Privacy Policy

Last updated: September 2026

Speecho ("we", "our", or "us") is operated by Maksym Soloviov, an individual entrepreneur (Фізична особа-підприємець / FOP) registered in Ukraine. Registration number and registered business address are available on written request at support@speecho.app. This policy explains what data we collect, how we use it, and your rights under GDPR, CCPA, and similar laws.

1. Data We Collect

Account data: email address, and - if you register with an email and password - a hashed password. If you sign in with Google instead, Google sends us your email address, your name and your Google account identifier; we store those and never receive or store a password for that account. Because Google confirms the address itself, an account created or linked this way counts as email-verified without a separate confirmation link.
Transcription data: file name, detected language, duration, and the resulting text. Audio files are streamed to OpenAI and/or Groq for AI inference, or to Replicate when you enable speaker identification. By default, audio is not stored on our servers after processing completes. Generated AI summaries, notes, chapters and translations are stored alongside the transcript.
Kept audio (optional): if you enable the "Keep audio" option before uploading or before starting a live subtitles session (it is off by default), a compressed copy of the recording is stored in private cloud storage so you can play it back next to the transcript. It is never made public, is deleted automatically after 90 days together with the transcript, and can be deleted separately at any moment with the "Delete audio" button - the transcript stays.
Handwriting scans: photos you upload for text recognition are processed in memory and streamed to OpenAI for recognition. The images are never written to disk or stored - only the recognized text is saved, under the same 90-day rule as transcripts.
Caption videos: a video you upload for subtitle burning is processed on our server; the finished subtitled video is stored temporarily so you can download it and is deleted within 24 hours. The extracted transcript follows the normal 90-day rule.
Transcript chat: questions you ask about a transcript (and the AI answers) are processed transiently through the AI providers listed below and are not stored on our servers. The chat thread exists only in your browser.
Text-to-speech data: the text you submit is sent to OpenAI or ElevenLabs for speech synthesis. The submitted text and the generated audio file are stored (audio in private cloud storage) so you can replay and download the clip, and are automatically deleted after 90 days - or immediately when you delete the clip or your account.
Live subtitles data: when you start a live subtitles session, microphone audio is streamed in real time through our server to Soniox for speech recognition and optional translation. The audio is relayed for recognition and is not stored by us unless you turn on "Keep audio" for the session; a kept recording follows the same 90-day rule and "Delete audio" button as any other kept audio. The resulting transcript is saved to your history when the session ends. You can later run a kept recording through the regular transcription pipeline for a more accurate transcript: the audio is then sent to the transcription providers below (and to Replicate if you enable speaker identification), and a second copy is kept with the new transcript under the same rules. If you explicitly enable the live viewing link during a session, the live transcript (text only, never audio) is visible in real time to anyone who has that link; the link is off by default and can be disabled at any moment. If the link is still enabled when the session ends, it keeps serving the saved transcript as a regular share link until you revoke it from your dashboard or delete the transcription.
Payment data: all payment processing is handled by Paddle as our Merchant of Record. We store only the order ID and the amount of credits added. We never see, store, or process your card details.
Usage data: IP address (used for rate limiting only, not retained long-term), request timestamps.
Analytics data: aggregated, anonymous traffic data (page views, country, device type) collected by Cloudflare Web Analytics, and cookieless product analytics (page views, feature-usage events) collected by PostHog and processed in the EU. Neither sets cookies or persistent identifiers; no personal identification.

2. How We Use Your Data

To provide and operate the transcription service.
To send transactional emails (payment receipts, transcription results, account-related notifications). We use Resend for email delivery.
To prevent abuse via rate limiting.
To monitor errors and improve service stability via Sentry (only error context, no user content).
To understand aggregate traffic patterns via Cloudflare Web Analytics and feature usage via PostHog (cookieless, processed in the EU).
To enable optional public sharing of individual transcriptions when you explicitly request it. Sharing is per-transcription, opt-in, and revocable from your dashboard at any time.

