Security & privacy

Every category of audio data has an explicit lifetime. Defaults below; enterprise customers can negotiate shorter windows.

• Sync API responses. Audio and transcripts exist only for the lifetime of the request. Nothing is written to disk on our side beyond operational logs scrubbed of content.
• Async-job result cache — 24 hours. When you submit a transcription or long narration through the async endpoint, the result is held in cache so you can retrieve it once your job finishes. It expires 24 hours after the job is created, and retrieving it does not delete it early — you can poll the same job until the window closes. How to disable: use the sync endpoint instead (/v1/transcriptions, /v1/speech) — the response is returned inline and nothing is cached. The desktop app uses sync for anything short; you only hit async for jobs long enough to exceed the HTTP timeout.
• Generated audio files (cloud) — 72-hour TTL. Defaults to AUDIO_TTL_HOURS=72. A scheduled cleanup task removes expired files; a Prometheus alert catches anything that overruns. A metadata record (duration, model, timestamp — not content) is kept for billing.
• Reference audio for voice clones — 7 days. Held in Redis with REFERENCE_AUDIO_TTL_HOURS=168. Deleted on expiry, on account deletion, or immediately when you call DELETE /api/v1/voice-clones/{ref_id} — whichever first.
• Usage logs — 90 days. Request-level audit log (user ID, model, duration, timestamp). Scrubbed of input and output content. Purged after 90 days.

The full per-category schedule, including billing records (7 years for tax) and consent records, is in the Retention and deletion section of the Privacy Policy.

Your inputs, reference audio, transcribed audio, and generated outputs are never used to train or improve our models. Not on paid tiers, not on the free tier, not anywhere.

If we ever introduce a model-improvement program, it will be a free-tier-only, in-product opt-in that defaults to off and is toggleable in account settings at any time. Enterprise and paid accounts are excluded by default and contractually — covered in the Data Processing Agreement we execute with enterprise customers.

We also do not send your audio to any third-party model API. Generation, transcription, and transcript cleanup happen on open-weight models we host ourselves (Kokoro, OmniVoice, Parakeet, Voxtral, pyannote, Qwen3). The credits page lists every model and its license.

If you are in the EEA or UK, the GDPR rights of access, rectification, erasure, portability, restriction, and objection apply. You can exercise any of them in two ways.

• In-product. The dashboard has a "Delete my account" flow that wipes your profile, generated audio, cached reference audio, and all per-user metadata within 30 days. Billing records are kept the 7 years required by US/California tax law; everything else is purged.
• By email. Send a request from the address on your account to our privacy contact. We acknowledge within 10 business days and respond within 45 calendar days (extendable once by 45 days for complex requests, as GDPR Art. 12(3) and CCPA §1798.130 permit). Portability requests return a structured, machine-readable export.

For transfers from the EEA / UK to the United States, we rely on the European Commission's Standard Contractual Clauses (module 2, controller-to-processor) with each subprocessor, supplemented by the UK International Data Transfer Addendum where relevant. Copies of the executed SCCs are available on request.

When a request falls back to the cloud (long-form transcription, cloned-voice synthesis, the web app), it travels to servers operated in the United States. Specifically:

• Compute & storage — our own GPU host, physically in the United States. Generated audio and cached reference audio live on encrypted disks at this host.
• Cloudflare (US) — tunnel ingress, edge TLS termination, DDoS protection. Cloudflare sees request metadata (IP, user-agent, URL) in transit, not your audio payload contents beyond the TLS-decrypted body it forwards to us.
• Clerk (US) — authentication. No audio content, only your account identifiers and session tokens.
• Stripe (US) — billing. No audio content, only billing metadata and payment-method identifiers.
• Resend (US) — transactional email (password resets, billing receipts). No audio content.

The full subprocessor list, including Sentry (error monitoring) and PostHog (pseudonymous product analytics where enabled), is in the Subprocessors section of the Privacy Policy. We give 30 days' notice of material changes to enterprise customers with a DPA in force.

If you believe you have found a vulnerability or have a question about how we handle your data, email our privacy contact. Please give us a reasonable window to respond before public disclosure.

To report abuse of a generated voice or transcript (impersonation, harassment, non-consensual cloning), use the abuse report form. Reports are reviewed by a human and acted on within 72 hours.