Privacy Policy

SpokenLeaf is operated by Infinite Source Agency Inc. (“we”, “us”, or “our”), a company based in Ontario, Canada. For additional contact details, see infinitesource.agency. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar laws, we are the “data controller” for the limited account-related data described below.

If you have any question about this policy or your data, contact us at support@spokenleaf.com.

SpokenLeaf is built to be local-first. Understanding two places is the key to this whole policy:

SpokenLeaf is not end-to-end encrypted, and we don't claim to be. Data is encrypted in transit and at rest by the services we use, but this is not zero-knowledge encryption.

If you create an account, the only personal data we hold on our servers is:

• Account & sign-in — your email address and authentication details, managed by our authentication provider (Supabase Auth).
• Plan & billing status — your subscription tier and status, and billing identifiers held by our payments provider (Stripe). We do not store your full card number; Stripe handles payment details.
• Transcription usage — the number of transcription minutes you've used, so we can apply your plan's limits. This is a count of minutes, not the content of what you transcribed.

We never store your notes, recordings, tasks, folders, or images on our servers.

If you use SpokenLeaf without an account (local-only mode), we store no personal data about you on our servers at all.

The following never reaches our servers and is never collected by us. It lives on your device until you delete it or clear your browser:

• The content of your notes and task lists
• Your folders and their organization
• Your recordings and their audio
• Images you attach to notes
• App preferences (such as theme, selected microphone, and interface settings)

You are in control of this data. You can export it at any time (as JSON, on any plan) and delete it from your device whenever you like.

Some SpokenLeaf features use third-party AI processors. These features are optional and always initiated by you. If you never use them, none of the data below leaves your device.

These AI paths are not end-to-end encrypted — the processors must be able to read the data in order to process it and return a result. We show a short, contextual note at each AI touchpoint before you use it.

We use a small set of reputable service providers (subprocessors) to run SpokenLeaf. Each processes data only as needed to provide their service:

• Supabase — account authentication and the database that stores your account, plan, and usage data.
• Stripe — payment processing and subscription billing.
• AssemblyAI — audio transcription (only when you transcribe).
• Perplexity — AI insights and task extraction over text (only when you use those features).
• Sentry — error monitoring and session replay, to diagnose crashes and bugs.
• Vercel — hosting and delivery of the application.

We will update this list as our providers change. If we launch native mobile apps in the future, any app-store billing providers we use at that time will be disclosed here.

SpokenLeaf uses cookies and in-browser storage only for functional purposes — never for third-party advertising or cross-site tracking:

• Authentication & session cookies (Supabase) to keep you signed in.
• Payment & fraud-prevention data used by Stripe during checkout and billing.
• Error-monitoring data used by Sentry to diagnose issues.
• On-device app data (in-browser storage) that holds your notes and preferences on your device. This is functional storage, not tracking.

We do not sell your data and we do not run third-party ad tracking.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases to process the limited account data described above:

• Contract — to provide the service you sign up for (account, plan, transcription usage limits).
• Consent — when you choose to use an optional AI feature that sends data to a processor.
• Legitimate interests — to keep the service secure and reliable (for example, error monitoring), balanced against your rights.
• Legal obligation — to keep records we are required to keep (for example, billing records).

We keep your account, plan, and transcription-usage data for as long as your account is active. When you delete your account, we delete this server-side data and cancel any active subscription. Audio sent to AssemblyAI is auto-deleted after about a day; text sent to Perplexity is not retained. Limited billing records may be kept where required by law.

Data stored on your device stays there until you delete it, clear your browser, or delete your account.

Our service providers may process the limited account data described above in countries outside your own, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) offered by these providers under their data processing terms.

SpokenLeaf is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

We use reputable providers with strong security practices, and data is encrypted in transit and at rest by those providers. No system is perfectly secure, and SpokenLeaf is not end-to-end encrypted. For a copy of your notes that you control, use export or Pro cloud backup.

We may update this policy from time to time. When we make material changes, we'll update the “Last updated” date above and, where appropriate, notify you in the app.

Questions, requests, or concerns about your privacy? Email us at support@spokenleaf.com. The Service is operated by Infinite Source Agency Inc.; for additional contact details, see infinitesource.agency.