Privacy Policy

1. What we collect

Account data: your email address and sign-in identifiers (via Google or magic link). Content: the audio/video files you upload (including recordings you choose to make with your microphone in the browser — captured on your device and handled exactly like any other upload), the transcripts and AI outputs generated from them, and any titles, notes, highlights or speaker names you add. Usage data: plan, transcription minutes and AI actions used (for metering and billing), and basic technical logs. Payment data: handled entirely by our payment provider Paddle — we never see or store your card details; we store only your plan and Paddle customer/subscription references.

2. How we use it

Solely to provide and improve the service: transcribing your files, generating the AI outputs you request, enforcing plan limits, processing payments, sending sign-in and service emails, and fixing errors. We do not sell your personal data, and we do not use your content for advertising.

3. Your files and retention

Audio and video files are stored securely and automatically deleted 30 days after upload. Transcripts are kept until you delete them. You can delete any file or transcript instantly at any time. Deleting your account removes all of your data — files, transcripts, usage records and profile — permanently.

Paranoid Mode, precisely: when enabled, the uploaded audio/video file is deleted permanently the moment transcription succeeds. It does not delete the transcript (that remains yours to keep or delete), and it does not change how metering or error logs work. It removes the recording itself — the most sensitive artifact — as early as technically possible.

Files you export and download (TXT, DOCX, PDF, SRT, VTT) are copies under your control on your own devices — this retention schedule no longer applies to them.

4. AI processing — no training

We use third-party AI services to transcribe (Deepgram) and to generate summaries, translations, chat answers and other outputs (Anthropic Claude). We never use your files or transcripts to train AI models of our own, and we configure these providers' training opt-outs so your content is not used to train their models under their current API terms. Content is sent to them only to fulfil the specific request you make, and we review these provider commitments when we update this policy.

5. Service providers

We share data only with the processors required to run the service: Supabase (database, authentication and file storage), Deepgram (speech-to-text), Anthropic (AI features), Paddle (payments, as merchant of record), Vercel (hosting), Inngest (background job processing), Upstash (rate limiting) and Sentry (error monitoring). Each receives only what it needs for its function. Where your data is processed: our providers operate primarily on infrastructure in the United States, so your content is stored and processed there and may transit other regions where these providers operate. Each provider handles data under its own terms and safeguards, described in its privacy documentation.

6. Your rights

Depending on where you live, you may have rights to access, correct, export, restrict or delete your personal data, and to withdraw consent. Most of these you can exercise directly: your dashboard shows all your content, every item has instant deletion, and Settings includes full account deletion. For anything else, contact us and we will do our best to help.

7. Security

Data is encrypted in transit and at rest, access is protected by row-level security (each account can only ever access its own data), and secrets are managed outside the codebase. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you as required by law.

8. Cookies

We use essential cookies only: they keep you signed in and make the app function. We do not use advertising or cross-site tracking cookies. For basic, privacy-friendly traffic statistics we use Vercel Analytics, which is cookieless and does not track you across other sites.

9. Children

The service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

10. Your responsibilities

You are the controller of the recordings you upload: it is your responsibility to have a lawful basis (such as consent from the people recorded) before uploading content containing others' voices or personal data, as set out in our Terms of Service.

11. Changes and contact

We may update this policy from time to time; material changes will be announced on this page with an updated date. Questions or privacy requests: info@trustample.com — we aim to respond within 48 hours.