Security & Data Protection

You're trusting ScribeToAny with recordings that are often private — interviews, meetings, calls. This page explains, plainly, what happens to your data and how we keep it safe. Nothing here is aspirational; it describes how the product actually works today.

Your uploads are deleted automatically

When a transcription finishes, the original file you uploaded is deleted from our storage — we keep only the transcript you came for. You never have to remember to clean up after yourself.

• Successful jobs: the source upload is removed as soon as the transcript is ready.
• Failed jobs: the source is removed within 7 days.
• Abandoned uploads that never start a job are swept within an hour.

Your transcripts are your data. They stay in your account so you can read, edit, translate, and export them — and you can delete any of them, at any time, from your files. Deleting a transcript removes it from our storage.

Encrypted in transit and at rest

Every connection to ScribeToAny uses HTTPS, so your data is encrypted while it travels to and from us. At rest, your files and transcripts are stored on Cloudflare's infrastructure (R2 object storage and D1), which encrypts stored data by default.

We never train AI on your data

We never use your audio, video, or transcripts to train AI models, and we don't sell or hand them to anyone for training. Transcription runs on the open-source Whisper model on GPU infrastructure for the sole purpose of producing your transcript. Your content is processed to give you a result, and for nothing else.

Translation works differently, and only if you use it. When you click Translate, your transcript text opens in Google Translate through a signed link that expires after 24 hours, so Google processes that text under Google's own terms. Only the transcript text is sent, never your audio or video. If you don't use Translate, nothing is sent to Google.

So does the AI assistant, and also only if you use it. When you ask for a summary or ask a question about a transcript, its text and your question go through our AI gateway to OpenRouter and on to a third-party AI model provider. They handle that text under their own terms, and we cannot guarantee they won't keep it or train on it. Your audio and video are never sent. If you don't use the assistant, nothing is sent to an AI provider. Details are in the Privacy Policy.

Payments are handled by Stripe

Billing is processed by established, PCI-DSS-compliant payment providers (Stripe and Creem). Your card details go straight to them over an encrypted connection — ScribeToAny never sees or stores your full card number.

Where your data is processed

• The application runs on Cloudflare Workers at the edge; your files are stored in Cloudflare R2.
• Transcription runs on GPU infrastructure (Modal), which reads your file only for the duration of the job.
• Translation, if you use it, happens in Google Translate, which receives the transcript text only.
• The free browser tools (subtitle and media converters) are different: they run entirely in your browser using WebCodecs, so those files are never uploaded anywhere at all.

Deleting your data

You're in control of everything you store with us:

• Delete individual files and transcripts from your files.
• Delete your entire account and its data from your settings.
• If you're in a region covered by the GDPR or similar laws, the data-subject rights described in our Privacy Policy apply.

For the full details on what we collect and why, see our Privacy Policy and Terms of Service.

Reporting a security issue

Found a vulnerability or have a security question? Please contact us — we take reports seriously and will respond promptly.