Privacy policy

Last updated: 4 November 2026

WhatScribe is a browser extension for WhatsApp Web that turns voice messages and videos into text. This policy explains what data is processed when you use the extension and this website, why, and what your rights are. The short version: audio is only sent when you ask, nothing you transcribe is stored on our servers, files are stored only if you turn on uploads and then for 7 days at most, and there are no ads or analytics.

Who is responsible

WhatScribe is run from Sweden and is responsible for your personal data. You can reach us at privacy@whatscribe.app.

Audio and transcripts

• WhatScribe does nothing with a message until you click WhatScribe (or CC on a video). Only the message you click is processed.
• When you click, the extension sends that message's audio (for videos, only the audio track) to the WhatScribe API, which runs on Cloudflare Workers. The API passes it to ElevenLabs, our transcription provider, and returns the text with word timings to your browser.
• The WhatScribe API stores neither the audio nor the transcript. ElevenLabs processes the audio to produce the transcript under its own terms and data processing terms.
• Transcripts are cached locally in your browser (IndexedDB) so that reopening one is instant. They stay on your device and you can clear them at any time from the extension popup. Uninstalling the extension also removes them.

Other people's voices

Voice messages and videos often contain other people's voices and personal data. You are responsible for having the right to transcribe the messages you choose to transcribe. WhatScribe processes them only on your instruction and only to show you the text.

Copying messages

You can select messages in a chat and copy them as text. The extension reads the messages you select. Their text goes to your clipboard and their files to your computer's download folder, without passing through our servers. Voice messages and videos are transcribed as described above, using your minutes.

Files you choose to upload

Uploading is off by default. If you turn on "Upload selected files for links" in the extension, the images, videos, audio and documents in the messages you select are sent to the WhatScribe API and stored with Cloudflare, so that an AI tool or anyone else you give a link to can open them. That can include personal data, also about other people, and you are responsible for having the right to upload it.

• Anyone with a link can open the file, without signing in. Links are long and can't be guessed, but treat them like the file itself: whoever you or your AI tool pass one on to can open it.
• Files are deleted automatically after 7 days, and their links stop working then. Ask us if you need one deleted sooner.
• We store each file with its name (a number, such as "003.jpg"), its expiry date and your account id. We don't look at the files except when needed to deal with abuse or a legal obligation.

The launch waitlist

If you join the waitlist on this website, the WhatScribe API stores your email address and when you joined. We use it only to tell you once when WhatScribe launches, and we delete the list after that. You can ask us to remove you at any time. The legal basis is your consent, which you can withdraw by writing to us.

Your account and usage

You sign in with your email address and a 6-digit code. To run your account and count minutes, the WhatScribe API stores:

• your email address;
• a SHA-256 hash of each sign-in code and of each session token (never the code or token itself);
• your plan and subscription status (for example, trial, Pro or Max, active or cancelled), and your Stripe customer and subscription ids;
• the number of minutes you have used in the current period;
• how many files you have uploaded in the current period, if you use uploads;
• how many of your transcriptions timed out today, and whether your account has been stopped from transcribing for abuse.

We do not store your name, your phone number, your contacts or the text of your messages, and we store files from your messages only if you turn on uploads. Sign-in codes are delivered by email through Resend.

Payments

Subscriptions are bought through Stripe's checkout, where Link acts as the seller (merchant of record) and Stripe processes the payment. They collect your email address and payment details and handle billing, taxes and receipts. Their own privacy policies, Stripe's and Link's, apply to that data. We never see your card details. We can see your subscriptions in Stripe's dashboard to provide support.

No analytics, no ads

The extension and this website contain no analytics, no advertising and no tracking cookies, and we do not sell or share your data for marketing. The extension uses the open-source WA-JS library to read the message you click; its built-in analytics are turned off.

Service providers

• Cloudflare: hosts the WhatScribe API and this website, and stores files you upload.
• ElevenLabs: transcribes the audio you send.
• Resend: delivers the sign-in codes to your email.
• Stripe and Link: checkout, payments, taxes and receipts, as merchant of record.

Some of these providers process data outside the EU/EEA. Where they do, the transfer is covered by safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Legal basis

We process this data to provide the service you asked for (performance of a contract, GDPR article 6(1)(b)) and, for preventing abuse and keeping costs under control, on the basis of our legitimate interests (article 6(1)(f)).

How long we keep data

Audio and transcripts are not kept by us at all. Files you choose to upload are deleted after 7 days. Your email, plan status, subscription ids and minute and file upload counts are kept while your account exists. Timeout counts are deleted after about two days. Ask us to delete your account and we delete them within 30 days. Sign-in codes are deleted once used or no longer valid, within two days of being sent. Stripe and Link keep their own payment records under their own policies.

Your rights

Under the GDPR you have the right to access, correct and delete your personal data, to restrict or object to its processing, and to data portability. Email privacy@whatscribe.app from the address you signed in with to use these rights. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the supervisory authority where you live.

Changes

If this policy changes, we will update the date at the top of this page, and tell you in the extension if the change is significant.