Privacy Policy

Hosting and delivery (Cloudflare Pages)

This website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (“Cloudflare”) on the Cloudflare Pages platform and delivered through its global content delivery network. Cloudflare acts as our processor for the technical delivery of this website.

Each time a page is requested, Cloudflare automatically processes the connection data your browser transmits, which is technically necessary to deliver the page:

• IP address of the requesting device
• date and time of the request
• URL requested and volume of data transferred
• HTTP status code of the response
• referrer URL, where your browser sends one
• browser type, browser version and operating system

This processing serves to deliver the website, to keep it stable and secure, and to defend against attacks, including DDoS and bot mitigation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is operating this website securely, reliably and resistant to attack.

This data arises unavoidably the moment you request the page, and therefore cannot be switched off in the consent banner — unlike Google Analytics, which loads only after your explicit consent. The connection data is not evaluated for audience measurement, not combined with other data sources and not used for profiling.

As a content delivery network, Cloudflare serves the content from the data centre closest to you, which may be outside Germany and outside the European Union. In addition, when you request an address without a language prefix — /privacy rather than /en/privacy — an edge function reads the Accept-Language header your browser sends in order to redirect you to the English or German version. The header is evaluated for that redirect only and is not stored.

Retention follows Cloudflare’s own policy; connection and security logs are held there for a limited period only. We receive no personal raw data about individual page views from Cloudflare. The Cloudflare dashboard shows us aggregate operational figures only, such as the total number of requests and the volume of data transferred, from which no individual person can be identified.

A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Further detail is available in Cloudflare’s privacy policy at cloudflare.com/privacypolicy.

Cookies and consent

A consent banner appears on your first visit. Until you make a choice there, no non-essential service is loaded and no non-essential cookie is set. Declining is exactly as easy as accepting: both buttons carry equal visual weight and neither is pre-selected.

The only strictly necessary cookie is the one set by the consent software (vanilla-cookieconsent), which stores your own choice for six months so you are not asked again on every visit. The legal basis is § 25(2)(2) TTDSG in conjunction with Art. 6(1)(f) GDPR.

You can change or fully withdraw your choice at any time via the “Cookie preferences” link in the footer. Withdrawal takes effect going forward and does not affect the lawfulness of processing carried out beforehand.

Google Analytics

Google Analytics 4 is the only analytics tool on this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use it to understand how this website is used and which content is genuinely helpful.

Google Analytics loads only if you accepted the “Google Analytics” category in the consent banner. For as long as you have not consented — including if you ignore or decline the banner — no script is requested from googletagmanager.com, no connection to Google is made, no cookie is set and not a single measurement is transmitted. The tracking code is not hard-wired into the pages; it is fetched dynamically only after your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG.

Once you have consented, Google processes the following pseudonymous usage data on our behalf:

• pages viewed, along with the time and duration of the visit
• referrer URL, that is the page you came from
• approximate location at country and region level, derived from the truncated IP address
• device and browser type, operating system and screen resolution
• language setting
• a randomly generated identifier used to recognise returning visits

IP anonymisation is enabled: your IP address is truncated before any further processing and is not stored. We receive aggregated reports only and cannot identify any individual from them.

After your consent, Google Analytics sets its own cookies — in particular _ga and _ga_<property-id> with a lifetime of up to two years, and _gid with a lifetime of 24 hours. If you withdraw your consent, these cookies are deleted automatically.

Advertising features, remarketing and ad data sharing are permanently disabled. Under Google Consent Mode v2, ad_storage, ad_user_data and ad_personalization remain irrevocably set to “denied”, and Google signals are switched off at property level as well. No cross-site tracking takes place, and the data is not used for profiling or for personalising advertising.

The event data collected is deleted automatically after 14 months. Transfer to the United States cannot be excluded; Google LLC is certified under the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses. A data processing agreement under Art. 28 GDPR is in place with Google.

