Privacy policy
Effective 30 July 2026
Sourcevine is live. This policy covers both this website — which collects an email address from people who want product updates — and the app itself, described below.
1. Who is responsible
Sourcevine is the product described on this site. We are the controller of the personal data described below. You can reach us at any time at [email protected].
2. What this website collects
If you submit the email form on this site, we process the email address you typed in. That is the only field the form has. We use it for exactly one purpose: to send you product updates. We do not sell it, rent it, or add it to an advertising audience.
We also count anonymous product-analytics events (for example, that the early-access form was submitted) using PostHog. Those events include the email address you submitted, because the submission event is what we are counting. They carry no cookie and no device identifier — see section 5.
If you email us instead, we receive whatever you put in that message, including the name on your email account.
3. What the app collects
We do not ask for your name. An account is identified by your email address, and only these categories of data exist:
- Account data — your email address and the date you created the account. Passwords are never stored by us; sign-in is handled by our authentication provider (see section 4).
- Audio you record — a voice recording is uploaded so it can be turned into text. Once the transcript exists, the audio file is transient and is not kept as part of your idea.
- The content you submit — your transcripts, the analysis reports generated from them, the findings and sources those reports cite, and any to-do items you create. This is your material; we do not publish it.
- Credit and purchase records — how many analysis runs you have, and a record of any top-up you bought, so a balance can be shown and a failed run refunded.
Push notifications are not available yet. If we add them, we will describe what they collect here before they go live.
4. Third-party services that process data
An external processor is a company outside us that receives your data. We use two:
| Service | What it processes |
|---|---|
| OpenRouter | Runs the speech-to-text and analysis models. Receives the audio you record and the transcript text to be analysed, and returns the transcript and report content. |
| RevenueCat | Handles in-app purchases of credit packs and reports the result to us. Processes purchase and subscription events tied to your account. |
Everything else — our database, our authentication, the queue that runs analyses in the background, the code that tracks your credit balance, and the server all of it runs on — is infrastructure we operate ourselves, on our own virtual private server. No third party receives your data through it, including the audio and report files, which stay on that server.
PostHog processes the product-analytics events described in sections 2 and 5.
5. Cookies and storage on your device
This website sets no cookies. It writes nothing to local storage or session storage, and it loads no advertising, retargeting or social tracking scripts. Analytics events are sent without any identifier that persists on your device, so we cannot follow you between visits or across other sites.
Because nothing non-essential is stored on your device, there is no consent banner to click. Being exempt from asking for consent is not an exemption from telling you, which is why this section exists even though the list is empty.
Signing in requires one strictly necessary session credential, set by our authentication provider so that you stay logged in. That is the only device-side storage the app uses, it exists solely to keep your session, and it is never used for tracking or advertising. If that ever changes — if we add anything non-essential — this section will list it and we will ask for consent before it loads.
6. Why we are allowed to process this
- Your consent, for the update-list email. You can withdraw it at any time and we will delete the address.
- Performing our contract with you, for running the app: transcribing what you record, producing reports, keeping your credit balance correct.
- Our legitimate interest, for anonymous, cookieless counts of how the site and app are used, and for keeping the service secure.
7. How long we keep it
- Update-list emails: until you unsubscribe or ask us to delete the address.
- Audio recordings: only as long as needed to produce the transcript.
- Your transcripts, reports and to-do items: until you delete them or close your account.
- Purchase and credit records: as long as required for accounting and refund obligations.
8. Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email [email protected] and we will respond within 30 days. If you are in the EEA or UK, you also have the right to complain to your local data-protection authority.
9. Children
This product is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us information, email us and we will remove it.
10. International transfers
Some of the providers listed in section 4 process data outside your country, including in the United States. Where that happens we rely on the transfer safeguards those providers offer, such as standard contractual clauses.
11. Changes to this policy
If we change how we handle your data we will update this page and the effective date at the top. If the change is significant and we have your email address, we will tell you directly.
12. Contact
Questions, requests or complaints: [email protected].