Privacy Policy

Effective date: September 25, 2026
Last updated: October 13, 2026

This policy explains what personal data HiText (the iOS and Android app for transcribing audio and video), its website trytiro.app and the web version of HiText at app.trytiro.app process, why, for how long, who helps us do it and what rights you have. We have tried to keep it short and plain. If you use HiText Business, the plan for professionals, its own privacy policy (in Spanish) also applies.

1. Who is responsible

The data controller is Roberto Díaz Badra, a self-employed professional trading as Disruptive Normality.

Contact for anything related to privacy: disruptivenormality@gmail.com

We have not appointed a data protection officer.

2. The short version

In the app you can use HiText without giving your name or email: it uses an anonymous ID. If you want, you can create an account or sign in with your email, Apple or Google (for now, on iPhone and iPad) to use the same account and the same Pro on the web. If you do, we process your email and, if Apple or Google share them, your name and profile photo, and your ID becomes linked to your account.
In the web version (app.trytiro.app) you need an account: with your email and a password, or with your Google or Apple account.
Your audio and video files are used only to create your transcription and are deleted from our servers once they are processed, and in any case within 7 days.
Your transcriptions, translations, summaries and documents are stored on our servers so you can see them in the app and on the web, until you delete them or ask us to.
We use AI providers (Replicate, OpenAI, Google Vertex AI and Deepgram) to transcribe, separate speakers, summarize and draft documents. We do not use your content to train AI models and we do not sell your data.
Payments in the app are handled by Apple or Google, and on the web by Stripe. We never see your card details.
On the web, analytics and ad measurement are only switched on if you accept them in the cookie notice (section 10).

3. What data we process

Content you send us

Audio you record with the microphone (only after you allow microphone access).
Audio and video files you upload, import or share with HiText, and links to videos you ask us to transcribe.
The results we create for you: transcription (with turns separated by speaker, if you use that feature), detected language, translation, summary, title, documents generated from templates and study materials such as flashcards and quizzes.
What you add yourself: speaker names, your own templates and projects.

This content may include personal data about you or other people (for example, voices or names mentioned in a recording). You decide what to send. If you record other people, you are responsible for telling them and, where the law requires it, getting their consent.

App and device data

A user ID created by Firebase Authentication (anonymous if you don't sign in).
Device and app information: device model, operating system, app version, language, country or region and time zone.
Usage events: for example, when you open the app, start a transcription, see a subscription screen or use a feature.
Crash reports and diagnostic logs (for example, the state of the app when an error happened).
A push notification token, if you allow notifications.

Your email, your account ID, how you sign in (email and password, Google or Apple), whether you verified your email, and the dates you signed up and last signed in. If you sign in with Google or Apple, they give us your email and, if they share it, your name (and, with Google, your profile photo). If you choose to hide your email with Apple, we receive an Apple relay address. Your password is handled by Firebase Authentication and we never see it. Your user ID becomes linked to your account, and RevenueCat receives your email to link your subscription to it (section 5).
How you use your account: minutes transcribed, whether you have already used the free recording with speakers, the number of documents generated, and your plan.
So that the free recording with speakers can only be used once per person, we keep a scrambled summary (a hash) of your normalized email. It can't be turned back into your email, but it lets us check whether the free recording was already used.
If you answer the question "What do you record?" when you sign up (for example, interviews, minutes or classes), your answer. It is optional, and we use it to suggest the template that fits and to understand what HiText is used for.
Your preferences, such as language and whether you want an email when a transcription is ready.

If you accept ad measurement (section 10), when you sign up we store how you reached the website: campaign parameters (utm), the Google Ads click ID (gclid, gbraid or wbraid), the keyword, the ad group and the match type, the landing page and the referring website.

Purchases

In the app: your subscription status, the product, trial and renewal dates, and a purchase ID. Payment is processed by Apple or Google; we never receive or store your card details.
On the web: payment is processed by Stripe. Stripe gives us the plan, the amount, the trial, payment and renewal dates, the subscription status, your country and billing address (to apply the right taxes) and the invoices, but never your full card number. Stripe processes your payment data as our processor to take the payment and, for its own purposes such as fraud prevention and its legal obligations, as an independent controller.

Feedback you send us

Answers to in-app surveys, feature votes, comments and the emails you write to us.

