D-REC Privacy Policy

Knight AI+AV LLC. Effective September 3, 2026. Updated October 27, 2026.

The short version. D-REC records and transcribes on your device. Your audio and your transcripts stay on your devices, and D-REC never receives them. If you create an account, the account holds your email address and your plan. Everything else it touches is listed below, in full.

What stays on your device

Recordings, transcripts, chapter titles and recaps are created and stored on the device you use. On iPhone, speech recognition and summaries run with Apple's on-device models. On the web, transcription runs inside the browser page with a local engine when you install it or, when you have not, through your browser's own speech recognizer, which D-REC uses only when it runs on this device; the ENGINE control names which one is active. D-REC operates no server that receives audio or transcripts.

The first time you record on iPhone, iOS asks you to allow Speech Recognition, with Apple's standard note about sending speech to Apple; every app that uses speech recognition gets that same note. D-REC asks iOS to recognize speech on the device only. Where your iPhone has no on-device model for your language, D-REC records the audio without a transcript and sends it nowhere.

What an account holds

Accounts are optional. Free use needs no account. If you sign in with Apple, with Google (offered on the website only), or with an email address, we store: your email address, a sign-in identifier, the date the account was created, your plan (trial, free or Pro) with its dates, and, for each device you sign in on, its platform (such as iPhone or Windows) and when it was last used. Nothing about what you record is ever sent to the account service.

D-REC can also leave a note on your account, such as Pro given as a gift. The account keeps the note's words, the date it stops showing if it has one, and when you saw it. The app asks for new notes when it checks your plan, and sends only your sign-in with that request. Download my account data includes them, and deleting the account deletes them.

Two more things exist for a practical reason and are named here rather than left out. When you sign in on the Mac or Windows app, we keep a hash of that computer's hardware ID and which kind of computer it is (a Mac or a Windows PC), never its name or anything else that describes it: it lets a one-time licence be tied to one computer at a time, so that "move my licence off which machine?" has an answer. And when you ask for a six-digit sign-in code by email, the request’s network address is kept for up to a day so the same address cannot spray codes at other people’s inboxes. It is deleted within twenty-four hours and is used for nothing else.

Payments

On the web, payments are processed by Stripe; we receive a customer identifier and subscription status, never your card number. On iPhone, payments are processed by Apple through the App Store; we receive a signed transaction that we verify against Apple's certificate to confirm your subscription. In the Android app, payments are processed by Google Play; we receive the purchase token Google Play gives the app, and our server asks Google Play about that purchase (its state, its order number, when it ends and whether it was refunded) and keeps the answer with your account. D-REC never sees a card. Google Play's billing library in the Android app also tells Google how a purchase went, under Google's own policy. A plan bought in any of these places unlocks D-REC Pro everywhere you sign in.

What we do not do

• No advertising identifiers, no third-party tracking SDKs, no analytics company of any kind. The only counts D-REC keeps are the two described below, and one switch turns both off.
• No use of your speech to train models, build profiles or target advertising.
• No sale or sharing of personal data.

Network requests the app makes

The app reads one small version file from its own website to learn whether an update exists; that request carries no ID, account or recording. The desktop apps downloaded from drec.live also ask GitHub, where their installers are published, whether a newer version exists, shortly after launch and every six hours after that, and download it by themselves when one does; that check carries nothing you recorded. The copy from the Microsoft Store leaves its updates to the Store.

To transcribe on your device, D-REC first downloads the engine that does it and keeps it there. On the web, in the desktop apps and on Android, the engine's code comes from jsDelivr and its speech, speaker and sound models come from Hugging Face. On iPhone, the models that tell one speaker from another come from Hugging Face the first time a take is read for voices. These are downloads to your device and nothing you record goes with them, but like any download they reach those services' servers, which receive the request and your internet address as any website does.

