This policy explains what DM Scribe collects, why, who else sees it, and what you can do about it. It describes the system as it actually works, including the parts that are less flattering — where data is not automatically deleted, and where a request has to be handled by a human rather than a button.
This summary is for orientation. The sections below are the actual terms.
This policy covers the DM Scribe website at dmscribe.com, the application behind it, and the DM Scribe apps for iPhone and Android, which use the same account and the same service. It does not cover third-party sites we link to, which have their own policies.
What the apps keep on your device, what they ask your permission for, and what deleting your account from an app does on the device are described in section 17.
If you use a campaign shared with you by a game master, the game master decides what is in that campaign and who can see it. We process it on their behalf.
Three things arrive here: what you give us directly, what the service generates as you use it, and what is recorded automatically when a browser talks to a server.
| Category | What it includes | Why |
|---|---|---|
| Account details | Email address, username, first and last name if you give them, a bcrypt hash of your password (never the password itself), your role and plan, and account timestamps such as creation and last sign-in. | To create and secure your account, and to apply the right plan limits. |
| Google sign-in details | If you sign in with Google: the Google account identifier, your verified email address, and your profile picture URL. | To sign you in without a password and to link the account to an existing one with the same verified email. |
| Apple sign-in details | If you sign in with Apple: Apple's identifier for your account, the email address Apple shares with us (a private relay address, if you chose to hide yours), your name if you chose to share it, and a token Apple issues, which is kept only so that DM Scribe's access can be revoked when you delete your account. | To sign you in without a password, to link the account to an existing one with the same verified email, and to revoke DM Scribe's Sign in with Apple authorization when the account is deleted. |
| Session audio | The recordings you upload, and the converted working copies made for transcription. | To transcribe the session. This is the core function of the service. |
| Campaign content | Transcripts, segment timestamps, recaps and their revision history, wiki entries, aliases, relationships, glossary terms, private game-master notes, and questions you ask about your campaign. | To build and serve your campaign wiki, recaps, timeline and Q&A. |
| Usage records | Transcription hours consumed, AI questions asked, storage used, job status, and the cost of each processing call. | To enforce plan limits fairly and to keep the service financially viable. |
| Billing details | Your Stripe customer and subscription identifiers, plan, billing period and payment status. Card numbers are handled by Stripe and never reach our servers. | To take payment and to give your account the features you paid for. |
| Marketing attribution | First-touch UTM parameters, any referral code, and advertising click identifiers captured when you first arrive. | To understand which campaigns bring people to the product. |
| Support and lead capture | Messages you send through the contact form, and an email address you submit to receive a downloadable guide. | To answer you, and to send the resource you asked for. |
| Technical logs | Server logs generated in the ordinary course of running the application, which may include IP address, user agent and request paths. | To operate the service, diagnose failures, and detect abuse. |
DM Scribe processes recordings of tabletop sessions, which means it processes the voices of everyone at the table. Those people usually do not have DM Scribe accounts and have no direct relationship with us. This is the most consequential privacy fact about the product and it deserves to be stated plainly rather than buried.
A recording, and the transcript made from it, can contain far more than the game: real names, jobs, health, relationships, opinions, and whatever else people say between rolls. All of it is transcribed and sent for AI processing along with everything else.
If you are the game master uploading the audio, you decide what is recorded and who it is shared with, and it is your responsibility to tell your table and get their agreement before recording. Our Terms of Service require this. We have no way to verify it and no way to contact your players ourselves.
If you are a player and you want a recording of you removed, ask your game master, who can delete the recording and the session directly. If that is not possible, contact us and we will work with the account holder to resolve it.
To run the service: transcribing audio, extracting entities into your wiki, generating recaps, answering questions about your campaign, and maintaining your account.
To enforce plan limits: measuring transcription hours and AI questions against the allowances of your plan.
To take payment and manage subscriptions.
To communicate with you: password resets, security notices, notifications that a session has finished processing, and product email you can unsubscribe from.
