Your recordings stay yours.
Media
Each recording is stored once, privately. Playback — yours, a viewer's, a public page's — streams that one copy through signed URLs that expire in minutes. Nothing is re-hosted and there is no download path for anyone but you.
Transcription
Opt-in per recording. It runs on our own worker with an open-source speech model, metered in minutes you can see. Audio never leaves our infrastructure for a third-party AI service.
What is logged
Security-relevant actions on your account — password changes, session revokes, share links, public toggles — and every operator action are written to an audit log kept for one year. Anonymous visitors to public pages are counted by a one-way hash of address and browser; the sample address is kept seven days, then dropped. Analytics are cookieless and aggregate.
Where data lives
Postgres and object storage in one region, with encrypted backups. Access tokens live in memory in the browser; refresh tokens are httpOnly cookies scoped to the auth path.
Deleting your account
Settings → Danger zone removes every recording, note and attachment and sweeps storage. Export first if you want a copy.
Reporting a problem
FAQ
Questions people ask
Can a viewer download my recording?
No. Shared and public recordings stream from your single copy through short-lived, signed URLs. There is no download.
Where does transcription run?
On our own worker with an open-source model. Audio is never sent to a third-party AI service.
What do you log about visitors to public pages?
A one-way hash of address and browser, to stop abuse. A sample address is kept for seven days for the operator, then dropped.
How do I delete my account?
Settings → Danger zone. Every recording, note and attachment is removed and the storage swept.