Privacy Policy

DariScript (“we”, “our”, or “us”) operates a subtitle transcription platform focused on Moroccan Darija content. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

1. Information We Collect

We collect the following information when you use DariScript:

• Account data — your name, email address, and profile picture, provided through Google OAuth via Supabase.
• Usage data — number of videos processed and total transcription minutes used, tracked for plan enforcement.
• Audio files — uploaded temporarily for transcription processing only. They are deleted immediately after processing completes.
• Transcripts — the generated subtitle text (.srt, .vtt and .ass) is saved to your account history so you can re-download or restyle it at any time. You can delete individual transcripts from your dashboard.
• Video files — if you upload a video, the audio track is extracted in your browser and only that audio is sent to us. Your video file never leaves your device.
• Corrections and vocabulary — when you fix a word in the review step, we store the original word, your correction, and the model's confidence for that word. These build a private vocabulary for your account so the same mistake is less likely next time. You can view and delete every learned term from your dashboard.
• Anti-abuse data — to stop people creating endless free accounts, we keep a keyed hash (HMAC-SHA256, with a secret only our server holds) of the network you signed up and transcribed from — never the IP address itself — and of your normalised email address. When something is blocked we log the reason with those hashes. See Data Retention for how long.
• Cookies — only the sign-in cookies needed to keep you logged in. There are no advertising or analytics cookies.

We do not collect payment details directly. Payments are handled by our Merchant of Record provider (Lemon Squeezy).

2. How We Use Your Information

We use your information to:

• Authenticate your account and maintain your session.
• Track subscription usage against your plan limits.
• Process transcription requests via the OpenAI API.
• Build a private vocabulary for your account from the corrections you make, so recurring names and terms are transcribed correctly next time. This is used only for your own transcriptions unless you switch on sharing (see below).
• Improve service reliability and performance.

Shared Darija dictionary (opt-in)

Moroccan Darija has no standard spelling, and speech models make predictable mistakes with it. If — and only if — you switch on “Help improve Darija for everyone” in your dashboard, the individual word pairs you correct (for example gadi → ghadi) may be counted towards a shared dictionary that improves results for all users. The same setting also publishes your vocabulary — the list of spellings you have told DariScript are correct — so that other people's transcripts use those spellings too.

• This setting is off by default.
• Only the word pair is used — never the surrounding transcript, never your audio, and never anything that identifies you.
• A word pair is only ever considered for the shared dictionary after several different users have made the same correction independently, and every pair is reviewed by a person before it is used.
• Published vocabulary is only used for other people once several different users have published the same term, and even then it is only a hint to the speech model — it never rewrites anyone else's words. It is only a word: it carries no context and nothing identifying you.
• Turning the setting off stops your corrections being counted and makes your vocabulary private again immediately. It cannot change transcripts other people have already produced.

Uploaded audio files are passed directly to the OpenAI API for speech-to-text processing and are deleted from our infrastructure immediately after processing completes. Generated transcript text is stored in your account so you can re-download it from your history. You can delete any transcript at any time from your dashboard.

3. Third-Party Services

We use the following third-party providers to operate DariScript. Each may process limited data necessary to perform their function:

• Supabase — authentication, user database and temporary audio storage.
• Vercel — hosting of the website and application.
• Cloudflare Turnstile — a bot check when you sign in, if enabled.
• OpenAI — speech-to-text processing of uploaded audio. Audio is sent to OpenAI's API and subject to their Privacy Policy.
• Lemon Squeezy — our merchant of record: it takes payments, issues invoices and handles tax for paid subscriptions. We never see your card details.

4. Data Retention

• Audio — deleted as soon as its transcription finishes or fails. An upload that never gets transcribed (for example, you closed the tab) is deleted by a daily clean-up.
• Transcripts, corrections and vocabulary — kept until you delete them or delete your account.
• Job records (progress of a transcription) — 30 days.
• After you delete your account — for 30 days we keep only a keyed hash of your email and your usage counters for the current month, so deleting and signing up again doesn't reset the free plan. No content, no email address.
• Network hashes (including a per-network count of free transcriptions) — removed after 31 days. Block records — 90 days. Rate-limit counters — 48 hours.
• Account and plan data — while your account exists. Payment and invoice records are kept by Lemon Squeezy as tax law requires.

5. Your Rights

Under Moroccan Law 09-08 on the protection of personal data — and the GDPR, if you are in the European Union — you have the right to access, correct, and delete your personal data, and to object to its processing. You can exercise the main ones yourself, at any time, from Dashboard → Account:

• Download my data — a copy of your transcripts, corrections, vocabulary and plan details, as a JSON file.
• Delete my account — permanently deletes your account and everything attached to it (apart from the 30-day anti-abuse record described above), and cancels any active subscription first so you are not charged again.

For anything else, email ilyass@acture.co; we reply within 30 days. If you are not satisfied with our answer, you can contact Morocco's data protection authority, the CNDP (cndp.ma), or your local authority in the EU.

6. Security

We implement reasonable technical and organizational measures to protect your data. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Jurisdiction

This service is operated from Morocco. Our providers (listed in section 3) process data on servers outside Morocco, including in the European Union and the United States. We only use providers that commit to protecting the data they process for us.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date above. Continued use of the service after changes constitutes acceptance.

Questions? Contact us at ilyass@acture.co.