4. Why we use it and our legal basis

To provide HiText (uploading, transcribing, separating speakers, translating, summarizing, generating documents and delivering the results in the app and on the web; managing your account and its free allowances; charging and syncing your subscription; letting you know by notification or email that your transcription is ready): performance of our contract with you (Article 6(1)(b) GDPR).
To send you push notifications (the notice that your transcription is ready and, from time to time, reminders about your trial or subscription and HiText offers): your consent, given through your device's notification permission. You can turn them off at any time in your device settings. You can turn off email notices in the web settings.
To keep HiText working and secure (crash reports, diagnostics, abuse prevention, and the scrambled email summary that stops the free recording from being repeated with new accounts): our legitimate interest in offering a reliable and secure service (Article 6(1)(f) GDPR).
To understand how the app is used and improve it (in-app product analytics, tests of subscription screens, your answer to "What do you record?", your feedback): our legitimate interest in improving HiText. We send analytics tools your user ID (which, if you have an account, is linked to it), never your name or email. You can object at any time by writing to us.
Analytics on trytiro.app and app.trytiro.app: your consent (Article 6(1)(a) GDPR; see section 10).
Ad measurement (knowing whether a visit that came from a Google ad ended in a sign-up or a purchase, and storing where your visit came from): your consent (see section 10).
App campaign measurement: if you came to HiText from a Google ad, Firebase Analytics tells Google Ads, without your name or email, whether the app was installed or a subscription was started, so we know which ads work. We do not use your data to show you personalized ads. Basis: our legitimate interest in measuring our campaigns (Article 6(1)(f) GDPR); you can object by writing to us.
To meet legal obligations (for example, tax and accounting rules, such as issuing and keeping invoices, or responding to requests from authorities): legal obligation (Article 6(1)(c) GDPR).

We do not sell your data, we do not show you ads inside HiText, and we do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you.

5. Who helps us (service providers)

We only share data with the providers we need to make HiText work. They process data on our behalf under data processing agreements and may only use it to provide their service to us.

Google Firebase and Google Cloud (Google Ireland Limited and Google LLC): sign-in (anonymous, or with email, Google or Apple), database, file storage, server functions, push notifications, remote configuration, Firebase Analytics and Crashlytics. Servers in the European Union and the United States.
Replicate: runs the Whisper speech recognition model that transcribes your audio. United States.
Google Vertex AI (Google): transcription with speaker separation using Gemini models, in the European Union multi-region.
Deepgram (Deepgram, Inc.): back-up transcription with speakers and transcription of long files, through its European Union endpoint and with the option not to use the data to improve its models.
OpenAI: language detection, translation, summaries, documents, flashcards and quizzes. United States.
Firecrawl: fetches the audio track when you ask us to transcribe a video link. United States.
YouTube (Google): when you paste a YouTube link, the app asks YouTube directly for the video's details (for example, its length); YouTube receives the link and your device's IP address.
RevenueCat: manages subscription status for the app and the web, so your plan works in both with the same account. It receives your user ID and, if you sign in, your email. United States.
Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., United States): processes web payments, trials, renewals, taxes, invoices and the portal where you manage your subscription.
Resend (Plus Five Five, Inc.): sends the emails letting you know a transcription is ready. It receives your email and the file name, never the text of the transcription. United States.
Superwall: shows the app's subscription screens and measures how they perform. United States.
Amplitude: product analytics (in the app; on the web, only with your consent). United States.
Google Analytics 4 and Google Ads (Google): on the web, analytics and ad measurement, only with your consent; in the app, the campaign measurement described in section 4.
Apple and Google: distribution on the App Store and Google Play, in-app payments and Sign in with Apple or Google. They act as independent controllers; see their privacy policies.

We may also disclose data to public authorities when the law requires it (for example, the Spanish Tax Agency), to advisers bound by confidentiality, or to protect our rights or the safety of users.

6. AI processing

To transcribe your audio we send it to Replicate, which runs the open-source Whisper model. When you use transcription with speakers, the audio is processed with Google Vertex AI (Gemini models) and, as a back-up or for long files, with Deepgram. To detect the language, translate, summarize, draft documents and create study materials we send OpenAI a short sample of the audio or the text of your transcription. These providers process the content only to return the result to us; under their business terms, they do not use it to train their models. We do not use your content to train AI models either.

Speaker separation tells the voices apart within each recording; it does not create voiceprints or identify people across recordings. You name the speakers yourself.

AI transcriptions, summaries and documents can contain mistakes. Check important results before relying on them.

7. How long we keep data

Uploaded audio and video files: deleted automatically from our servers when the transcription finishes. If something goes wrong, an automatic rule deletes them within 7 days (10 days for audio fetched from a video link).
Transcriptions, translations, summaries, documents and study materials: stored on our servers, linked to your ID or account, for as long as you choose to keep them. When you delete a transcription in the app, it is also deleted from our servers (from app version 1.0.97). We do not delete them for inactivity: they are kept until you delete them or email us to ask us to (see section 9).
Your account: for as long as you have it, until you delete it or ask us to.
Scrambled email summary for the free recording: kept even if you delete your account, only to stop the free recording from being repeated.
Subscription data (app or web, including web invoices): while the subscription is active and then for as long as needed for accounting, tax and possible claims (generally up to 6 years under Spanish law).
Visit source: in your account, for as long as you have it or until you withdraw your consent. Analytics data (Google Analytics 4, Firebase Analytics and Amplitude): up to 14 months. Crash reports (Crashlytics): up to 90 days. After that it is deleted or anonymized.
Feedback and emails: as long as needed to reply to you and improve HiText.

