Customer privacy notice

Contact details

If you have questions about this notice, or want to exercise your data protection rights, you can email [email protected].

What information we collect and why

For the website, waitlist, and customer communication, SubSmith only collects a small amount of personal information:

• Email address (and optionally your name) – so I can:
  • send you a one-off update you asked for (for example, joining a waitlist);
  • send account access details and subscription confirmations; and
  • reply to support questions.
• Advertising attribution data – when you arrive from a paid ad, the site may record the ad click identifier, campaign, keyword, match type, device category, referring page, and an anonymous handoff identifier. This is used to understand whether SubSmith's own ads lead to a download, trial, or purchase. New handoff and download attribution records expire after 180 days.
• Pseudonymous app diagnostic data – when the desktop app first launches, it sends a randomly generated installation identifier, the app version, and the operating-system family (for example, Windows, macOS, or Linux). This is used to understand whether downloaded installers open successfully and to diagnose release or setup problems. The record is retained for up to 180 days. It does not contain your name, email address, hardware or device identifiers, advertising click identifiers, filenames, media, transcripts, or subtitles.

I don't sell your personal data, build cross-site advertising profiles, or use this data to advertise other companies' products.

Local processing by default

SubSmith is built to process your media locally on your computer. When you load a video or audio file, transcription happens on your device using Whisper models; your media files are not uploaded to any server operated by me.

• Your media files stay on your machine.
• Transcripts and subtitles are stored locally by the app until you delete them.

Lawful bases and your rights

Under UK data protection law, there must be a "lawful basis" for using your personal information. For the activities described on this page, I mainly rely on:

• Consent – when you ask for updates (for example, by joining a waitlist or requesting information) and I email you in response.
• Contract or legitimate interests – when it's necessary to set up your account, process subscriptions, respond to support requests, measure whether the installer opens successfully, or diagnose release and setup problems so the service can be operated and improved. App diagnostics are limited to the pseudonymous fields described above.

Regardless of the lawful basis, you have rights over your personal information, including the right to access it, correct it if it's wrong, and in some cases delete it or object to how it's used. You can also withdraw consent at any time where consent was the basis.

Who your information is shared with

I use a small number of trusted service providers to run the website, process payments, and send emails. These organisations either act as data processors (handling information on my behalf) or as independent service providers with their own privacy responsibilities.

• Cloudflare – hosting and analytics.Hosts the website via Cloudflare Pages, receives form submissions (like waitlist sign-ups), and provides privacy-focused web analytics. Cloudflare may also process technical logs to keep their service secure and reliable.
• Railway – API and database hosting.Hosts the SubSmith API and stores the limited account, subscription, attribution, and app diagnostic records described in this notice.
• Resend – transactional email service.Sends emails such as account updates, login links, and support replies. Your email address is used only to send the specific messages you requested or need for using the app.
• Stripe – payment provider.Processes your payment details (if you subscribe) and handles fraud prevention. I receive limited information from Stripe, such as your email and basic transaction details, so I can manage your subscription and provide support. Your full card details are not stored by me.
• Google Ads – advertising measurement.Receives limited click and conversion information so I can measure whether SubSmith's own advertising leads to downloads, trials, or purchases. Raw media, transcripts, and subtitle content are never shared with Google Ads.

International transfers

Some of the service providers used by SubSmith – including Cloudflare (website hosting), Railway (API and database hosting), Stripe (payments), Resend (email), and Google (advertising measurement) – are based outside the UK or store data on servers located outside the UK, including in the United States.

When personal information is transferred outside the UK, these providers use standard contractual safeguards or similar mechanisms required under UK data protection law (for example, the UK International Data Transfer Agreement or equivalent protections in their data processing terms).

Website analytics

The website uses Cloudflare Web Analytics to understand which pages are visited and how people discover SubSmith. This setup is privacy-focused and does not use tracking cookies.

• No marketing cookies, pixel-based ad tracking, or cross-site profiling.
• Paid-ad attribution is based on first-party URL parameters and server-side event records.
• Data is used in aggregate to decide what to improve on the site and in the product.

Open-source components

SubSmith is built on top of several important open-source projects. Full license and acknowledgement details are available on our acknowledgements page.

• Whisper by OpenAI
• FFmpeg

View full open-source acknowledgements →