Privacy Policy

Scribe0 (“the app”) is provided by Linus Asaabey (“we”, “us”, “our”). This policy explains what the app does with your data across all its versions: iOS, Android, macOS, Windows, and web. It is written to align with the Australian Privacy Principles (APP) under the Privacy Act 1988 (Cth).

Using the iPhone app from the App Store? It has its own, simpler policy at scribe0.com/privacy/ios, which is the one that applies to it.

Scribe0 is a dictation and documentation aid for clinicians. It transcribes speech to text on your device and can rewrite that text using an AI model. It is not a medical device and does not provide diagnosis or treatment advice.

The short version

• Your audio never leaves your device. Speech-to-text runs entirely on-device (on the Apple Neural Engine on Apple hardware; on the CPU on Android and Windows). We never receive, store, or transmit your recordings.
• No account is required, and there is no advertising or cross-app tracking. Every app works without a login. If you purchase an optional Pro plan, we hold only your account key, the email used at purchase, and the device identifiers using the key (see “Accounts and plans”). We do not collect your contacts, location, or device advertising identifiers.
• Transcripts are stored only on your device, never on our servers. See “Transcripts and related notes” for how each platform protects them at rest.
• Text leaves your device only when you run an AI “Enhance”, and only the transcript text and your prompt, never the audio. On mobile this is off until you first use it, behind an explicit one-time consent.
• The one thing we do collect: when you use the built-in (free) enhance, our service logs anonymous usage metadata (an anonymous per-install identifier, a one-way hashed IP address, and token/model counts) to meter free usage and prevent abuse. We never log or store the transcript text itself.

What data the app handles

Audio recordings

Captured from your microphone solely to produce a transcript. Transcription is performed on-device; audio is held in memory only for the duration of processing and is then discarded. Audio is never written to long-term storage and is never transmitted off the device.

Transcripts and related notes

The text the app produces, plus any AI-enhanced version, is stored locally on your device using the platform’s on-device database (SwiftData on Apple platforms; an encrypted SQLite/Room database on Android; a local SQLite database in your user profile on Windows; local storage on the web). This text can contain personal and health information (for example, patient names, identifiers, and clinical details). At-rest protection differs by platform: Apple devices encrypt files with device file-level encryption; Android additionally encrypts the database itself with SQLCipher; on Windows the database is protected by your user account permissions, and by full-disk encryption where your PC has BitLocker / device encryption enabled (we recommend enabling it on clinical machines). You can optionally enable a biometric app lock (Face ID / Touch ID on iOS; fingerprint / face / PIN on Android). We do not have access to this local data.

AI enhancement

You can apply an AI “Enhance” step to a transcript. Depending on the platform and your settings, this runs one of two ways:

• On-device enhancement processes your text entirely on the device. Nothing is transmitted. This is available on supported Apple hardware (Apple Foundation Models) and on Windows PCs with a capable graphics card (a local Qwen3 model, enabled only after the app verifies your GPU can run it).

• Cloud enhancement sends your transcript text and the prompt over an encrypted (HTTPS/TLS) connection to an AI service to generate the enhanced text. No audio is ever sent. On mobile, cloud enhancement is opt-in: the first time you use it you must accept an explicit disclosure.

  By default, cloud enhancement is routed through our own sovereign proxy running in Australia, which forwards your text to Anthropic’s Claude models running on AWS Bedrock in Australian regions and returns the result. Our proxy processes your text only to fulfil the request; it does not log or store the transcript content, and neither AWS Bedrock nor Anthropic stores it or uses it to train models. The in-app permission dialog names the service before the first transcript is sent. You may instead configure your own API key and endpoint (see “API keys”), in which case your text goes directly to the service you configure.

  Important: transcript text sent for cloud enhancement is not redacted before sending. Do not use cloud enhancement for content you would not be permitted to send to a third-party AI service under your own obligations.

Usage metering (built-in enhance)

So that the built-in enhance can be offered free without a login, and to prevent abuse, each cloud-enhance request through our proxy records a small amount of anonymous metadata:

• an anonymous per-install identifier, a random value generated on your device, not derived from any hardware ID, and reset if you reinstall;
• a one-way hashed IP address (we cannot recover the original IP from it);
• the AI model used and token counts for the request, a timestamp, and whether the request succeeded.