To keep the service working and secure: diagnosing failures, detecting abuse, and enforcing rate limits.
To understand how the site is found and used, in aggregate, so we know which pages and campaigns are worth keeping.
This section exists because "we use AI" is not a disclosure. Here is what actually leaves our servers.
When you upload a session, the audio is converted to a working format and sent to OpenAI's speech-to-text service to produce a transcript. Long sessions are split into parts, each sent separately.
The resulting transcript is then sent to OpenAI's language models several more times: once to extract the characters, places, items and factions mentioned; once to detect relationships between them; and once to write the recap. Portions of it are also sent to generate the numerical embeddings that power campaign search.
When you ask a question about your campaign, the question and the passages retrieved from your own transcripts, wiki and recaps are sent to OpenAI to compose a cited answer.
To improve how names are transcribed, a short prompt built from your campaign glossary, player character names and recent wiki entries is included with the audio.
This processing happens under OpenAI's terms for its developer platform. We are describing the data flow, not making a promise on OpenAI's behalf — read their policy, linked in the table below, for how they handle it.
We do not use your campaign content to train our own models, and we do not build advertising profiles from it.
DM Scribe is a small product built on other people's infrastructure. These are the services involved and what each one receives.
| Service | What reaches them | Their policy |
|---|---|---|
| Microsoft Azure | Everything. Azure hosts the application, the SQL database holding your account and campaign content, and the blob storage holding your audio. Azure encrypts data at rest and in transit by default. | privacy.microsoft.com |
| OpenAI | Your session audio (for speech-to-text), and your transcript text (for entity extraction, recap generation, embeddings and campaign question-answering). This is the largest disclosure in this policy and the service cannot function without it. | openai.com |
| Stripe | Your email address and payment details, which you enter on Stripe's own checkout. Stripe returns customer, subscription and invoice identifiers to us. | stripe.com |
| If you use Google Sign-In, Google authenticates you and returns your verified email, account identifier and avatar. Google Analytics also receives page-view and event data from the marketing site. | policies.google.com | |
| Apple | If you use Sign in with Apple, Apple authenticates you and returns an identifier for your account, your email address or a private relay address, and your name if you choose to share it. When you delete your account, we ask Apple to revoke DM Scribe's authorization. Email we send to a private relay address passes through Apple's relay to reach you. | apple.com |
| Server-side conversion events carrying a SHA-256 hash of your email address, an internal account identifier, your IP address, your user agent, and for a purchase the amount paid. No sign-up event is sent for an account created in the iPhone or Android apps, and no purchase event for an account that has been used in either app, including a purchase made on the website. The browser pixel sends equivalent events from the website. | reddit.com | |
| TikTok and Meta | Browser-side advertising pixels that receive page views and conversion events from the marketing site. They do not receive campaign content. | tiktok.com |
| OpenAI (ChatGPT ads) | A browser-side advertising pixel, separate from the OpenAI processing of your sessions, that receives page views and conversion events from the website: registration, contact or checklist requests, checkout started, and purchases with the plan and amount. While you are signed in, it attaches a SHA-256 hash of your email address and of an internal account identifier to every event it sends. It also reads the email, phone and name fields of forms you fill in on the site and sends OpenAI a SHA-256 hash of them, so OpenAI can match a conversion to a ChatGPT account. Our servers also send OpenAI three events of their own, each carrying a SHA-256 hash of your email address and a hash of an internal account identifier: when you register on the website (with your IP address, browser user agent and the ad-click and browser references the pixel stored); when the first session you upload finishes processing (only the fact that it happened, nothing from the session); and when you buy a plan or extra hours (with what you bought, the amount paid and the same references). We may also upload a SHA-256 hash of the email address of registered accounts, so ChatGPT ads can be shown to, or kept from, people who already use DM Scribe; an account that unsubscribed from marketing email is never included. Nothing is sent for an account that has been used in the iPhone or Android apps. It does not receive campaign content. | openai.com |
| Email delivery provider | Your email address and the contents of the messages we send you — password resets, processing notifications and product email. | — |
The marketing pages carry analytics and advertising tags from Google, Reddit, TikTok, Meta and OpenAI (for ChatGPT ads). They record page views and conversion events so we can tell which advertising actually brings people to the product.
