Privacy policy

7 October 2026

At a glance

The app turns speech from video and audio into text. You do not need an account to use it. Available Google or Apple sign-in methods are shown in the account section. When signing in from the installed app, confirmation takes place in an external browser and finishes by entering a code in the app. The app does not show ads, track you across other apps or sell personal data.

Data we process

We process the public link you paste or the video or audio file you select, together with the file name, a temporary job identifier, the transcript, summaries and service data needed to display the result. To protect the service, we also use the app platform, a random installation identifier and the network IP address, as explained below. The app does not read your other files or contacts.

If you choose to sign in with Google or Apple, the app receives your identifier at that provider, your name and a verified email address, if supplied. You enter your password with the provider; the app does not receive it. If you prepare an email report, the last address entered may be remembered on the device itself.

For history and time-saved estimates, Cloudflare also stores the job creation time, status and processing time, recording duration and word count. The account library retains this information, the number of entries and, if you prepare or send a report, its status and the time of that action. These data enable app features and your history and statistics; they are not used for advertising or tracking across other apps.

Installation identifier and abuse prevention

The installed mobile app creates a stable random installation identifier (UUID). The iOS Share extension creates its own identifier of this kind. It is stored locally and reused in subsequent requests: requests, including uploading the selected file and retrieving the result, carry the identifier in the X-Installation-Id header and the platform in X-App-Platform. This is not an advertising identifier (IDFA/ADID), a device serial number or an account identifier.

The server uses a deterministic SHA-256 hash of the installation identifier and platform to rate-limit native requests. A SHA-256 hash of the IP address is used for additional network limits and, in the browser, also for the main request limit. These hashes act as keys for Cloudflare protection counters. Hashing allows repeat requests to be recognized; it is not full anonymization. When a request arrives, the selected content and identifier arrive together, so data may be linked to the app installation even without an account. We do not store the installation identifier or its hash in the job record.

The identifier and protection counters are used for security and abuse prevention, not for advertising, cross-app tracking or history synchronization. The configured rate-limit window is 60 seconds. This is the counter window, not a promise to physically delete identifiers, hashes or all technical data after exactly 60 seconds.

How processing works

In the cloud version, selected content is sent over HTTPS for the requested transcription, summaries and translation. Cloud processing uses Cloudflare only: it hosts the app and temporary storage, Cloudflare Workers AI transcribes audio with Whisper, and GPT-OSS creates and checks summaries and translates the full text. Translation is stored separately and does not replace the original transcript. The service owner sets a spending ceiling for AI processing. If the configured limit is reached or processing is temporarily unavailable, the job waits to resume within its retention period. We do not use or share content for advertising or tracking. In the local macOS version, processing may run directly on your computer. There is also a temporary phone testing mode on the same Wi-Fi network using local HTTP: it must not be exposed to the internet and should not be used with confidential content.

If you use the Wear OS companion with a paired Android phone, selected history, statuses, summaries and full text are transferred with the interface language, an opaque account identifier and update revision. A snapshot is limited to 12 records and 512 KiB; each text body to 256 KiB. Passwords, access, session and installation tokens are not transferred. Google Play services Data Layer is used; without Bluetooth it may relay through Google Cloud with end-to-end encryption. The watch stores a private local copy. Signing out, deleting the account or clearing history queues watch erasure for the next connection. Until reconnecting, the watch may retain its last copy. Policy: Google.

Retention and deletion

An ordinary job and its result are available for 24 hours from creation. A job waiting for processing capacity may be extended to a maximum of 7 days from job creation, not from each retry. While waiting, selected materials, prepared audio chunks and intermediate checkpoints for resuming processing are held in private Cloudflare R2 storage. After expiry, the service stops returning the job and deletes its record when the timer runs or the record is accessed.

To speed up repeated processing of public links, the service may temporarily store the transcript and summaries in a separate cache. That cache is valid for 7 days from writing and is not used after expiry. This does not synchronize your local history.