In the Mac App Store app and the iPad app, CONTROL FROM APPLE WATCH in Settings is off until you switch it on. When it is on, your Apple Watch and that Mac or iPad pass the Watch's presses (record, stop, play, mark, a place to move to) and what the Mac or iPad is doing (recording or playing, the position and length, and the colors of its colorway) through your own iCloud account, in Apple's CloudKit private database. Every one of these records is encrypted end to end with keys kept in your iCloud Keychain, so the maker cannot read them, and none of them carries audio, a transcript or a recording's name. Switching it off deletes that device's record.

If you choose to send a note to the maker from the help panel, what it carries is described under “If you write to us” below. If you sign in, the app talks to the D-REC account service and to the identity provider you chose. The counts are described next.

These requests happen whether or not the counts are on: update checks, engine and model downloads, the current prices and, when you use them, sign-in and plan checks, purchases, notes you send and the check for answers to them. The switch described below covers the counts only.

The counts we keep

Once a day, if it is open, D-REC tells its own server that a copy was used. That message carries three things and nothing else: a random id this copy made for itself, which platform it is (web, iPhone, iPad, Android, Mac or Windows), and which version. There is no audio in it, no transcript, no take, no filename, no title, no account, no email and no session. The row it writes holds no account, email or name, and D-REC never joins it to an account.

The id is random and holds nothing about your machine, so it is not a fingerprint: two copies on one computer count twice, and the same person on a laptop and a phone counts twice. Because a copy sends the same id each day, D-REC can tell how many copies are in use, which versions they run, and whether a copy is used again after its first day, week and month. The id is never used to follow you across other apps or websites. Earlier versions of D-REC began that id with the time the copy was first opened. Turning the counts off deletes the id, and a copy that is switched back on makes a new one.

There is a second count on the same switch, and it works the same way. The FIRST time a copy of D-REC does one of these things, it writes one more row naming only which of them happened: starts a take, exports, sees the plans, signs in, opens the checkout, begins a trial, uses the production tools, or opens music mode. And when D-REC asks whether you would rate it, it writes which way that went: that it asked, that you said you like it, that you went on to rate it, that you said not really, or that you chose to write to the maker instead. It never learns the rating itself. Once each, ever, per copy. The row carries the same random id and the platform and nothing else: no version, no audio, no words, no filename, no title, no account and no email. It exists so the maker can see where people stop. Like the daily count, it holds no account, email or name, and D-REC never joins it to an account.

To switch it off, open the gear panel and turn off OPTIONAL USAGE COUNTS under ABOUT. It takes effect immediately, and the copy forgets its id. Counts already sent stay, under that id.

If you write to us

The app has a panel for reporting a bug or sending a note, and one optional line, “What would make it worth it?”, on the plans card and on the card that ends a free recording at ten minutes. Those are the places you can hand us something on purpose. When you send a note from the panel, we keep what you typed, whatever contact you chose to put in the box (you can leave it empty and still get a reference number), the kind of report, and a short technical context that helps reproduce the fault: the app version, the platform, which transcription engine was running, the colorway, the window size, the diagnostics line and your browser's user agent string. That is all of it. There is no audio in it, no transcript, no take, no filename and no title. We do not keep the address your computer connected from: it is used for a moment to stop anyone flooding the panel, and never written down. A line sent from one of those two cards carries only what you typed, the app version, the platform and which card it came from, and it is asked for once.

Each note you send from the panel gets a reference, and the app keeps the references of the notes sent from it, on the device. With a reference you can read the answer and add to the note later. Now and then the app asks D-REC support whether one of those notes has a new answer, sending only its reference. If you put an email address in the box, the answer is also sent to that address once a person has written it, and nothing else is ever sent to it.

We keep it until it is deleted by hand, because a report you sent months ago is often the thing that explains a bug today. Ask us at the address below and we will delete yours.

Deleting your D-REC account and data

Deleting a session in the app deletes its transcript and, on iPhone, its audio file. On iPhone, recordings are kept out of iCloud and computer backups, and from version 2.5.3 the transcripts and settings are too, so the phone is the only copy. On Android, D-REC takes no part in the phone's backup or in moving to a new phone. Export what you want to keep before you change phones.

