Privacy Policy

Podtyper (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, the legal basis for that use, and the rights you have regarding your data when you use Podtyper at podtyper.com.

This policy applies to all users, including those in the European Economic Area (EEA), United Kingdom, and other jurisdictions with data protection laws.

1. Information We Collect

We collect the following categories of information:

• Account information: When you sign up, we collect your email address and a hashed password (or, if you use Google OAuth, your name and Google profile ID).
• Transcription data: The podcast URLs you submit, the resulting transcript text, AI-generated insights, and episode metadata (title, duration, platform type). Episode metadata and source audio links may be visible without signing in, including in public episode lists. Transcript text and insights are restricted to the account that created the transcription and authorized administration. Sharing a transcription page link does not by itself give another person access to that private text. Publicly available audio can still contain personal data about its speakers or other people mentioned in it.
• Usage metrics: How many minutes of audio you have transcribed, your subscription tier, and when you created each transcription.
• Payment information: Billing is handled entirely by Stripe. We keep customer and subscription identifiers, plan and subscription status, and billing references needed to manage your account. We do not store your full payment card number.
• Analytics data: We use self-hosted Plausible Analytics to understand aggregate traffic and product use. New analytics requests contain approved page categories, known public content paths, selected referral domains, and limited categories such as source platform, plan, and export format. We do not send account IDs, transcript IDs, episode URLs, search queries, chat messages, or raw error messages in these requests. See Section 5.
• Technical data: Standard server logs (IP address, browser type, pages visited) for security and debugging purposes.

2. Legal Basis for Processing (GDPR Art. 6)

We only process your personal data when we have a valid legal basis to do so:

• Contract performance (Art. 6(1)(b)): Account registration, delivering transcription results, enforcing usage quotas, and managing your subscription. This processing is necessary to provide the service you signed up for.
• Legal obligation (Art. 6(1)(c)): Retaining payment and invoice records where required by tax and accounting law. The applicable period depends on the type of record and legal obligation.
• Legitimate interests (Art. 6(1)(f)): Security logging, fraud prevention, and sending transactional service emails (e.g., subscription confirmations, payment failures). The purposes are to operate a secure, reliable service and communicate information needed to use it.
• Legitimate interests (Art. 6(1)(f)): Limited measurement of site traffic and product interactions to understand usage and improve the service. We minimize the information collected and do not use it for advertising profiles or cross-site tracking. Account-linked operational information, such as completed jobs and subscription status, is personal data even when reports present aggregate totals. Where consent is required for a processing activity, legitimate interests does not replace that requirement.

Personal data about speakers and other people in a recording also requires an applicable legal basis and safeguards, including additional conditions where sensitive personal data is involved. Public availability does not itself constitute consent. Contact us if information in an episode concerns you and you want to exercise your data protection rights.

3. How We Use Your Data

• To provide the transcription service and display your results.
• To track your usage quota and enforce plan limits.
• To process payments and manage your subscription via Stripe.
• To send transactional emails (e.g., subscription confirmations). We do not send marketing emails unless you explicitly opt in.
• To improve the accuracy and performance of the service.
• We do not sell your data to third parties. We do not use your transcript content to train our own AI models. To deliver the requested transcription and insights, we send content to the AI services described in Section 7. Their handling of that content depends on the applicable processing terms and service configuration.

4. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account data: Retained until you delete your account. Upon completed deletion, the live authentication account and associated application records are removed. Payment-provider records, operational logs and backups have separate retention considerations described below.
• Transcriptions and history: Retained until you manually delete them or delete your account. Downloaded audio is used as temporary working data. The worker attempts to remove temporary files when processing finishes or fails; interruptions or cleanup failures can leave files requiring later removal.
• Payment and billing records: Records needed for tax, accounting, disputes or other legal obligations may remain after account deletion for the period applicable to the record and purpose. Stripe may also retain information for its own legal and regulatory obligations.
• Operational logs and backups: These support security, troubleshooting and recovery. Retention depends on the hosting service and configured rotation or backup cycle. There is currently no single enforced automatic expiry across all of these systems. Removing a live account does not immediately remove every retained backup or diagnostic record. Contact us about retained information or an erasure request.
• Analytics data: Our self-hosted analytics database currently retains event and session records until they are removed; automatic event expiry is not yet configured. On October 23, 2026, we removed identifying transcript references, individual transcript paths and raw error properties from the live historical analytics records and the local analytics exports identified during that cleanup. We preserved event totals. External hosting snapshots and other unverified backup locations were outside that verification. Any retained linkable information remains subject to applicable access, objection and erasure requests.

5. Cookies and Analytics

We use necessary browser storage to provide the service:

• Necessary cookies (always active): Authentication session cookies set by Supabase Auth to keep you logged in. These are strictly necessary for the service to function.
• Functional storage: Session storage temporarily preserves an episode you submit while you sign in or return from checkout. Local storage maintains chat usage counters. These values support those product features and are not used to create an analytics visitor identity.

For analytics, we use Plausible Analytics, which we host ourselves. Our analytics sender does not set cookies or store a persistent visitor ID in your browser. It removes URL query strings and fragments, groups transcript URLs under a generic page category, and excludes authentication and admin pages. A server-side collector validates the same restrictions before forwarding events.

Plausible temporarily processes the connection IP address and browser User-Agent to derive approximate location, device categories, and a site-specific daily visitor estimate. Its analytics tables do not store the raw IP address or raw User-Agent. Event and session records support aggregate reports; we do not join their visitor keys to account records or track visitors across sites or devices. Infrastructure providers may separately process connection data in security logs.

