Privacy Policy

This Privacy Policy explains what information ScribeFlow processes, why, and what choices you have. It applies to this instance of the ScribeFlow web application. By using ScribeFlow you acknowledge this Policy and the Terms of Service.

1. Who is responsible

The controller is the person or organization that operates this ScribeFlow instance. There is no separate privacy officer unless that operator names one. If you host ScribeFlow yourself, you are the controller for data on your machine.

2. Information we process

Account

If you sign in with Google, we receive an identifier (subject), and may receive your name, email address, and profile photo from Google. Local test sign-in stores a non-verified identifier in a cookie on this device.

Lecture material

Recordings or transcripts you upload, generated notes, quizzes, flashcards, file names, and timestamps. If you are signed in, this material may be saved in Workspace on the ScribeFlow server. That store is not encrypted.

Device and session

Cookies and similar storage described in the Cookie Policy, including sign-in cookies and, if you allow functional storage, a draft of your last lecture saved in this browser.

Technical

Standard request logs that a host or reverse proxy may keep (IP address, user agent, URL, time). This application does not run its own advertising or analytics pixels.

3. How we use information

• to transcribe audio and draft study materials you request;
• to show Workspace and restore a lecture when you are signed in;
• to keep you signed in and protect sign-in;
• to remember optional cookie preferences;
• to operate, debug, and (if the operator chooses) back up this instance.

Legal bases, where GDPR or similar law applies, include performing the contract (providing the tool you asked for), legitimate interests in running a working service, and consent for optional functional storage.

4. How we share information

We do not sell your personal information.

We share information with processors only as needed to run features you use:

• Transcription and note providers (when live processing is turned on): audio and transcript text are sent to them. They may keep that data under their own retention policies. Their privacy terms apply.
• Google (if you choose Google Sign-In): authentication is handled by Google. Google’s privacy policy applies to that flow.
• The instance operator and anyone with disk or admin access can read Workspace files and server logs. Treat that as an intended limitation, not a bug we hide.

We may disclose information if required by law or to protect rights, safety, or the service.

5. Security — what we do not do

Stored lectures, transcripts, and notes are not encrypted. That is why this service is not a secure place to keep private material. In particular we do not promise:

• encryption of Workspace files or browser drafts;
• encryption that only you can unlock;
• access limits beyond “a signed-in person sees their own files”;
• an audited security program, or compliance with school, health, or payment rules;
• guaranteed deletion from backups the operator may have made;
• a protected connection in every setup.

You are responsible for what you upload. If a recording includes other students, patients, or confidential workplace information, you must have the right to process it. If you need a secure system, do not use ScribeFlow.

6. Retention

Browser drafts remain until you clear site data or turn off functional storage. Workspace remains until you delete an item or the operator deletes the store. Sign-in cookies last up to about 30 days for the local test cookie, or as configured for Google sessions. We do not run a scheduled purge. Providers that transcribe or draft notes may keep copies of what you send them for as long as their own retention policies allow. We do not control those policies.

7. Your choices and rights

• Sign out; delete Workspace folders or files in the app.
• Clear this site’s cookies and saved data in your browser.
• Use cookie preferences to allow or refuse functional storage.
• Disconnect Google access in your Google account settings.

Depending on where you live, you may have rights to access, correct, delete, restrict, or port personal data, to withdraw consent, and to complain to a regulator (for example the Office of the Privacy Commissioner of Canada, or a European supervisory authority). Send requests to the operator of this instance. We may need to verify you and may refuse requests the law does not require us to honor.

8. Do not sell or share (US state privacy laws)

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use targeted advertising cookies. If you still want to record a “do not sell or share” request, use cookie preferences (Essential only) and avoid Google Sign-In. This section is our notice under laws such as the CCPA/CPRA.

9. Children

ScribeFlow is not directed at children under 13. We do not knowingly collect personal information from them. If you believe a child under 13 used ScribeFlow, stop use and delete the data you control.

10. International transfers

If you use Google or a provider that transcribes or drafts your lecture, data may be processed in the United States or other countries that may not have the same data-protection laws as your home. Those providers may also keep the data under their own retention policies. Workspace files stay on the machine that hosts this instance.

11. Automated decisions

Drafting notes and questions is automated. It is not a decision that produces legal effects about you (for example grading or admission). You can edit or discard output.

12. Changes

We may update this Policy. The “Last updated” date will change. Continued use after an update means you accept the revised Policy.

13. Contact

Contact the operator of this ScribeFlow instance. You can also delete in-app Workspace files, sign out, and clear browser site data.