Privacy policy
Effective 30 July 2026
Sourcevine has not been released yet. Today this website does one thing: it collects an email address from people who want to be told when the app is available. The sections about the app describe what will happen once it ships, so you can decide before you sign up.
1. Who is responsible
Sourcevine is the product described on this site. We are the controller of the personal data described below. You can reach us at any time at [email protected].
2. What this website collects
If you submit the early-access form, we process the email address you typed in. That is the only field the form has. We use it for exactly one purpose: to email you when the app becomes available. We do not sell it, rent it, or add it to an advertising audience.
We also count anonymous product-analytics events (for example, that the early-access form was submitted) using PostHog. Those events include the email address you submitted, because the submission event is what we are counting. They carry no cookie and no device identifier — see section 5.
If you email us instead, we receive whatever you put in that message, including the name on your email account.
3. What the app will collect when it ships
We do not ask for your name. An account is identified by your email address, and only these categories of data exist:
- Account data — your email address and the date you created the account. Passwords are never stored by us; sign-in is handled by our authentication provider (see section 4).
- Audio you record — a voice recording is uploaded so it can be turned into text. Once the transcript exists, the audio file is transient and is not kept as part of your idea.
- The content you submit — your transcripts, the analysis reports generated from them, the findings and sources those reports cite, and any to-do items you create. This is your material; we do not publish it and we do not use it to train models.
- Credit and purchase records — how many analysis runs you have, and a record of any top-up you bought, so a balance can be shown and a failed run refunded.
- A push-notification token — a device identifier issued by your phone's operating system, so we can tell you when an analysis has finished. Tokens that stop being used are pruned.
4. Third-party services that process data
We use the following providers. Each one is listed with what it actually handles.
| Service | What it processes |
|---|---|
| Supabase | Our database and authentication. Stores your account record, transcripts, reports, to-do items and credit balance, and manages sign-in credentials and sessions. |
| Supabase Storage | Holds uploaded audio recordings and generated report artifacts as files. |
| NestJS | The framework our own backend application is written in. It handles your requests on our servers; it is software we run, not a company we send data to. |
| OpenRouter | Runs the speech-to-text and analysis models. Receives the audio you record and the transcript text to be analysed, and returns the transcript and report content. |
| BullMQ | The job queue that runs analyses in the background on our own infrastructure. Holds the identifiers and text of a pending analysis job until it completes. |
| Custom credit gateway | Our own code, running on our own servers, that reserves a run before an analysis starts, charges it on success and refunds it on failure. It processes your credit balance and an audit record of every change. |
| RevenueCat | Handles in-app purchases of credit packs and reports the result to us. Processes purchase and subscription events tied to your account. |
| Firebase Cloud Messaging | Delivers push notifications to your device. Receives your device push token and the notification text ("your analysis is ready"). |
| Coolify | The deployment platform we use to run the above on our own virtual private server. It hosts the environment your data lives in. |
PostHog processes the product-analytics events described in sections 2 and 5.
5. Cookies and storage on your device
This website sets no cookies. It writes nothing to local storage or session storage, and it loads no advertising, retargeting or social tracking scripts. Analytics events are sent without any identifier that persists on your device, so we cannot follow you between visits or across other sites.
Because nothing non-essential is stored on your device, there is no consent banner to click. Being exempt from asking for consent is not an exemption from telling you, which is why this section exists even though the list is empty.
When the app ships, signing in will require one strictly necessary session credential, set by our authentication provider so that you stay logged in. That is the only device-side storage we plan, it exists solely to keep your session, and it is never used for tracking or advertising. If that ever changes — if we add anything non-essential — this section will list it and we will ask for consent before it loads.
6. Why we are allowed to process this
- Your consent, for the early-access email. You can withdraw it at any time and we will delete the address.
- Performing our contract with you, for running the app: transcribing what you record, producing reports, keeping your credit balance correct.
- Our legitimate interest, for anonymous, cookieless counts of how the site and app are used, and for keeping the service secure.
7. How long we keep it
- Early-access emails: until the app launches and we have sent that one message, or until you ask us to delete the address — whichever comes first.
- Audio recordings: only as long as needed to produce the transcript.
- Your transcripts, reports and to-do items: until you delete them or close your account.
- Purchase and credit records: as long as required for accounting and refund obligations.
- Push tokens: pruned once a device stops checking in.
8. Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email [email protected] and we will respond within 30 days. If you are in the EEA or UK, you also have the right to complain to your local data-protection authority.
9. Children
This product is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us information, email us and we will remove it.
10. International transfers
Some of the providers listed in section 4 process data outside your country, including in the United States. Where that happens we rely on the transfer safeguards those providers offer, such as standard contractual clauses.
11. Changes to this policy
If we change how we handle your data we will update this page and the effective date at the top. If the change is significant and we have your email address, we will tell you directly.
12. Contact
Questions, requests or complaints: [email protected].