Privacy Policy

Last Updated: June 25, 2026

1. Introduction

Lecsy (“the App”) is built for international students who attend English-language lectures. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

2. How Your Data Flows

The short version

The audio file (.m4a) Lecsy records stays on your iPhone and is never stored by Lecsy. For cloud transcription, audio is sent to our speech-to-text provider to be transcribed and is not saved to your account or kept on our servers. When the live stream can't be used (offline recordings, or if live transcription drops), the recording may be sent once through Lecsy's secure processing endpoint to that provider and is likewise not stored. Transcript text is saved on your device and, when you are signed in, synced to our database for cross-device access. AI features send only the transcript text (never audio) to OpenAI when you tap the button.

How the live audio is turned into transcript text depends on your plan:

Free plan — Premium AI intro (3 hours, up to 8): every new user gets the first 3 hours of English transcription on Premium AI (high accuracy, live captions), and can unlock 5 more hours (8 total) by joining the Pro waitlist in the app. During this intro, the live audio stream is sent over an encrypted TLS connection to our speech-to-text engine and is never stored by Lecsy.
Free plan — after the 3-hour intro: transcription switches to fully on-device English using WhisperKit (tiny.en). The audio never leaves your iPhone in this mode.
Pro (and organization plans): the live audio stream is sent over an encrypted TLS connection to our speech-to-text engine for real-time English transcription and is never stored by Lecsy. Lecsy itself never stores your audio on its servers.

Data	Your Device	Lecsy Server	Speech-to-text	OpenAI	Condition
Audio live stream — Free 3-hour Premium AI intro	Yes	Never	Yes (not stored by Lecsy)	Never	Streamed to our speech-to-text engine only while recording, during your first 3 hours of Premium AI.
Audio live stream — Free (after 3 h intro)	Yes	Never	Never	Never	On-device English transcription (WhisperKit tiny.en). Audio never leaves your iPhone.
Audio live stream — Pro	Yes	Never	Yes (not stored by Lecsy)	Never	Streamed to our speech-to-text engine only while recording.
Audio (.m4a file)	Yes	Transit only*	Cloud transcription only*	Never	Stays on your device. *For cloud transcription (including offline or failed-live recordings), the file is sent once to our speech-to-text provider via Lecsy and then discarded — never stored.
Transcript text	Yes	Yes	—	No	Synced when signed in
AI Summary / Translation input	Yes	Yes	—	Yes	Text only, never audio; only on demand
Account info (email, name, ID)	—	Yes	—	No	Apple / Google / Magic Link sign-in
Ads / Trackers / IDFA	—	None	None	None	No ad SDKs installed; IDFA not collected

3. How Transcription Works

Free plan — 3 hours of Premium AI, then on-device fallback

Every new Free user gets 3 hours of Premium AI transcription using high-accuracy cloud transcription (English, live captions), and can unlock 5 additional hours (8 hours total) by joining the Pro waitlist in the app. During this intro, the live audio stream is sent to our speech-to-text engine over an encrypted (TLS) WebSocket connection and is never stored by Lecsy (see “Speech-to-text data handling” below). The trial balance is tracked against your account so it cannot be reset by reinstalling the app.

After the 3-hour intro is used up, the Free plan falls back to fully on-device English transcription using WhisperKit (tiny.en). In this mode the audio is never sent to Lecsy's servers, our speech-to-text engine, OpenAI, or any third party, and transcription works without an internet connection. The on-device fallback is English only.

Pro plan — Unlimited real-time cloud transcription

On Pro, and on organization-managed plans, Lecsy uses high-accuracy cloud transcription to perform real-time English speech-to-text. While you are recording, audio is streamed to our speech-to-text engine over an encrypted (TLS) WebSocket connection. Transcript text is returned within milliseconds and stored on your device. Lecsy itself never stores your audio on its servers.

Speech-to-text data handling:

Audio is processed only to produce the transcript and is not used to train speech-to-text models (per our provider's API terms).
Processed audio is never stored by Lecsy.
Lecsy uses short-lived API tokens (15-minute TTL) to authorize each session, so no permanent credentials live on your phone.
For organization customers we will negotiate a Zero Data Retention agreement with our speech-to-text provider on request.

If you are offline during the Free 3-hour intro or on Pro, the cloud-based real-time transcription is unavailable. Your local audio file is still saved, and transcription falls back to on-device English so you can still get a transcript without internet.

4. AI Summaries, Translation & Study Guides

When you tap AI Summary, Bilingual Translation, or Study Guide, the transcript text (never audio) is sent from our server to OpenAI's API (GPT-4o-mini and gpt-5-nano) to generate the result. Using these AI features saves your transcript text to your Lecsy account even if Cloud Sync is turned off, because the summary is generated server-side. OpenAI does not use API content to train its models. Lecsy does not use your data to train AI models either.