The OpenAI ads tag also reads the email, phone and name fields of forms you fill in on the website — sign-up and sign-in included — and sends OpenAI a SHA-256 hash of them, not the readable values, so it can match a conversion to a ChatGPT account. Passwords are not read. While you are signed in it also attaches a SHA-256 hash of your email address and of an internal account identifier to the events it sends.
One part of this deserves specific mention rather than a general reference to "advertising partners". When you register or purchase, we send a conversion event to Reddit from our servers containing a SHA-256 hash of your email address, an internal account identifier, your IP address, your user agent, and for a purchase the amount paid. Hashing means Reddit does not receive your email in readable form, but it does allow Reddit to match you to a Reddit account it already knows.
For ChatGPT ads, our servers also send OpenAI a conversion event when you register, when the first session you upload finishes processing, and when you purchase. Each carries a SHA-256 hash of your email address and a hash of an internal account identifier; the registration also carries your IP address and browser user agent, and the registration and purchase carry the ad-click and browser references its tag stored in your browser and what you bought and paid. The first-session event says only that it happened — nothing from the session itself. As with Reddit, hashing hides the readable email but still lets OpenAI match the event to a ChatGPT account.
We may also upload a list of SHA-256 hashed email addresses of registered accounts to OpenAI, so that ChatGPT ads can be shown to, or kept from, people who already have an account. Accounts that have used the iPhone or Android apps, and accounts that unsubscribed from marketing email, are never included.
Our servers send no sign-up event for an account created in the iPhone or Android apps, and no purchase event for an account that has been used in either app — section 17 explains.
Your campaign content, transcripts and recordings are never sent to any advertising service.
We do not sell personal information for money. Note that some privacy laws, including California's, treat the kind of advertising measurement described above as "sharing" for cross-context behavioural advertising even where no money changes hands. We would rather say that plainly than hide behind a narrow definition of "sell".
You can block these tags with a content blocker or your browser's tracking protection; the application works normally without them.
DM Scribe itself uses your browser's local storage rather than cookies for its own purposes. The advertising and analytics services above set their own cookies through their tags.
| What | Purpose |
|---|---|
| Authentication token and cached profile | Keeps you signed in. Stored in your browser's local storage, not in a cookie. Clearing site data signs you out. |
| Interface preferences | Dark mode, dismissed banners, collapsed panels and which release notes you have seen. |
| Checkout and offer state | The plan or bundle you were buying, so the purchase can be confirmed when Stripe returns you to the site. |
| Attribution identifiers | First-touch UTM parameters, any referral code, and advertising click and visitor identifiers, and while you are signed in a hash of your email and account identifier, used for conversion measurement. |
| Third-party advertising cookies | Google, Reddit, TikTok, Meta and OpenAI set their own cookies and identifiers through their tags. These are governed by their policies, linked above. |
Some email is part of the service and cannot be switched off while you have an account: password resets, notices that your password changed, billing messages, and the notification that a session has finished processing.
Other email is promotional — reminders to finish setting up a campaign, occasional offers, and notes about new features. Every one of those carries a one-click unsubscribe link that takes effect immediately and needs no sign-in.
Unsubscribing from promotional email does not affect the service email above.
To the service providers in the table above, to the extent each needs it to do its job.
To people you deliberately share with: anyone you give a wiki share link to, and any account you link to a shared plan.
When required by law — a valid legal request, court order, or where disclosure is necessary to investigate suspected fraud, a security incident, or a threat to someone's safety.
In a business transfer: if DM Scribe is acquired or its assets sold, account and campaign data would transfer with it. You would be told before that happened, and this policy would continue to apply until replaced.