Older versions used short-lived analytics notification cookies. We no longer create or read those cookies and expire existing copies. Historical analytics payloads in the live database were cleaned on October 23, 2026, as described in Section 4. This does not make all account, operational or backup data anonymous.

6. Data Storage and Security

• Our primary account and transcription database is hosted by Supabase in Ireland (eu-west-1). Row-level access controls protect private transcription content. Public episode metadata is exposed separately as described in Section 1.
• Audio processing: A Docker worker on our VPS downloads audio when required, sends it to the transcription service, and attempts to remove its temporary files afterward. Some jobs reuse available captions or published transcripts instead of uploading audio for speech recognition.
• Public network connections to our website and service APIs use HTTPS.
• Private account and transcript data is restricted to the relevant account and authorized administration. Episode metadata and public audio links have the public access described in Section 1.

7. Third-Party Services and International Transfers

Podtyper uses the following services. Our primary database is in Ireland, but hosting, payment and AI services or their subprocessors may process information outside the EEA. International transfers require an applicable GDPR Chapter V mechanism, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses where applicable. You can contact us for information about processing locations, recipients and applicable transfer safeguards.

• Supabase — account authentication, primary database hosting in Ireland, and related infrastructure. It processes account details, authentication/session information, stored transcriptions and usage records. supabase.com/privacy
• Google Sign-In — if you choose this login method, Google and Supabase handle the sign-in flow and provide the account identity information needed to authenticate you. Google privacy policy
• xAI / Grok API — speech recognition. When a job requires audio transcription, audio and transcription options are sent to this API. Its business/API processing terms apply, rather than the consumer chatbot privacy terms alone. xAI business/API terms
• OpenRouter and model providers — transcript analysis and AI features. Requests can include transcript text, episode titles and, when a chat feature is used, its messages and context. OpenRouter routes requests to model providers; our configured model includes Google Gemini. The data-use terms and account settings of the router and receiving model provider matter. openrouter.ai/privacy
• TranscriptAPI — retrieval of available YouTube captions and episode metadata when that processing path is used. Requests include public video identifiers and related metadata or search queries. transcriptapi.com/privacy
• Stripe — checkout, payments, subscription management and billing records. It receives checkout information and the billing references needed to process your purchase. Its role and retention obligations depend on the processing activity. stripe.com/privacy
• Cloudflare — hosting of the web application and its API routes, content delivery and network services. It processes connection data and request/response information needed to deliver and secure the service. Cloudflare privacy policy
• netcup GmbH — VPS hosting for our Docker transcription worker and analytics installation. The worker handles temporary audio and transcription results; the infrastructure also processes server and connection information. netcup privacy policy
• Plausible Analytics — analytics software we host ourselves. Analytics requests pass through our validated first-party collector to our VPS. See Sections 4 and 5 for historical cleanup, collection restrictions and retention. The collection described here is our self-hosted installation. plausible.io/data-policy

8. Your Rights

If you are located in the EEA or UK, you have the following rights under GDPR. We will respond without undue delay and normally within one month of receiving a request. Where the law allows an extension for complexity or the number of requests, we will explain the reason and extension within that first month.

• Right to access (Art. 15): You can view all your transcriptions and history in your account at any time. To request a full copy of your personal data, contact support@podtyper.com.
• Right to rectification (Art. 16): To correct inaccurate personal data (e.g., your email address), contact us at support@podtyper.com.
• Right to erasure (Art. 17): You can delete individual transcriptions from your history at any time. To delete your entire account and all associated data, use the Delete Account option in your account menu. The completed operation removes your live account and associated application records. Retained billing records, operational logs, backups and information held by other providers require the separate handling described in Section 4; contact us about those records.
• Right to data portability (Art. 20): You can export any transcript in PDF, TXT, SRT, or VTT format from your history. Where the right applies, contact us to request eligible personal data in a structured, commonly used, machine-readable format. Transcript downloads are not the complete process for requesting a copy of all your personal data.
• Right to object (Art. 21): You can object to processing based on legitimate interests by contacting us at support@podtyper.com.
• Right to restrict processing (Art. 18): In certain circumstances, you can request that we restrict processing of your data. Contact us to exercise this right.
• Right to lodge a complaint: You have the right to lodge a complaint with your national data protection supervisory authority. For EU residents, you can find your local authority at edpb.europa.eu.

9. Browser Extension

The Podtyper browser extension helps you open Podtyper with the podcast page you are currently viewing. When you open the extension popup, it reads only the URL of your active browser tab so it can detect YouTube, Spotify, or Apple Podcasts pages.

• The extension does not store that URL, and it does not send it to any third party.
• If you click “Transcribe with Podtyper,” the extension opens podtyper.com in a new tab with that URL as a query parameter so the homepage input can be prefilled.
• The extension does not inject scripts into web pages, does not access page content, and does not collect analytics.

10. Children's Privacy

Podtyper is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide an additional notice. A privacy notice is not a substitute for consent where separate consent is legally required.

12. Contact and Data Controller

Podtyper is the data controller for personal data collected through this service.

Berke Atac
Rudolf-Reusch-Strasse 27
10367 Berlin, Germany
(see our Impressum for full legal details)

If you have questions about this Privacy Policy, wish to exercise your rights, or have a data protection concern, please contact us at: support@podtyper.com