5. Information We Collect

Account Information (optional but required for cloud features)

Email address (from Apple ID or Google account)
Display name
User ID

Audio Recordings

Lecture audio recorded through the app
Local file (.m4a) stays on your device and is never stored by Lecsy. For cloud transcription, it may be sent once to our speech-to-text provider for processing and is then discarded (see Section 3).
Free plan, 3-hour Premium AI intro: the live audio stream is sent to our speech-to-text engine for real-time transcription and is never stored by Lecsy (see Section 3).
Free plan, after the 3-hour intro: the live audio stream is processed entirely on-device (WhisperKit tiny.en, English only). Audio never leaves your iPhone.
Pro plan: the live audio stream is sent to our speech-to-text engine for real-time English transcription and is never stored by Lecsy.

Transcription Text

Text returned by our speech-to-text engine during recording
Stored locally on your device
If you are signed in, text is synced to our server (Supabase) for cross-device access and backup

Usage & Diagnostic Data

Recording minutes per day / per month (for usage caps and billing)
Device type and operating system version
Crash reports and error diagnostics, sent to Sentry to keep the app reliable. These include technical details, the app version, your plan, and your account ID — never your audio or transcript text.

6. How We Use Your Information

Transcription: Users get 3 hours of Premium AI via our cloud speech-to-text engine (English), then fall back to on-device WhisperKit (English). During the free Premium AI hours, audio streams to our speech-to-text engine for real-time English transcription (never stored).
AI Features: Transcript text is sent to OpenAI when you use AI Summary, Translation, or Study Guide.
Authentication: To verify your identity and manage your account.
Data Synchronization: To sync transcript text across devices.
Service Operation: Anonymized usage data to enforce quotas and improve reliability.

7. Data Storage

On Your Device

Audio recording files (.m4a)
Transcript text and segments
App settings and preferences

On Lecsy Servers (Supabase, when signed in)

Account information (email, display name)
Transcript text (for cross-device sync and backup)
Usage logs (rate-limit and billing tracking)
Audio recordings are never stored by Lecsy

Security Measures

All data is transferred over encrypted connections (HTTPS/TLS 1.3)
Data at rest is encrypted
Row-level security ensures you can only access your own data
Short-lived (15-minute TTL) API tokens for our speech-to-text engine, never long-lived secrets in the app

8. Sub-Processors

We use the following third-party services (sub-processors) to operate Lecsy. Each is bound by their own privacy and security commitments:

Service	Purpose	Data Shared	Privacy Policy
ElevenLabs (speech-to-text)	Real-time and cloud speech-to-text	Audio for transcription (live stream, or the recording file for cloud transcription) — not stored by Lecsy	elevenlabs.io/privacy
OpenAI	AI summaries, translation, study guides	Transcript text only (no audio); on demand	openai.com/privacy
Supabase	Database, authentication, cloud sync	Account info, transcript text (no audio)	supabase.com/privacy
Stripe	Subscription billing	Email, payment method (held by Stripe)	stripe.com/privacy
Apple Sign In	User authentication	Apple ID credentials	apple.com/privacy
Google Sign In	User authentication	Google account credentials	policies.google.com/privacy
Sentry	Crash & error monitoring (to keep the app reliable)	Diagnostic/crash data, app version, your plan, and account ID (no audio, no transcript text)	sentry.io/privacy

9. Data Sharing

We do not sell, rent, or share your personal information with third parties, except in the following circumstances:

With Your Consent: When you explicitly authorize sharing
Sub-Processors: Listed in Section 8, solely to operate the Service
Legal Requirements: To comply with applicable laws or legal processes

We never share or sell your transcript text or audio data for advertising or model training.

10. AI Training

We do not use your audio, transcripts, or any other personal data to train artificial intelligence models. Our sub-processors (our speech-to-text engine, OpenAI) also commit, in their API terms, to not using your data for model training.

11. Your Rights

Right to Access

You can request access to the personal data we hold about you.

Right to Rectification

You can request correction of inaccurate data.

Right to Deletion

You can delete your account and all associated data directly from the app: Settings → Delete Account. Your cloud data is permanently deleted within 30 days, and on-device data (audio files, local transcripts) stays on your device until you remove it.

Right to Data Portability

You can request a copy of your data in a portable format.

