsoft, and oppref from OpenAI. Clicking one of our ads adds one, but so can opening a copied link that still carries it; we cannot tell the two apart. (fbclid is recorded but does not count, because Facebook also adds it to ordinary shared links.) First: if what we hold has none of those five, or we cannot read it, a later link that carries one of them replaces it. Second: if what we hold has only gbraid or wbraid (the identifiers Google uses on iPhones), a later link that carries a gclid replaces it. Each time, the whole record is replaced — campaign, landing page and time. Once what we hold has a gclid, an msclkid or an oppref, it is never replaced. If the cookie is damaged so badly that it cannot even be decoded when it reaches us, we treat it as missing, and the next page you land on becomes the first answer; one that decodes but cannot be read is kept, and the first exception applies to it.

tx_adc holds your answer to the question about our ad — yes or no, which platform the question named, and for a yes whether it named the free week or a purchase — and nothing else, so that you are not asked again. It is set only if you arrived from one of our ads on Google or in ChatGPT and answered.

We ask your browser to keep these cookies for up to 400 days, so that we can tell whether the people who arrive from a particular link are the people who eventually subscribe. Your browser decides whether to honour that, and some browsers shorten it. If you sign in, they are attached to your account once, so that the same question can be answered about customers.

A count we record is an event name, a time, the random value above, where you first arrived from, and a handful of numbers — how long a recording was, which language, which plan. It can also say which feature was used (a summary, a search, an export — never what you asked, searched or exported), whether a recording was made in our app or picked as a file, and what kind of device it came from: a computer’s browser, a phone’s, or one of our apps, and which of our apps (txscribe or Notaula). That is a kind: your browser’s full identification string is not recorded with these counts, nor on your transcripts. The same kind, and whether it was recorded or a file, is noted on a transcript when it is created, for the same counts. (Our servers’ own request logs, which are not these counts, keep the identification string and network address of every request for 30 days, to find faults and abuse.) For an optional question on a transcript's page, we record whether it was shown, answered or skipped, your plan, and, if you answered, the category you picked, to understand what people use transcription for. Like every count here, these carry the random value above and where you first arrived from, so through the value your account holds they can be put next to your account. The question has no text field, and these counts hold no audio, transcript text, title, file name or transcript identifier. A mark in this browser's storage keeps the question from being shown again; the mark holds no answer. Your account identifier is not one of them, and cannot be: there is nowhere in that record to put one. So deleting your account removes the only thing that ever connected those counts to you, and what is left is not about anybody.

We do not store your IP address against any of this, and none of it is combined with data from anywhere else. Clearing your cookies removes it, and you will simply be counted as a new visitor.

Some pages do load another company’s script, each for one job on that page:

• Signing in uses Google’s Firebase Authentication, which loads a script from Google (apis.google.com) on the sign-in page, and may load it on any other page that signs you in or out, such as the trial’s result and the page you return to after paying.
• A transcript made from a video on YouTube, Vimeo, Facebook, Instagram, TikTok or Loom shows that site’s own player in its page, loaded from that site. For a YouTube video the page also loads YouTube’s player script, from youtube.com, so that the transcript can follow the video.
• Where Pro can be paid for inside the trial’s pages, pressing to pay there loads Stripe’s own script into that page. What it does is under Payments, below.
• On the sign-in page and the trial page, a browser that is signed in to Google may be shown Google’s own one-tap sign-in prompt, drawn by a script from Google (accounts.google.com). Loading it tells Google that your browser opened that page; nothing else is sent until you press it, which signs you in with that Google account. Closing it keeps it away for twelve hours.

What your browser sends those companies then is governed by their own privacy policies.

Deletion

Deleting a transcript deletes the uploaded recording, the transcript, any translations of it, and any share link. The share link stops working at once and the records become unreadable to us immediately. Study materials are deleted with their transcript and with your account, and they are included in your account export.

Your account export says, for each transcript, which engine made it (for example Google Cloud Speech-to-Text or your phone).

In the web app’s library, a transcript is first moved to Trash, where it is kept for 30 days so that it can be restored. While it is there it cannot be opened, no new processing can be started on it (work already queued before you deleted it, such as a summary you had asked for, may still finish), and its share link does not work; restoring it brings the link back, unless the link’s own expiry passed in the meantime. After 30 days, or as soon as you choose Delete forever or Empty trash, it is deleted as described above. The phone app moves a transcript to Trash in the same way; a recording still on the phone that was never uploaded is deleted from the phone at once. The desktop app deletes straight away, without Trash.