You may withdraw your consent at any time with effect for the future via the “Cookie preferences” link in the footer. Independently of that, Google offers a browser add-on to opt out of Google Analytics at tools.google.com/dlpage/gaoptout. Further information on Google’s processing is available at policies.google.com/privacy.

Fonts

All fonts are served from our own origin. No connection is made to Google Fonts or any other content delivery network, and no data is transmitted to third parties in the process.

Your interviews, recordings and transcripts

Using Transcriber requires no user account. You do not register, you give us neither a name nor an email address, and we keep no user directory.

Each interview — the audio recording, the transcript, your notes and the revision history — is stored in an encrypted document with the extension “.trbr” on your own device. These documents are not transmitted to us as a whole: we hold no copy of your library, and we can neither hand your interviews over nor restore them on request. The one exception is the audio file while it is being transcribed, which is covered in the next section.

You can additionally lock the app as a whole, or an individual interview, behind a passcode, Touch ID or Face ID. That check runs through Apple’s security framework on your device; no biometric data is transmitted to us or to Apple in the process.

Because the data lives only with you, backing it up is your responsibility too. If you delete a document or the app, the interviews concerned are irretrievably lost.

Transcription

Converting speech to text does not happen on your device. It runs on our servers, and that step requires an internet connection: without one you can still record, read, edit and export, but not transcribe.

When you start a transcription, the following happens:

• The audio file is transmitted to our server over an encrypted connection and placed in a storage bucket created specifically for that one job.
• The server passes the file to the Google Cloud Speech-to-Text API, which produces the text in the language you selected.
• The finished transcript is returned to your device and written into your encrypted document there.
• The bucket is then deleted. Concurrent clean-up jobs additionally make sure no orphaned buckets are left holding audio that is no longer needed.

The audio file is therefore deleted immediately after processing and is not stored with us on any lasting basis. We do not listen to your recordings, do not analyse them, and use them for no purpose other than the transcription you asked for.

The legal basis is Art. 6(1)(b) GDPR: the processing is necessary to provide the service you requested. Without this transmission, transcription is technically impossible.

We use the Google Cloud Speech-to-Text API provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland as a sub-processor for this. A data processing agreement under Art. 28 GDPR is in place with Google. Transfer to third countries cannot be excluded; Google LLC is certified under the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Please note: if a recording contains personal data of other people — the voices and statements of your interviewees, for instance — you are responsible for ensuring that recording it and transmitting it is lawful. Please obtain any consent required beforehand.

Syncing via iCloud

If you use syncing, your Transcriber documents are synchronised between your devices through your own iCloud. Apple is responsible for iCloud as your provider under your own agreement with Apple; the data sits in your personal iCloud storage, not with us.

We receive no copy of your documents and no information about which documents you sync. You can turn syncing off at any time in your device settings or in the app.

Anonymous usage statistics in the app

If you have consented, we collect anonymous usage and error data in the app in order to identify and fix usability problems and technical faults.

What is recorded is technical event data only: which function of the app was used, which operating system and device type were involved, and which error occurred and when. We receive an anonymised report from it. The contents of your interviews are neither recorded nor transmitted.

This data is not passed to third parties and is not used for advertising. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG.

You can withdraw your consent at any time with effect for the future by switching the corresponding setting off in the app’s settings. The data collected is deleted automatically after one year at the latest.

Subscription and payment

The Transcriber subscription and all in-app purchases are handled exclusively through Apple’s App Store. Apple is your contractual partner for the payment and processes your payment data on its own responsibility under Apple’s privacy policy.

We receive from Apple neither your name nor your email address nor your payment details — only aggregated sales statements. That is why, in the event of a withdrawal, we ask you to attach your App Store invoice to your request: without it we cannot identify your purchase.

Managing, renewing and cancelling your subscription all happen in your Apple account settings. The details are governed by our Terms & Conditions.

Newsletter

We offer a free newsletter with news about our company, the development of our products and related subjects.