This metadata is stored in our analytics database, hosted on Supabase in Sydney, Australia. It is used only to meter free usage, prevent abuse, and understand aggregate load. It is not linked to your identity (there is none), not used for advertising, and it never includes your transcript or enhanced text. If you supply your own API key, the same request metadata is recorded against that key instead of the anonymous identifier.

Model downloads and app updates

On first use, the apps download the on-device speech model (and, if you enable speaker labelling or on-device drafting, those models too) from our content-delivery network (downloads.scribe0.com); on Windows some model files are fetched from their public hosts (Hugging Face, GitHub) instead. These are ordinary file downloads: no personal data, transcript, or audio is sent; as with any download, the server receives your device’s IP address to serve the file.

The Windows and macOS apps also check downloads.scribe0.com for app updates at launch, which is likewise an ordinary HTTPS request carrying no personal data. The Microsoft Store edition of the Windows app is installed and updated by the Store instead, under Microsoft’s own terms.

Accounts and plans

The built-in cloud enhance works without any account on the free plan (a limited number of enhances per day, metered by the anonymous per-install identifier). If you purchase a Pro plan, you sign in with an account key. To operate the service we associate that key with the email address used at purchase and with the anonymous identifiers of the devices using it, solely to verify the plan and enforce its device limit. Payments are handled by our payment processor (Stripe); we never see your card details.

API keys

If you configure your own cloud enhancement key (AWS Bedrock, or on some platforms OpenRouter), it is stored in the platform’s secure key store: the iOS Keychain on Apple platforms, the Android Keystore (EncryptedSharedPreferences) on Android, or the Windows Credential Manager on Windows. It is sent only to the corresponding service to authenticate your requests. We never receive keys you supply.

Third parties (sub-processors)

We keep the data footprint minimal. The services that may process data on our behalf are:

Each service processes data only to provide its function, under its own terms and privacy policy, and each provides privacy and security protections for your data that are equal to or stronger than those described in this policy: all transfers are TLS encrypted, AWS Bedrock does not store prompts or outputs after processing and does not use them to train models, and Anthropic’s commercial terms exclude API inputs and outputs from model training. If data residency matters to you (for example, to keep data in Australia), use the default AWS Bedrock (AU) path rather than configuring OpenRouter.

What we do not collect

We do not collect or transmit: your audio, device advertising identifiers, location, contacts, browsing or search history, photos, or the contents of your transcripts (beyond the opt-in cloud processing described above, which is never stored). Outside an optional Pro purchase we hold no identity details at all. We do not use your data for advertising, cross-app tracking, or training AI models. The apps contain no third-party analytics or advertising SDKs.

How long data is kept

Transcripts remain on your device until you delete them (in the app’s History) or uninstall the app. On iOS and Android, uninstalling removes all local app data. On Windows, uninstalling can leave transcripts, settings, and downloaded model files behind in your user profile (the Scribe0 folders under your profile and its AppData): delete transcripts in the app first, or remove those folders, if you want everything gone. We hold no copy of your transcripts. The anonymous usage metadata described above is retained for service metering and abuse prevention; free-plan quota counters expire within 48 hours. Pro account records (the key, purchase email, device bindings, and usage metadata) are kept while the account is active and deleted on request. Text sent through the built-in cloud enhancement is processed transiently and not retained by us, AWS Bedrock, or Anthropic; requests you route via your own OpenRouter key are handled per that provider’s retention policy.

Security

• On-device transcription, so audio never traverses the network.
• Local data encrypted at rest with device file protection on Apple platforms and Android (plus SQLCipher on Android); on Windows, protection comes from account permissions and BitLocker / device encryption where enabled.
• Optional biometric app lock (iOS and Android).
• API keys you supply stored in the platform secure key store (Keychain, Android Keystore, Windows Credential Manager).
• All network requests use HTTPS/TLS.

Children

Scribe0 is intended for use by healthcare professionals and is not directed at children.

Your rights

Your transcripts and notes are stored locally on your device, so you control them directly: you can view, export (share), or delete them within the app at any time. The usage metadata we hold for free-plan use is anonymous and not linked to you. For Pro account records (key, purchase email, device bindings), you can request access, correction, or deletion by contacting us at the address below. If you have questions about this policy or how your data is handled, contact us the same way.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected by the “Last updated” date above and published at this URL.

Contact

Linus Asaabey Email: privacy@scribe0.com