Privacy
Who is responsible
The BleepItOut service is responsible for the personal data described on this page (the data controller).
For any question about your data, write to support@bleepitout.com.
What we store and for how long
When you upload a file we store the upload, the audio we extract from it, the transcript and the result in a folder that belongs only to that file. The folder is deleted from our server an hour after you finish working on it, and at the latest 6 hours after upload. You can also delete it right away with the "Delete my file now" button.
When a file expires we also clear its original file name.
While a file exists we also keep a keyed hash of your device (or account) and of your network with it, only to limit how many files run at once; it is deleted with the file.
We also keep a keyed fingerprint of each upload with its file, so that the same device or account can reuse its own transcript if it uploads the same file again; it is deleted with the file.
This browser keeps the links to your files in its own storage until they expire, so you can find them again on the home page; they never leave your device.
We keep service statistics: how many files were processed, how long each step took, which language and speech provider were used and why an upload was refused. They contain no file names, transcripts, email addresses or IP addresses. To count how many different devices or accounts uploaded on a day, we keep a keyed hash of the device or account salted with that day, so different days cannot be linked. Detailed records are deleted after 90 days; only daily totals are kept.
Free daily minutes
To enforce the free daily minutes we set one random device cookie called bleep_dev. It lasts about a year and is used only for this purpose.
We also keep a keyed hash of that cookie and a keyed hash of your IP address (or of its /56 network for IPv6), both salted with the current day. These are pseudonymous, not anonymous, because we hold the key. We use them only to enforce the limits, and we delete them after 2 days.
Promo codes
A promo code is stored on our server only as a keyed hash. A code can be redeemed only after signing in with Google: its minutes then move to your account and the code stops working. Nothing about the code is kept in your browser.
Accounts (Sign in with Google)
Signing in is optional. Google signs you in: it tells BleepItOut your Google account id, your email address, whether that address is verified, and your name. BleepItOut never sees your Google password and keeps no Google token.
For an account BleepItOut stores your email address, your name, the free minutes you used today and the purchased and promo minutes on the account. Instead of your Google account id it keeps a keyed hash of it.
We keep this data to give you your daily free minutes and your purchased minutes on any device, and to prevent abuse.
The session cookie bleep_session keeps you signed in for 30 days. The short bleep_login cookie exists only for the 10 minutes of a sign-in.
You can delete your account at any time from the account menu. This deletes your email address, your name and your sessions at once. Purchased and promo minutes left on the account are lost with it: they are non-refundable and are not given back in any form. The account menu asks you to confirm this before it deletes an account that still has such minutes.
To stop repeat sign-ups, a keyed hash of your Google account id and the minutes you used today are kept until the end of that day (UTC) and then deleted.
If you choose "Email me when it launches" on the pricing page, we keep that choice with your account and use your email address once, to tell you that payments have launched. Deleting your account removes the choice.
Bot protection (Cloudflare Turnstile)
Uploads are protected by Cloudflare Turnstile, a check that tells people from bots, usually without asking you anything. When you upload a file, Cloudflare receives your IP address, your browser's TLS fingerprint, its User-Agent and the site key with the page origin, to tell people from bots.
Cloudflare states that it does not collect these signals to identify, profile or target anyone. Its Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
Traffic statistics (Cloudflare Web Analytics)
Our public pages (the home page, the guides, the sounds page, the pricing page and the legal pages, never the page of your file) load a small script from Cloudflare Web Analytics that counts page views and measures how fast the pages load.
It sets no cookies and uses no browser storage. Cloudflare states that it does not fingerprint visitors or collect their personal data, and it does not record the query strings of addresses. About the service: https://www.cloudflare.com/web-analytics/
Who receives your data
To run BleepItOut we use these service providers:
OVHcloud hosts our server in Canada. Your files, transcripts and the other data described on this page are stored there.
For free minutes, Groq (USA) recognises the speech, and ElevenLabs (USA) does it when Groq is unavailable. For paid minutes, ElevenLabs (USA) recognises the speech, and Groq (USA) does it when ElevenLabs is unavailable. Whichever of them does the work receives the audio of your file for that purpose. Groq keeps no copy of the audio after processing: zero data retention is switched on for our account.
Cloudflare (USA) runs our domain's DNS and forwards the emails you send to support@bleepitout.com to us.
Cloudflare also runs the bot check described above.
Cloudflare also counts the page views for the traffic statistics described above.
Google handles the sign-in when you use Sign in with Google, as described above.
Transfers outside the EU
Our server is in Canada, which the European Commission recognises as offering an adequate level of data protection. Some of the providers above are based in the USA or may process data there. Transfers to the USA rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep data
Files, transcripts and results: an hour after you finish working on a file, at the latest 6 hours after upload, or until you press "Delete my file now".
Keyed hashes for the free daily limits: 2 days.
Service statistics: detailed records for 90 days, then only daily totals, which contain no personal data.
Emails you send us: only as long as we need them to answer and handle your request.
Your account: until you delete it. After that only the keyed hash of your Google account id and the minutes used that day remain, until the end of that day (UTC).
No training, no selling
We do not use your uploads to train any model. We do not sell them, and we share them only with the providers named on this page, to run the service.
Groq does not use this audio to train models: its services agreement does not allow it. ElevenLabs does not use this audio to train models: training on our data is switched off in our account settings.
Why we process data and on what legal basis
To provide the service you ask for, such as processing your files. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR).
To enforce the free limits, stop abuse and bots, keep the service secure and see how it is used through statistics. The legal basis is our legitimate interest in running a free service that works and is not abused (Article 6(1)(f) GDPR). You can object to this processing.
The cookies and browser storage we use are strictly necessary for the service, so they do not need your consent.
Your account and its minutes are kept to perform the same contract.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. You can also complain to your local data protection authority, for example the AEPD (Agencia Española de Protección de Datos) in Spain.
To use these rights write to support@bleepitout.com. You can delete your account yourself from the account menu, and a file with the "Delete my file now" button. For files, we may ask for the link of your file to find your data.
Cookies
BleepItOut sets three cookies, all strictly necessary: bleep_dev for the free daily limit, bleep_session to keep you signed in, and bleep_login only during a sign-in with Google. Your theme choice, the links to your recent files and your changes in the editor are kept only in this browser's own storage. We use no analytics or advertising cookies.
Age
BleepItOut is meant for adults. See the terms of use for details.