Our providers may keep data for short periods under their own policies (for example, to prevent abuse) and then delete it.

8. International transfers

Several providers are in the United States, so your data may be transferred outside the European Economic Area. When that happens, transfers rely on the EU-US Data Privacy Framework where the provider has joined it (such as Google, Stripe or Amplitude) and, otherwise, on the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

9. Your rights

You can ask us to access, correct or delete your data, restrict or object to its processing, and receive it in a portable format. Where processing is based on your consent, you can withdraw it at any time without affecting earlier processing.

To exercise your rights, write to disruptivenormality@gmail.com, from your account's email if you have an account. If you use the app without an account, we may ask for details that help us find your data (for example, the approximate date and title of a transcription, or your App Store or Google Play receipt). We will reply within one month.

Deleting your account: for now this is done by email: write to us from your account's email and we will delete your account, your email, your transcriptions and your documents, as well as your email in RevenueCat and the Amplitude analytics events linked to your ID. We only keep what the law requires or section 7 explains: invoices and Stripe payment records, and the scrambled email summary for the free recording. Deleting your account does not cancel any subscription: if you have an active web subscription, cancel it first in Settings → Subscription (afterwards you won't be able to sign in to do it); if you have it on the App Store or Google Play, cancel it there.

If you are not happy with our reply, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority in your country.

10. Cookies and storage on trytiro.app and app.trytiro.app

You don't need to give us any personal data to visit trytiro.app; to use the web version (app.trytiro.app) you need an account (see section 3). In the European Economic Area, the United Kingdom and Switzerland we ask you in a notice before switching on anything that is not necessary, and Accept and Reject carry the same weight. We use three categories:

Necessary (always on)

The website doesn't work without them, so they don't need consent. They don't track you and are not used for advertising.

Your cookie choice (for example, dl_consent), stored in your browser so we don't ask on every visit.
Your preferred language and, on the landing page, the campaign parameters of the current visit (dl_session_utm, in the browser's session storage, which is cleared when you close the tab) so the sign-up button can pass them on to the web app.
Your signed-in session on app.trytiro.app (Firebase Authentication, in the browser's local storage), until you sign out.
Stripe: when you pay or manage your subscription, you do it on Stripe pages, which use their own necessary cookies to process the payment and prevent fraud.

Analytics (only if you accept)

Tells us how many people visit the website, which pages they see and which features they use, so we can improve it.

Google Analytics 4: the _ga and _ga_XXXX cookies (a code for our Analytics property), which last up to 2 years.
Amplitude (on app.trytiro.app): cookies or local storage starting with AMP_, for up to 1 year. It is not loaded without your consent.
dl_attr: our own cookie that remembers how you reached the website (for example, the campaign or the referring website), for 90 days.

Ad measurement (only if you accept)

We advertise HiText on Google. This category lets us know whether a visit that came from an ad ended in a sign-up or a purchase, so we only spend on the ads that work. We do not use your data to show you personalized ads and we do not sell it.

Google Ads: if you accept, we enable ad storage (ad_storage) and sending user data to Google for measurement (ad_user_data). Google sets conversion measurement cookies such as _gcl_au and _gcl_aw, which last up to 90 days, and when you sign up we store where your visit came from in your account (section 3). On the landing page, the ad click ID of the current visit is kept in the browser's session storage (dl_session_click, cleared when you close the tab) so the sign-up button can pass it on to the web app.
If you don't accept, Google Ads sets no cookies and receives no user data. To measure in aggregate, without cookies, the ad click ID may be carried from one page of our website to another inside the address (URL) (the url_passthrough feature of Google's consent mode).

You can change your choice at any time with the "Cookies" or "Cookie settings" link at the bottom of every page, or by deleting cookies in your browser. If you withdraw your consent, we delete the dl_attr cookie and stop sending data to these tools.

11. Children

HiText is intended for people aged 16 or over. We do not knowingly collect data from children under 16. If you believe a child under 16 has used HiText, write to us and we will delete their data.

12. Security

We use encrypted connections, encryption of stored data, per-user access rules and signed requests between the app, the web and our servers, and we limit how long files are kept. No system is completely secure, but we work to protect your data and, if there were a breach, we would tell you and the authorities where the law requires it.

13. Changes to this policy

We may update this policy when HiText or the law changes. We will publish the new version here with its date and, if the changes are significant, we will also let you know in the app, on the website or by email.

14. Contact

Roberto Díaz Badra – Disruptive Normality
Email: disruptivenormality@gmail.com