3. Data Retention

Transcription history (file name, text, metadata): automatically deleted after 90 days.
Kept audio (opt-in "Keep audio" recordings): deleted together with the transcription - after 90 days, when you delete the transcription or your account, or immediately when you use "Delete audio" on the transcript.
Account data: retained until you delete your account.
Guest data: stored on our servers and linked to a token in your browser. Empty guest sessions (no balance, no transcriptions) are automatically deleted after 24 hours. Guest sessions with a balance or transcription history are retained until you delete the session yourself; associated transcriptions still expire under the 90-day rule above.
Caption renders (subtitled videos): deleted within 24 hours of completion.
Text-to-speech clips (submitted text and generated audio): automatically deleted after 90 days, or immediately when you delete the clip or your account.
Payment records: retained for 7 years for tax and accounting compliance.
Share links: when you opt to share a transcription, a random token is stored alongside it and remains valid until you disable sharing from your dashboard or until the parent transcription is deleted (under the 90-day rule above). Disabling sharing immediately invalidates the link for all visitors.

4. Third-Party Services

OpenAI - performs AI inference for audio transcription (Whisper model), handwriting recognition on scanned images, and serves as fallback for text tasks (summaries, notes, chapters, chat, translations, clean read). Inputs are processed for inference only and are not used to train models by default for API usage, per OpenAI's data policy. Subject to OpenAI's Privacy Policy.
Groq - alternative provider for audio transcription (Whisper) and the primary provider for text tasks: AI summaries, notes, chapters, transcript chat, translation and clean read, using open-weight language models hosted by Groq. When Groq is unavailable or rate-limited, the same text is processed by OpenAI instead. Inputs are processed for inference only and are not used to train models, per Groq's data policy. Subject to Groq's Privacy Policy.
Replicate - runs the speaker identification model when you enable it before upload. Audio is processed for inference only. Subject to Replicate's Privacy Policy.
Soniox - performs real-time speech recognition and translation for live subtitles. Microphone audio is streamed for inference only; Soniox is SOC 2 Type 2 and ISO/IEC 27001 certified and GDPR compliant. Subject to Soniox's Privacy Policy.
ElevenLabs - performs text-to-speech synthesis for the enhanced and premium voice tiers (OpenAI handles the standard tier). The text you submit is processed for synthesis only. Subject to ElevenLabs' Privacy Policy.
Paddle - handles payments as Merchant of Record, including tax compliance. Subject to Paddle's Privacy Policy.
Google - provides Google Sign-In. If you use it, Google tells us your email address, name and account identifier so we can create or find your account. We send Google nothing about you: your audio, transcripts and balance are never shared with them. Subject to Google's Privacy Policy.
Resend - delivers transactional emails (receipts, transcription results, password reset). Subject to Resend's Privacy Policy.
Neon - hosts our PostgreSQL database.
Railway - hosts our backend application.
Cloudflare - hosts our landing pages and frontend app, and provides DNS, CDN, and Web Analytics.
PostHog - cookieless product analytics (page views, feature-usage events), configured without cookies or persistent identifiers. Data is processed in the EU (PostHog EU cloud). Subject to PostHog's Privacy Policy.
Sentry - error tracking and session replay (replays only triggered on errors; input fields are masked by default).

5. Cookies and Tracking

We do not use advertising or tracking cookies. Our PostHog analytics runs entirely without cookies or persistent browser identifiers. Authentication tokens are stored in your browser's localStorage for keeping you signed in. Cloudflare may set technical cookies necessary for security and basic functioning of the website. The sign-in page loads Google's sign-in widget from accounts.google.com; Google may set its own cookies to recognise that you are signed in to Google. That widget is loaded on the sign-in page only.

6. International Data Transfers

Your data may be processed in the United States, the European Union, or Ukraine (where our team is based). We use providers that comply with GDPR and standard contractual clauses for cross-border transfers.

7. Your Rights

Under GDPR, CCPA, and similar laws, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data ("right to be forgotten")
Export your data in a portable format
Object to specific processing activities

To exercise any of these rights, email us at privacy@speecho.app. We respond within 30 days.

8. Children's Privacy

The Service is not intended for users under 16 years old. We do not knowingly collect data from children. If you believe a child has provided us with data, please contact us immediately.

9. Changes

We may update this policy from time to time. The date at the top reflects the latest revision. Material changes will be communicated to registered users via email.

10. Contact

Questions? Email us at privacy@speecho.app.