Privacy Policy

1Who processes your data

The service is operated by Artem Chuikin, an individual seller based in Serbia, trading as TranscriptOut, reachable at support@transcriptout.com. Where data protection law gives you a right against a controller, that is who you exercise it against.

Purchases are a separate matter: Paddle is the merchant of record and therefore the seller on your invoice, with its own company details and address printed there. What Paddle collects to take the payment, it collects as its own controller.

2What we collect

Five kinds of data, each for a stated reason:

• Account. There are two ways in and they hand over different amounts. Signing in with Google gives us your name, email address, profile picture URL and a user id. Signing in with a one-time link emailed to you gives us the address and a user id, and nothing else. No name, no picture. Either way we use it to identify your account, address you in the interface and contact you about the service.
• API keys. A key is generated once and shown to you once. We store only its SHA-256 hash, together with a label you choose and its creation date. The key itself is not recoverable from what we keep, not by you and not by us.
• Usage records. Every API call is logged: timestamp, endpoint, HTTP method, status code, credits charged, how long it took, a request id, and the resource you asked about, whether a video, channel or playlist id or a search query. This is what the Logs page shows you, and it is what lets us answer "why was I charged for this call".
• Credits. Your balance across its three buckets (the free signup grant, your plan’s monthly allowance and any top-ups bought outright), and a ledger of every grant, charge and refund.
• Site analytics. Google Analytics tells us which pages people read and where they arrive from: pages visited, the referrer, an approximate location derived from the IP address, device and browser, and an identifier stored in your browser so a returning visit is recognized as one. It is about pages, not about accounts. We never send it your name, your email or your account id, so what it holds is not joined up with who you are here. Cloudflare Web Analytics measures the same kind of thing for the site and stores nothing in your browser to do it: it reports the page address, the referrer and how quickly the page loaded, with an approximate location, device and browser derived from the request itself. It keeps no identifier, so a second visit is not tied to the first.

Our web server also records the usual request metadata (IP address, user agent, the URL requested) for a short period, to keep the service available and to investigate abuse.

3What we do not collect

• No advertising, and no advertising pixel. Nothing here feeds an ad network.
• No session recorder. We do not replay what you did on a page, and we do not record keystrokes or mouse movement.
• No selling, and no sharing for anyone else’s marketing.
• No card details. Payments are taken by Paddle on their own checkout. A full card number never reaches our servers. What comes back to us is that a payment succeeded and what it was for.
• No password. Neither way in uses one. Google authenticates you, or a one-time link does, so your account never has a password for us to store or leak.

4Cookies and browser storage

Two things are stored in your browser. Your sign-in session, written for the parent domain so that one sign-in works across the dashboard and the other subdomains. And Google Analytics’ own identifier, which is what lets it count a returning visitor once rather than twice. Nothing is stored for advertising.

The analytics identifier can be refused, and nothing on the site depends on it: any browser setting or extension that blocks third-party analytics stops it, and Google publishes an opt-out add-on of its own.

Cloudflare’s site measurement adds nothing to that list. It writes no cookie and keeps no identifier at all, which is also why it cannot tell a returning visitor from a new one.

That cookie is deliberately not HttpOnly: the browser has to read the token to attach it to API requests. The practical consequence is the same exposure as browser storage (a script running on any of our subdomains could read it), which is the price of a single sign-in shared across hosts. In local development the session lives in localStorage instead, because a parent-domain cookie is rejected on localhost.

5Who else touches the data

We keep the list of processors short, and it is:

• Supabase hosts the authentication service and the database in which accounts, key hashes and the credit ledger live.
• Google Analytics measures how the site is used. It receives page addresses, referrers and the technical details listed above, and never anything that names your account. Google processes it under its own terms and may store it outside your country.
• Paddle takes the payments and is the merchant of record for every sale. They hold the card details and the billing address we never see, and they issue the invoice. What they collect is theirs and is covered by their own privacy notice. We pass them your account id so that a completed payment can be matched to the right balance.
• Cloudflare provides the network our service is delivered through and the site measurement described above. Because the connection is terminated on their network before it reaches our server, a request to the API is visible to them: the calling address, the headers it carries, including the key that authorizes it, and the video, channel or playlist being asked about. They process this under their own terms and operate from the United States.
• Our hosting provider runs the servers the API and website are served from.
• Proxy providers pass API requests to YouTube. They see the video, channel or playlist identifiers being requested. They receive nothing that identifies your account.
• Google/YouTube is the source of the transcripts and metadata. We fetch public content from them. We do not send them anything about you.

We do not sell personal data, and we do not share it with anyone for their own marketing.

6How long we keep it

Account data, key hashes and the credit ledger are kept while your account exists. Request logs (the per-call rows the Logs page shows, including the video ids and search queries in them) are deleted after 30 days. The daily usage counters built from them survive 90. They hold call counts and credits by endpoint, and nothing about what was asked for.

Transcripts we have fetched are cached so that the same video does not have to be pulled twice. That cache holds public YouTube content keyed by video id, not by who asked for it.

7Your rights

• See it. Your profile, balance, keys and full request history are visible in the dashboard at any time.
• Correct it. If you signed in with Google, your name and picture come from there, and changing them there changes them here. If you signed in by emailed link, there is nothing to correct: the address is all we hold.
• Delete it. Settings → Delete account removes your account, its API keys, its credit ledger, its request log and its usage counters. It takes effect immediately and cannot be undone. If anything about that fails, write to support@transcriptout.com and we will finish it by hand.
• Export it. Ask at the same address and we will send you what we hold in a machine-readable form.

Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to a data protection authority.

8Security

API keys are stored as hashes, never in plain text. Traffic is served over TLS. Revoking a key takes effect immediately, across every server.

If you find a vulnerability, please write to security@transcriptout.com before disclosing it publicly. We will respond and we will not pursue researchers who act in good faith.

9Children

The service is intended for developers and is not directed at children. We do not knowingly create accounts for anyone under 16.

10Changes to this policy

If we change how we handle your data, we update this page and the date at the top of it. For changes that materially affect you, we will also email the address on your account.

11Contact

Questions about this policy, or about the data we hold on you: support@transcriptout.com. Security reports: security@transcriptout.com.