Privacy
Last updated 22 October 2026. This notice describes what this site actually does; it is not legal advice and should be reviewed by counsel before you rely on it commercially.
What is stored
When you upload a recording we receive the file, the settings you chose (language, speaker labels, key terms), and the transcript produced from it. For each job we keep the file name, the audio duration, the job status, and the time it was created. If you sign in with Google we store the stable Google account id, your name, your email address if Google returns one, your profile picture URL, and a running total of the minutes you have used each day. We never receive or store your Google password.
Signing in with Google
Sign-in uses Google OAuth 2.0. When you continue with Google you are sent to Google, and Google returns an authorization code to this site. We exchange that code for a short-lived token, read your name, email address and profile picture, and create a session. The token is used during sign-in and is not stored. If you delete your account, the link to your Google identity is deleted with it.
Who processes your audio
Speech recognition is performed by AssemblyAI, a third-party service, on our instructions. Your audio is transmitted to their API, transcribed there, and the resulting transcript is returned to us. We do not use your recordings to train models. AssemblyAI's handling of that data is governed by their own privacy policy, which you should read before uploading sensitive material.
Where it is kept
Transcripts, job records, and usage totals are stored in a database on our own server. Uploaded audio is kept in object storage for up to 24 hours after the transcription finishes so you can play it back next to the transcript; after that the stored audio object is deleted and the transcript remains.
How long it is kept
Uploaded audio is deleted 24 hours after the transcription finishes, with the storage bucket's lifecycle rule removing any remaining object within 48 hours. Job records and transcripts remain available to you until you delete them or delete your account. Daily usage counters are kept for accounting and abuse prevention. Account records are kept until you ask us to remove them.
Analytics
We use Google Analytics 4 to understand which pages are useful and how people find them. The Google tag is only loaded when a measurement ID is configured for the build, and it is not loaded at all if you land directly on a private area. When it is active we send page views for public pages only: the path is sent without its query string, and paths under /app, /account, /login and the other signed-in areas are never sent. File names and the contents of files you upload are never included in analytics events. IP addresses are anonymised before they are stored, analytics is not used for advertising, and we do not sell or share this data.
Cookies
We set one session cookie, and only after you sign in. It holds a random session token so you stay logged in, is marked HttpOnly and SameSite=Lax, and expires after 30 days. During Google sign-in we also set a short-lived HttpOnly cookie (10 minutes) that holds the OAuth state value and the PKCE verifier; it is deleted as soon as Google sends you back. When analytics is enabled, Google Analytics also sets its own first-party cookies (normally _ga and _ga_<container id>) to distinguish returning browsers; these are not set on a direct visit to a private page and are not set at all if you block the Google tag. We do not use advertising cookies. There is no cookie-consent banner at this stage of the product: you can block Google Analytics with a browser extension, a privacy setting or a content blocker, and the transcription product still works.
Rate limiting and IP addresses
To stop the service being abused, we record the IP address that submitted a job when no account is signed in. This is used only for abuse prevention and rate limiting on anonymous jobs, and it is never shared.
Sharing
We do not sell your content and we do not share transcripts with advertisers. The only third party that receives your audio is the speech recognition provider named above. We may disclose records if legally compelled.
Your choices
You can ask us to delete a transcript, close your account, or tell you what we hold about you by writing to hello@dictawave.com. We will respond within a reasonable period.
Changes
If this policy changes we will update the date below. Material changes affecting how audio is processed will be announced on the site.
Contact
hello@dictawave.com