The stored files themselves are removed on a seven-day delay: Google Cloud Storage keeps a deleted object recoverable for seven days before erasing it, which protects you against an accidental deletion and means the bytes are genuinely gone a week after the transcript is permanently deleted — that is, a week after Delete forever, Empty trash or the end of the 30 days in Trash, not a week after you first press Delete. We would rather give you that number than write “for a short period”.

Payments

Payments are handled by Stripe. We never see or store your card details; we store only the Stripe customer and subscription identifiers needed to tell which plan you are on. When a payment does not go through, we keep the reason Stripe gives for it, such as 'insufficient funds', to see where checkouts fail; it never includes your card details.

To set up your subscription we send Stripe your email address, an internal identifier for your account, and the plan you choose. Where tax has to be calculated, Stripe also asks for your billing address and keeps it with your payment details. Stripe never receives your recordings, transcripts or anything generated from them.

On the trial’s pages, Pro can also be paid for in Stripe’s form drawn inside the page rather than on Stripe’s page; where this policy says “Stripe’s page”, that form is meant too. The form is Stripe’s: what you type into it goes to Stripe, never to us. To draw it, your browser loads Stripe’s script from js.stripe.com into that page when you press the button that opens it, and never before. From then on, as on Stripe’s own pages, that script may set Stripe’s cookies on this site, may load hCaptcha to tell people from bots, and sends Stripe information about your device and how the page is used, which Stripe uses to prevent fraud and says it never uses for advertising. That is governed by Stripe’s privacy policy and cookie policy.

If you buy a single trial transcript, you pay on Stripe’s page without an account, once: nothing renews. Stripe receives the email address and card details you give it there, the identifier of the transcript the payment is for and the random identifier our analytics gives your browser; we learn that the payment went through and the identifier of its checkout. In Brazil, Stripe’s page may show the price in reais and offer Pix: if you pay by Pix, you pay from your bank’s app, and Stripe receives the details its page asks for to pay that way instead of card details.

Receipts and notices about payments may come from Stripe rather than from us, and those messages are governed by Stripe’s privacy policy.

Email

These are the emails we send:

• A sign-in link you ask for. When you ask to sign in by email, or to add your address to a purchase made before you had an account, a one-time link is emailed to the address you typed, either by Google’s Firebase or through Resend. Somebody else could type your address too; such a link does nothing unless it is opened.
• Before we charge you. What the amount is, what date it lands, and a link to cancel. When the amount is changing — at the end of an introductory month, say — it says that too. When a free week starts, the same message says the day it ends and what will be charged then, sent to the address your billing email goes to. When a paid first week starts, the same message goes out that day, with the date the monthly price begins and what will be charged then.
• When a transcript is ready, or didn’t finish. On unless you turn it off, because most people leave the tab while a recording is transcribed. The ready notice carries the transcript’s title and a short preview — the summary’s overview if there is one, otherwise the transcript’s opening words. Every one of these has a one-click link to stop them, and your account settings have the same switches.
• A share link you send by email. When you email a transcript’s share link from txscribe, the people whose addresses you type in get a message with your name and address, the transcript’s title, the link and any note you add. We remember those addresses on the link’s “Shared with” list until you turn sharing off or delete the transcript. We do not add them to any mailing list or write to them unless you send the link again.
• Getting started: up to three emails in your first week. If you sign up and have a free account, we may send you up to three short emails in the first week — on about the first, third and seventh day — each saying one thing you can do withtxscribe, and the last one what the paid plan costs if your free minutes are nearly used up. If your account has a finished transcript when the first email is prepared, that email also asks what you use transcription for; answering is optional, and replies go to our support inbox. They are written from what your account itself shows (whether anything has been transcribed, how many free minutes are left), never from the content of a recording. Nothing more is sent after the first week. Every one has a one-click link to stop them, and your account settings have the same switch. They are not sent to paying accounts.
• Confirming an address. If you give us a separate contact address, or an address for the student discount, we send a link to it to check that it is yours. For the student price, once the address is confirmed we keep only the university’s domain (for example, mit.edu) and a one-way fingerprint of the address — never the address itself — so that one address can verify one account. Until it is confirmed, the address is kept with the confirmation link.

Beyond the first-week emails above, we send no marketing email, and there is no mailing list to be on: we never write to you about offers, news or anything else unless you ask. If you write to us, a person replies from a mailbox — that reply is not part of any of this.

These messages are delivered by Resend, which receives the address each one goes to and the text of the message, including the title, preview and note described above. It never receives your recordings. The preview is the summary’s overview cut to 400 characters, or else the transcript’s first 200 characters, so a transcript shorter than that reaches it whole. A sign-in link is emailed either through Resend or by Google’s Firebase, as described above.

Contact

Questions about any of this: support@txscribe.ai.