You can delete your account from the account panel at any time. That removes the account record, its sign-ins and its licence seat at once, cancels a subscription bought on the website, and ends the plan. A subscription bought on the iPhone is cancelled in the iPhone's own Settings, because Apple holds it. A subscription bought in the Android app is managed in Google Play; when you delete your account, D-REC also asks Google Play to stop it renewing. Stripe, Apple and Google keep their own record of a payment, because the law on payments and tax requires it.

If you have uninstalled D-REC or cannot open the app: email build@knightaiav.com with the subject “Delete my D-REC account”. Send the request from the email address on your D-REC account, or tell us that address so we can verify that it belongs to you. Do not send a password or a sign-in code. Knight AI+AV LLC will answer within thirty days and remove the account and associated sign-in and licence records after verifying the request. You do not need to reinstall the app.

To delete a support report or feedback without deleting your account: email the same address with the subject “Delete my D-REC report” and its reference number, or enough information to identify the note you sent. We will verify the request and delete that report and its attached technical context. Usage counts do not contain an account or email address, so an account deletion cannot identify those separate rows. Audio and transcripts stay on your device; remove those in the app or clear the app's local data. Payment providers retain any records they are legally required to keep under their own retention policies.

Your rights

You can see, download, correct or delete what an account holds. In the account panel, Download my account data gives you all of it as a file, and Delete account removes it. For anything else, a correction, a question, or an objection to how something is used, write to the address below and we answer within thirty days. If you are in the European Union or the United Kingdom, you can also complain to your data protection authority. We do not sell or share personal data, so there is nothing to opt out of, and we treat everyone the same whichever right they use.

Where the GDPR applies, the reasons are these. The account and its plan are the service you asked for. The counts, the day-long record that stops sign-in codes being sprayed at other people, and the notes you send are our legitimate interest in knowing how many people use D-REC, which versions they run, whether they come back and where they stop, keeping the door safe and fixing faults, and each is built to hold as little as that needs. Payment records are kept because the law requires it.

Where it runs, and who helps

The account service and its database run on Railway, in its Amsterdam region in the European Union. The website, including the small version file the app reads, is served from Railway's regions in the United States and the European Union. Railway is a company in the United States, certified to the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, which cover any personal data it handles there. Everything between the app and the account service travels encrypted, the database lets each account read only its own rows, and it is backed up every day.

A few other companies each do one job, and each receives only what that job needs. Stripe takes payments on the website. Apple takes them on the iPhone and runs Sign in with Apple. Google runs its sign-in button on the website, and Google Play takes payments in the Android app. Resend delivers D-REC's email: the six-digit sign-in code, purchase, trial, payment and refund notices, notes sent to support and the answers to them. It receives the address each email goes to and what that email says. Each keeps its own records under its own policy. These four are in the United States, so a payment, a sign-in or a code may be handled there. Stripe and Google are certified to the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Apple says in its privacy policy that it uses the European Commission's standard contractual clauses for personal data from the European Union, the United Kingdom and Switzerland. Resend handles D-REC's email under the standard contractual clauses in its data processing terms, which also cover the United Kingdom and Switzerland.

How long things are kept

An account is kept until you delete it. A sign-in code, and the network address that asked for one, are gone within twenty-four hours, and old sign-ins are cleared away as new ones are made. Count rows are deleted 12 months after a copy's last count. Each holds only the random id, the platform, the version or the event, and the day. A note you send is kept as described above.

Do Not Track, and changes to this policy

D-REC does not follow you across other websites, so a browser's Do Not Track signal has nothing to switch off here; the counts follow the OPTIONAL USAGE COUNTS switch. When this policy changes, the Updated date at the top changes with it, and a change to what D-REC collects is named in the release notes of the version that makes it.

Children

D-REC is a production tool and is not directed at children under 13.

Contact

Knight AI+AV LLC, 2108 N St Ste N, Sacramento, CA 95816, United States, build@knightaiav.com.