Privacy and security
At TapeNote privacy is not an add-on, it is the starting point. That is why the desktop app works without an account and without internet, and the cloud is something you switch on yourself.
Local by default
Without signing in, the desktop app makes no network connection at all. Recording, transcribing, editing and exporting happen on your own PC. We measured it: signed out, the app opened zero connections.
The cloud only if you want it
- TapeNote Cloud only works once you sign in and switch on sync. Signing out makes the app fully local again.
- Uploading audio is off by default. Switch it on, for everything or per recording, and the app asks for confirmation first.
- Your sign-in is stored encrypted on your PC by Windows (DPAPI). The app has no password field.
Data in the EU
Your account, transcripts and uploaded audio are stored in the EU region Frankfurt. AI summaries and server transcription are processed in the EU too.
Isolated per workspace
Each workspace is isolated inside the database itself with row-level security. Even if something goes wrong in the web app, the database does not hand out data from another workspace. We test those rules automatically, including tests that must fail when a rule is missing.
Sharing on your terms
- A share link shows one transcript and nothing else. Revoke it with one click, or let it expire.
- An AI summary only appears on a share page if the owner switches that on for the link.
- Irreversible actions, such as deleting for good, uploading audio or transferring ownership, ask for an extra confirmation and go into an audit log.
No training on your data
We do not use your audio or transcripts to train AI models. The AI summary runs on Claude through AWS Bedrock in the EU; AWS does not use that input for training either.
Deleted means deleted
- The trash keeps items for 30 days; after that they are gone for good.
- Deleting your account wipes all your data in the cloud, and your share links stop working immediately.
- Log files never contain transcript text or audio.
Sub-processors
For the cloud we work with these companies. To be fair: they are American companies. That is why we choose the EU region with each of them and sign a data processing agreement with standard contractual clauses (SCCs). So we say "data stored in the EU", not "no American companies".
| Company | What for | Which data | Where |
|---|---|---|---|
| Supabase Supabase Inc. (US) | Database, sign-in and file storage | Account, transcripts, uploaded audio, waitlist | EU (Frankfurt) |
| Vercel Vercel Inc. (US) | Hosting of website and web app | Requests to the site and web app | Functions in the EU (Frankfurt), static files through a global network |
| AWS Bedrock Coming soonAmazon Web Services (US) | AI summaries with Claude | Transcript text for a summary | EU (Frankfurt), EU inference |
| RunPod Coming soonRunPod Inc. (US) | GPU for server transcription | Uploaded audio for server transcription | EU data centre |
| Postmark ActiveCampaign LLC (US) | Transactional e-mail | E-mail address and mail content (sign-in links, confirmations), never transcripts | Sends from the US |
The desktop app without an account uses none of these. If the list changes, we update it here and e-mail cloud users in advance.
And this website?
- No cookies, no analytics, no tracking pixels. Fonts and images come from our own server, not from Google or another network.
- Strict security headers, including a Content Security Policy and HSTS.