To receive it, enter your email address in the app under “Settings” → “Advanced Settings” → “Newsletter”. You will receive the newsletter only if you have consented to it. The legal basis is Art. 6(1)(a) GDPR.

We use the Mailchimp service provided by The Rocket Science Group LLC d/b/a Mailchimp, 405 N. Angier Ave. NE, Atlanta, GA 30308, USA, to send it. A data processing agreement under Art. 28 GDPR is in place with that provider; transfers to the United States are covered by the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses.

You can unsubscribe at any time. Every issue contains instructions for unsubscribing, and you can additionally withdraw your consent at any time by turning off the switch under “Advanced Settings”. Your email address is removed from the distribution list once you withdraw.

Support requests and contact by email

If you write to us, we process your message and your sender address solely to handle your enquiry. You are not obliged to provide personal data in your request, and you may contact us under a pseudonym at any time.

If you send a support request from within the app, the email will contain some technical information about your device and your Transcriber version that helps us resolve technical issues. You may delete that information from the email before sending it; please note that we may then be unable to help you with technical questions.

The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries and otherwise our legitimate interest in answering enquiries under Art. 6(1)(f) GDPR.

We keep support requests for up to 120 days after your request has been dealt with, in order to confirm that it was resolved successfully and to understand which problems occurred previously if you contact us again. They are deleted afterwards, unless statutory retention obligations require otherwise.

Disclosure of data

In principle, your personal data is not passed on without your explicit prior consent. The following cases are the exceptions:

• Disclosure to law-enforcement authorities and, where applicable, harmed third parties, where necessary to investigate unlawful use of our services or for prosecution. This requires specific indications of unlawful or abusive behaviour.
• Disclosure in order to enforce our terms of use or other agreements.
• Information provided to certain public bodies where we are legally required to do so, for example law-enforcement authorities, authorities pursuing administrative offences subject to fines, and the tax authorities.
• Disclosure to the processors we use, each of which is named by name in this policy.

Depending on the case, the legal basis is our legitimate interest in fighting abuse, prosecuting criminal offences and securing, asserting and enforcing claims under Art. 6(1)(f) GDPR, or a legal obligation under Art. 6(1)(c) GDPR.

We select our processors with care and review them at regular intervals. They may use the data only for the purposes we specify, and are contractually obliged to process it solely in accordance with this policy and applicable data protection law.

In the course of developing our business, the structure of Binaries Lab UG (haftungsbeschränkt) may change — by altering the legal form, or by founding, acquiring or selling subsidiaries or parts of the company. In such a transaction, customer information would be transferred together with the part of the business concerned. We will ensure this takes place in compliance with this policy and the relevant data protection laws.

Erasure and retention

We erase or anonymise your personal data as soon as we no longer need it for the purposes set out above. The specific periods are stated in the relevant sections.

After those periods, the data is deleted, unless it is needed for longer due to statutory retention obligations, for criminal prosecution, or to secure, assert or enforce legal claims. In such a case the data is blocked and is no longer available for further use.

No automated decision-making, no profiling

We do not use any automated processes to reach a decision about you, and we carry out no profiling within the meaning of Art. 22 GDPR.

Change of purpose

Processing of your personal data for purposes other than those described takes place only to the extent permitted by law, or where you have consented to the changed purpose. Before any further processing for purposes other than those for which the data was originally collected, we will inform you of those other purposes and provide you with all other relevant information.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). Contact legal@binarieslab.com to exercise any of them.

You may withdraw any consent you have given at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.

Please note: we keep no user account and no copy of your interviews. The audio file transmitted during a transcription is deleted immediately after processing, so by the time a request reaches us there is normally no data left for us to report on or erase. Your stored interviews sit with you alone — on your device and in your iCloud.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Changes to this policy

We update this policy whenever the processing described here changes. If a change concerns website services that require your consent, the consent banner is shown again. If it concerns the app, we will tell you in the app.

The current version is available at any time at https://transcriber.binarieslab.com/privacy.