What stays on your device, what leaves, and why

Version 1.0 · July 31, 2026 · privacy policy · governance policy (French only, for now) · terms of use

This page says where your files go. No jargon, and nothing left out. If any of it still feels unclear once you have read it, that is our fault: write to us and we will fix the wording.

1. The whole thing, in one table

2. By default, nothing leaves

No account, no card, no connection: the app works. The dated log, the evidence vault, the timeline, the deadlines, the legal information, the report preview — all of it lives in your browser's memory, on your device. We receive none of it. We cannot read it, because it is not with us.

This is not a stripped-down mode or a trial version. It is how the app normally works. Everything else is optional.

The trade-off, said plainly: what lives on a single device disappears with that device. A lost laptop, a stolen phone, a browser cleared by mistake, and your exhibits are gone. That is exactly the problem the encrypted vault (section 5) is there to solve.

3. Reading a screenshot: five free reads, then a membership

When you ask the app to read a screenshot of texts or emails, the text is pulled out inside your browser. The image does not leave. It is not sent anywhere — not to us, not to anyone else.

Because nothing leaves your device, this costs us next to nothing. So it is open to everyone, with no account and no card: five free reads, enough to judge for yourself whether the tool reads your screenshots properly before paying for anything. Past that, it takes a membership, which makes it unlimited. The count is kept on your device: we do not know what you have read — only your browser does.

Two real limits, so that nobody is sold magic. The first: the very first time you use it, your browser downloads the reading engine, which takes a few seconds and needs a connection. After that it stays cached. The second: the machine gets things wrong. It misreads a word, a time, a name. What it gives you is a draft of the text, which you reread and correct before it goes into the case. You are the one who approves it, and that is what makes the result defensible.

4. The one thing that leaves: the audio of a transcription

Transcribing a recording takes computing power a browser does not have. It is the only feature in the app that goes through our servers. We say so plainly rather than bury it.

What leaves: the audio, and only the audio. If you drop in a video, the audio track is pulled out on your device and the picture is set aside: it never leaves.

What happens next: the audio is transcribed, then deleted immediately. It is not kept, not listened to, not reused, and it trains no model. None of the content is written to our technical logs. We keep one number and nothing else: how many minutes were processed, so we can keep count against your plan.

Your consent is asked again for every single recording, and the screen reminds you that you can always type the transcript out yourself, by hand, with nothing leaving your device.

The five free trials

You get 5 transcriptions in total, free, with no account and no card. After that, transcription takes a membership.

That count is kept on your device, not on our servers: we do not know who has used up their trials, or when. It is five trials per device, not five per person — we have no way of identifying you at that stage, and we are not looking for one.

Why a limit here and nowhere else? Because this is the only place where every minute costs us money. Five trials are enough to judge whether the result is useful to you before paying for anything.

Technical limits, whatever your plan

• A single clip runs to at most 24 MB, or roughly 25 minutes. A longer recording is split into segments.
• At most 40 clips per hour. That limit is there to stop a robot, not a person: ordinary human use never comes close to it.

5. The encrypted vault: what we can see, and what we cannot

The vault is a backup of your exhibits (photos, documents, recordings) held off your device, so you can get them back if you switch machines or yours breaks. It takes an account and a membership. It is never switched on by default: you have to ask for it, and expressly accept what follows.

How it actually works

You choose a passphrase. It never leaves your device. It is used to build an encryption key inside your browser (PBKDF2-SHA256, 310,000 iterations, with a salt unique to your account). Each file is then encrypted on your device, with AES-GCM 256, before anything at all is sent. What reaches us is a string of unreadable bytes.

The key is never transmitted, never stored, never written to a log. We have not held it once.

What the encryption protects — and what it does not

We will not sell encryption as total protection. It is not that.

It protects: the contents of your exhibits while they travel, and while they sit on our servers. If someone breaks into our host, or if we are ordered to hand your files over, what comes out is unreadable. We cannot disclose what we are unable to read.

It does not protect:

• your device. Anyone with access to your unlocked computer sees your exhibits in the clear, exactly as you do;
• your passphrase. If it is guessed, jotted on a scrap of paper, or told to somebody, the encryption stops being worth anything;
• the fact that you have an account, a membership, a certain number of exhibits and a certain volume. That much we do see, and there is no way around it;
• your text data, if you switch on sync. That, we could technically read. It is a separate and distinct choice, set out in the privacy policy.

6. The storage included in each plan

A single exhibit runs to at most 60 MB. The minute counter resets at the start of each month; it does not carry over from one month to the next. Prices are before tax where applicable. See the pricing page.

Those numbers look small; they are not. The app compresses every photo before filing it: a 6.9 MB photo straight off a phone takes about 20 KB once processed, without becoming unreadable. For a video, only the audio is kept. Two gigabytes therefore means, in practice, thousands of exhibits.

7. When the storage is full

Nothing is deleted. Not automatically, not to make room, not ever.

What happens is simple: the next exhibit is refused, with a message telling you how much you are using and how much you have. Everything already in the vault stays intact, downloadable and deletable. You then have three options: download exhibits and take them out of the vault, delete some, or move up to a larger plan.

If you move down a plan and your exhibits go past the new allowance: again, nothing is deleted. You can no longer add a new exhibit, you keep full access to what is already there, and you have 30 days to get back under the limit or take a larger plan again. After that, the rule in section 8 applies — with the same notices, and never without warning.

8. When a membership ends

A membership coming to an end triggers no immediate deletion. Here is the exact sequence:

You are always warned before a single exhibit is destroyed, at least thirty days ahead, at the email address on your account. If our notices could not be delivered to you, we do not delete: we wait.

And remember that the copy that counts is yours. Your cases live on your device first; the vault is a backup, not the original.

9. What stays free, always

Two things will never depend on a membership, on a payment being up to date, or on anything else at all:

• Deleting. One exhibit, one case, the whole vault, the whole account: it is free, immediate, with no reason to give, even without a membership, even after you have cancelled one. There is no version of this service where you have to pay to leave.
• Taking your data back. Exporting what you have recorded, in an open and reusable format, is free. That is your right to portability, and a right does not get invoiced.

Not to be confused with what a membership does cover: the formatted professional report, the binder of numbered exhibits, printing and the advanced editor. Those are documents we produce for you. The raw material itself always comes out freely.

Documenting stays free: the log, the evidence vault, the timeline, the deadlines and the legal information will never go behind a wall.

10. Where the bytes physically sit

The encrypted exhibits are held with Cloudflare (R2 storage); account information sits in its key-value storage. We favour hosting in Canada. A privacy impact assessment was carried out before launch, and it takes into account that the exhibits arrive already encrypted: the most sensitive information is not readable by the host.

The detail of retention periods, roles, destruction and what we do in the event of an incident is set out in the personal-information governance policy (published in French; an English version is coming).

A question about this page, or a point that seems ambiguous to you: vieprivee@preuveenmain.ca · answer within 30 days. Recourse: the Commission d'accès à l'information du Québec, the provincial privacy regulator (its name is used in English as well).