How to Exercise Your Rights: Contact us at support@lecsy.app

12. Data Retention

On-device data (audio file, transcripts) remains until you delete it (you can also set automatic deletion at 30/90/180 days in Settings → Privacy → Delete audio after).
Cloud transcript data is retained while your account is active
Upon account deletion, all cloud data is deleted within 30 days
Audio sent to our speech-to-text engine for live transcription (during the Free 3-hour Premium AI intro and on Pro) is never stored by Lecsy. After the Free intro is used up, audio is not sent to the cloud — transcription runs entirely on-device.
Some data may be retained longer if required by law

13. Children's Privacy

Lecsy is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

14. International Data Transfers

Lecsy is operated from the United States. During the Free 3-hour Premium AI intro and on Pro, audio is briefly processed in the cloud (United States) for real-time transcription. Transcript text and account data are processed in the United States by Supabase, and by OpenAI when you use AI features. By using the Service, you consent to such transfers. Where required by law, we rely on Standard Contractual Clauses (SCCs) for cross-border transfers.

15. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the CCPA:

Right to know what personal information is collected
Right to know whether personal information is sold or disclosed
Right to opt out of the sale of personal information
Right to non-discrimination for exercising your rights

We do not sell personal information.

16. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the GDPR including access, rectification, erasure, restriction of processing, data portability, and the right to object.

Legal Basis for Processing: Consent, performance of a contract, and legitimate interests.

17. For Schools & Organizations

When Lecsy is provided to a school, university, language program, or other educational institution under a written pilot or license agreement, the following commitments apply in addition to the rest of this policy:

FERPA “school official”: Lecsy operates as a school official with a legitimate educational interest, processing student data only as directed by the institution. We do not disclose personally identifiable information from education records to third parties except as permitted by FERPA or with consent.
Lecsy never stores audio: The local .m4a file remains on the student's device. Under organization plans, the live audio stream is sent to our speech-to-text engine only during recording for real-time transcription; Lecsy itself never stores audio on its servers. On-device transcription mode is available to organization administrators on request.
Speech-to-text retention & Zero Data Retention (ZDR): Audio sent to our speech-to-text engine is never stored by Lecsy. For institutional deployments we will negotiate a Zero Data Retention agreement with our speech-to-text provider on request, so audio is discarded after transcription with no retention window.
Transcript storage: Transcript text is stored in encrypted Supabase Postgres with row-level security scoped so that only members of the institution's organization can access its data. Audio is never persisted on Lecsy infrastructure.
Student consent: Before a student records under an organization, the iOS client surfaces a FERPA-aligned consent prompt. The acknowledgement timestamp is written to the student's organization membership record so administrators can produce evidence of consent. Consent can be withdrawn by emailing the school's Lecsy administrator or privacy@lecsy.app.
No model training on student data: Neither Lecsy nor our sub-processors (our speech-to-text engine, OpenAI) use institutional audio or transcripts to train AI models, per their API terms.
Compliance documentation on request: We provide a Data Processing Addendum (DPA) with Standard Contractual Clauses for cross-border transfers, and HECVAT-Lite responses for institutional security reviews.

Institutional inquiries: support@lecsy.app.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through:

In-app notifications
Email (if you have provided one)
Updating the “Last Updated” date above

19. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: support@lecsy.app

Summary

Data	How It's Used	Where It's Stored	Shared With
Audio live (Free, 3-hour Premium AI intro)	Real-time English transcription in the cloud	Streamed to our speech-to-text engine, never stored by Lecsy	Speech-to-text engine only
Audio live (Free, after 3-hour intro)	On-device English transcription (WhisperKit tiny.en)	Your device only	No one
Audio live (Pro)	Real-time English transcription in the cloud	Streamed to our speech-to-text engine, never stored by Lecsy	Speech-to-text engine only
Audio (.m4a file)	Local backup of recording	Your device only (all plans)	No one
Transcript text	Display, search, cross-device backup	Device + cloud (if signed in)	Supabase (our cloud provider)
AI summary / translation input	Generate summaries, translations, study guides	Processed, not stored by OpenAI	OpenAI (text only, on demand)
Account info	Authentication	Cloud (Supabase)	Supabase, Apple/Google (auth)

Key Points:

✓ Your audio file (.m4a) is never uploaded — on any plan
✓ Free 3-hour Premium AI intro and Pro: live audio streams to our speech-to-text engine and is never stored by Lecsy
✓ Free after the 3-hour intro: transcription runs entirely on your iPhone (WhisperKit, English only)
✓ AI features send transcript text only (never audio), only on demand
✓ No data is sold to third parties
✓ No data is used to train AI models
✓ You can delete your data anytime

This Privacy Policy is effective as of June 25, 2026.

←Back to Home