Privacy Policy
What we collect
To create an account: your email address and a password (stored as a salted PBKDF2-SHA256 hash — we never store or see your plaintext password), or, if you use Google sign-in, your Google account identifier instead of a password. We also record the IP address of signups and free/anonymous demo usage, and basic first-visit attribution (referrer, UTM parameters, landing page) — this is used for abuse/rate-limit prevention on the free tier and to understand which channels bring people to the site. This analytics data is stored on our own servers. When server-side product analytics is enabled, a limited copy of product usage and acquisition events is also sent to PostHog. Raw visitor IP addresses are not sent to PostHog, and we do not use advertising trackers.
The recording you submit
When you paste a link or upload a file, the source audio or video is downloaded to our server only long enough to transcribe it, then deleted — typically within minutes, right after that processing attempt finishes (success or failure). If a job is queued or waiting to retry, the file is kept only until that attempt completes. We do not keep a library of the source media you submit.
Connected sources and Google user data
If you connect Google Drive, Dropbox, OneDrive or Zoom, LongScribe stores the OAuth access and refresh credentials needed to keep that connection working. Those credentials are encrypted before they are stored. For Google Drive, LongScribe requests read-only Drive access so you can browse folders and files, select a source, and optionally monitor that source for new recordings. LongScribe does not modify or delete files in your Google Drive.
Provider file names, identifiers, timestamps and selected source settings are used only to show the connected-source UI, avoid duplicate imports and run the imports and automations you choose. Media imported from a connected source is handled like any other submitted recording: it is downloaded only for the processing attempt and then deleted as described above. Finished transcript text and user-requested outputs remain in your Library until you delete them.
When you disconnect an integration, LongScribe attempts to revoke the provider credential, deletes the stored OAuth credential and removes provider-derived source metadata. Disconnecting does not delete transcripts that were already created; you can delete those separately from your Library.
LongScribe's use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features you request and is not sold, used for advertising, credit decisions, or to train generalized AI or machine-learning models.
Your transcripts
The resulting transcript text is saved to your account so you can find it again, and stays there until you delete it yourself from your Library. Jobs that fail or are cancelled are automatically cleared after 30 days; anonymous demo jobs (no account) are cleared after 7 days. Signed-in successful transcripts have no automatic expiry.
Who else sees your data
- Groq, Inc. — standard AI transcription and the Ask AI feature may send the relevant audio or transcript context to Groq's API.
- ElevenLabs — when you use the High Accuracy plan, the recording audio is sent to ElevenLabs Scribe v2 to generate the transcript.
- Stripe, Inc. — if you buy a subscription or minute top-up, Stripe handles the payment directly. LongScribe never sees or stores your full card number.
- PostHog — when server-side product analytics is enabled, a limited copy of product usage and acquisition events is sent to PostHog; raw visitor IP addresses are not sent.
- Our email provider — used for password resets and job notifications.
We do not sell your data, and we do not share it with advertisers.
Cookies
LongScribe uses one cookie: a session cookie that keeps you signed in for up to 30 days. It's not used for tracking or advertising, and we don't set any other cookies.
Your choices
You can delete your finished jobs and transcripts yourself at any time from your Library. To have your account itself (and any remaining associated data) deleted, contact us using the Report a problem link in the site footer — we'll handle it manually and confirm once it's done. If you're in the EEA, UK or a similar jurisdiction, you can also ask us what data we hold about you or object to processing you believe is unnecessary, through the same channel.
Children
LongScribe isn't directed at, and shouldn't be used by, children under 16.
Changes to this policy
We may update this policy as the product changes. The date at the top of this page reflects the last update.
Contact
Questions about this policy or your data? Use the Report a problem link in the site footer, or the contact form in the app.
Connected cloud and recording accounts
If you choose to connect Google Drive, Dropbox, OneDrive, Box, Zoom or Webex, LongScribe receives OAuth access/refresh tokens for that provider so it can list the folder or cloud recordings you selected and retrieve media for transcription. Provider tokens are encrypted at rest with a server encryption key and are not exposed in the browser after the OAuth flow. For connected private media, LongScribe downloads the authorized file into the same private job storage used for direct uploads; it does not turn the source into a public sharing link. Temporary source media follows the normal LongScribe media-retention policy. You can disconnect a provider from Connected Sources; this removes the stored OAuth connection and disables the associated watched Sources. Existing transcripts/jobs remain subject to the normal account/library controls described elsewhere in this policy.