After completion, cancellation or terminal failure, the service deletes temporary processing files from Cloudflare R2; failed cleanup is retried. A full transcript already produced may remain in the job result until its expiry even if a summary or translation did not finish. Additional cleanup of expired files and cache runs hourly. Technical delays may postpone physical deletion. Successful cancellation is confirmed after cleanup is checked.

Without signing in: On the device, the app stores up to 50 history entries in IndexedDB: the full transcript, summaries and source information. History survives restarts until you delete an entry, clear the site or app data, or an old entry is displaced by the 50-entry limit.

The last email address entered may remain in localStorage until it is replaced or the site or app data is cleared. Optional sign-in creates a protected session cookie with Secure and HttpOnly attributes; the configured session lifetime is 7 days. A temporary sign-in transaction lasts 10 minutes.

The mobile app identifier is kept in the app’s local storage, and the Share extension identifier in the extension’s local preferences, until the corresponding value is deleted. After that value is deleted, a new random identifier is created on next use. Deleting an individual history entry does not reset the installation identifier. Clearing local data does not automatically delete data already processed by the server or protection counters.

Accounts and connections

Google or Apple profile data and session information are stored on Cloudflare servers; the authorization token is stored encrypted. Session expiry or signing out ends the current sign-in but does not by itself delete the saved account record. You can request account deletion in the account section: the service revokes the provider authorization and deletes the server account record. If this step fails, the interface does not confirm successful deletion. Deleting an account does not automatically erase local guest history, temporary jobs or the Instagram connection.

When Instagram connection is available, you authorize access to your own professional Business or Creator account on Instagram’s page. The service receives the username, account type, post count, information about selected videos and an access token. The token is stored encrypted in Cloudflare and associated with a hash of the installation identifier; the app does not receive your Instagram password. A long-lived token normally lasts 60 days and may be refreshed during use. Token expiry does not mean physical deletion of the saved connection record. Disconnecting Instagram deletes that record from the service; you can also revoke the authorization at Instagram.

For a channel or video collection, the service stores selected links and metadata, individual episode results, summaries and generated HTML/PDF documents. A collection is available for 7 days from creation. This is a separate period: an ordinary job lasts 24 hours, while waiting for processing capacity may extend it to a maximum of 7 days from creation. After expiry, the collection is no longer returned, and cleanup removes its server records and associated files. Technical delays may postpone physical cleanup.

Account cloud library

When you sign in with Google or Apple, your account library is stored on Cloudflare and synced across devices signed in to the same account. The limit is 50 entries and 32 MiB per account. Texts, summaries, titles, notes and source information are stored. History created without signing in stays local; importing it requires a separate button. The device may also keep a separate library cache linked to the account.

Signing out hides the account library and clears it from the interface’s memory, but does not delete the cloud copy. Clearing device data removes local guest history and the account cache; deleting the account removes its cloud history and the current local cache. Retention periods for temporary jobs, public-link cache and collections apply separately; they do not determine how long the account library is kept.

Third-party links

YouTube, Instagram and TikTok links are used only to locate the public media you request. You must have the right to process that content. The app does not ask for passwords for those platforms.

The cloud processing provider’s policy is available here: Cloudflare. API data is governed by the applicable API terms and data processing agreements. Processing may take place outside your country. Our retention periods stated here do not imply identical retention for Cloudflare’s technical logs.

Security and your choices

You can cancel a job while it is running and delete individual history entries directly in the interface. To erase local history, the remembered email address and cookies together, clear this site or app’s data in browser or system settings. To request early deletion of temporary data from the processing service, contact support and provide the job identifier if you have it. Do not send confidential content that is unnecessary for the transcription.

Contact

Operator: KAMAL SALBITTI LTDA, CNPJ 67.216.649/0001-15, Florianópolis, Santa Catarina, Brazil. Questions and deletion requests: WhatsApp +55 48 98838-1971; a link is available on the support page. The deletion procedure is explained on a separate page.