Privacy Policy

Introduction

This Privacy Policy explains how Domichron Inc. ("we", "us"), the company behind DomeScribe, collects, uses, and protects your personal information when you use domescribe.ai. We collect as little as we can, keep it for as short a time as the product allows, and give you control over what remains.

Data We Collect

We collect: account information (name, email address, password hash or Google sign-in identifier); usage data (features used, job history, transcription minutes and AI credits consumed); the content you submit for processing (uploaded files, links, pasted text — see Data Retention below); billing records held by Stripe (we never see full card numbers); and cookies for session management plus, only with your consent, product analytics. We do not collect biometric data or precise location data.

How We Use Your Data

We use your data to deliver and improve the service, process payments via Stripe, send transactional emails (receipts, security notices, account verification), and provide customer support. If — and only if — you opt in, we also send occasional product-update and promotional emails, which you can unsubscribe from at any time via the link in every such email or from your account settings. We never sell your data, and we never use your content to train AI models.

Processing in Your Browser

Media conversion, video and audio compression, audio extraction from an uploaded video, and Clip Studio export rendering run entirely in your browser using WebAssembly (ffmpeg.wasm). Those files never leave your device and are never uploaded to our servers. Large files are limited only by your device's memory.

Transcription and AI Processing

Transcription runs on our servers: an uploaded recording, or the audio fetched from a supported platform link, is converted to a compressed audio track and sent to OpenAI's Whisper API to produce the transcript. The AI features (summary with chapters, repurposed drafts, chat, clip picks) send the transcript text to OpenAI's chat models and return the result to you. Results are cached per recording, encrypted with the same per-user key as the transcript, and deleted with it.

Transcript Encryption

Transcripts and AI results are encrypted at rest using AES-256-GCM with a per-user key derived (HMAC-SHA256) from a master key that lives only on our servers. This is not end-to-end encryption — we hold the master key so the product can search, summarise, and play back your recordings — but it means a copy of the database alone cannot reveal your content.

Data Storage & Security

Data is encrypted at rest and in transit (TLS). Our database runs on managed PostgreSQL infrastructure (Supabase) with encryption at rest and automated backups. Two-factor authentication (TOTP) is available for every account. In-app audio playback uses short-lived signed tokens rather than public file URLs.

Data Retention & Auto-Deletion

Uploaded recordings are deleted once transcription finishes. A compressed audio copy is kept only for in-app playback, for the lifetime of the transcript, and is never offered for download. Media fetched from a platform link is used only to produce the transcript; a compressed audio copy is kept for in-app playback in the same way, and we never provide that media to you or anyone else as a file. Transcripts and their AI results are auto-deleted 30 days after creation on every plan — export them at any time, or erase them sooner from the Privacy & Data section of your dashboard. Files from failed jobs are removed by the same automated cleanup process. Browser-tool outputs never reach our servers and are not retained anywhere.

Cookies

We use strictly necessary cookies (httpOnly, Secure, SameSite) to keep you signed in; access tokens are held in memory only, never in localStorage. Product analytics (PostHog) run only after you accept them in the cookie banner. hCaptcha, used to prevent automated abuse on sign-up and account-recovery forms, may set its own cookies. See the Cookie Policy for details.

Third-Party Services

We rely on the following processors, each bound by its own privacy policy and data-processing terms:

• Stripe — payments and subscription billing.
• Supabase — managed database and storage.
• OpenAI — Whisper transcription, and the chat models behind the AI summary, repurposing, chat, and clip features. OpenAI's API terms state that API data is not used to train its models.
• Resend — transactional email (receipts, verification, security notices) and opt-in product emails.
• PostHog — product analytics, only with your consent.
• hCaptcha — abuse prevention on sign-up and account-recovery forms.

Your Rights (GDPR)

Under GDPR you have the right to: access your data (Art. 15), correct inaccuracies (Art. 16), request deletion (Art. 17 — available via the Privacy & Data dashboard), export your data in machine-readable JSON format (Art. 20 — available via the Privacy & Data dashboard), restrict processing (Art. 18), and object to processing (Art. 21). Contact privacy@domescribe.ai to exercise any right.

Data Portability

You can export all of your data (profile, settings, job history, decrypted transcripts) as a JSON file at any time from the Privacy & Data section of your dashboard. You can also permanently erase all your content while keeping your account.

Security Measures

Our security measures include: CSRF protection (Origin + X-Requested-With verification), rate limiting on all endpoints, input sanitisation, strict Content Security Policy headers, HSTS enforcement, brute-force lockout on failed logins, and row-level ownership checks to prevent cross-user data access.

Changes to This Policy

When this policy changes, the date at the top changes with it. Material changes are announced by email where practical.

Contact

Privacy questions and data requests: privacy@domescribe.ai. We aim to respond within 72 hours.