Beyond that, campaign content is not disclosed to anyone. It is not sold, rented, or handed to advertisers.
Plainly: as long as your account exists. Nothing in DM Scribe expires or is deleted on a schedule. Audio, transcripts, wiki entries and recaps stay until you delete them or ask us to.
Deleting a recording from within the application is a real deletion: the stored audio is removed from our storage, including the working copies made during processing, along with its transcript and the wiki references drawn from it.
Deleting a campaign works differently, and the difference matters. It removes the campaign from your account and stops any processing still running for it, but the underlying content remains in our database rather than being erased. If you want a campaign's content actually destroyed, delete its recordings first, or ask us — see the next section.
Some records outlive the content they relate to, because they have to: billing and transaction records are kept for tax and accounting purposes, and minimal usage records are kept to enforce plan limits across billing periods.
Cancelling a paid plan does not delete anything. Deleting your account does, immediately and irreversibly — see the next section.
Copies kept on your device by the iPhone and Android apps follow their own, shorter rules, set out in section 17.
Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it in a portable form, and to withdraw consent. If you are in the EEA or UK this is the GDPR; in California, the CCPA/CPRA; other jurisdictions grant similar rights.
What you can do yourself, immediately: change your account details, delete individual recordings, delete campaigns, revoke share links, export a wiki or session from the application, unsubscribe from promotional email, turn off AI transcription in the iPhone and Android apps, download a complete copy of your data, and delete your entire account.
The last two are in Account settings, both on the website and in the DM Scribe apps for iPhone and Android. "Download my data" produces a JSON file of every record linked to your account — campaigns, sessions, transcripts, recaps, wiki entries, marketing email history and billing history. Audio files are not included: they are binary, and there is currently no way to download a recording back out of DM Scribe once it has been uploaded, so keep your own copy of anything you want to be able to listen to again. "Delete my account" cancels any active subscription and then permanently erases your account and everything scoped to it, including the audio in storage. It is immediate and cannot be undone, so export first if you want a copy.
To delete your account from the iPhone or Android app, open Account settings and choose "Delete my account". It erases the same things, and also deletes that account's recordings and queued uploads from the device you delete it on. Section 17 explains what that means on the device, and what happens to a Sign in with Apple authorization.
If either fails, or you would rather we did it for you, write to us through the contact page and we will action it by hand.
We do not charge for these requests and will not treat you differently for making one. If you believe we have handled your data improperly, you can complain to your local data protection authority.
Traffic between your browser and our servers is encrypted in transit, and data stored in Azure SQL and Azure Blob Storage is encrypted at rest by the platform.
Passwords are stored as bcrypt hashes with a work factor of 12 and are never stored or logged in readable form. Accounts created through Google Sign-In have no password at all.
Sessions use signed tokens that expire after seven days. Changing your password immediately invalidates tokens issued before the change, so a reset genuinely locks out a stolen session rather than leaving it valid for the rest of the week.
Password reset links are single-use, expire after sixty minutes, and are stored only as a SHA-256 hash — a copy of our database does not yield a working reset link. Wiki share links are stored the same way, so the stored value cannot itself be used as a link.
Access to campaign data is checked on every request against the campaign you are a member of. Requests for campaigns you cannot see return "not found" rather than "forbidden", so the API does not confirm that another user's campaign exists.
No system is perfectly secure, and we do not claim to hold any security certification. If you find a vulnerability, please report it through the contact page rather than disclosing it publicly.
Our infrastructure and the services listed above operate across several countries, including the United States. Using DM Scribe involves transferring your information to countries whose data protection laws may differ from those where you live.
Where such a transfer involves personal data protected by UK or EU law, it relies on the transfer mechanisms our providers make available, such as standard contractual clauses.
DM Scribe is not intended for children under 13, and we do not knowingly collect their personal information as account holders. If you believe a child under that age has an account, contact us and we will delete it.
A separate point that follows from the nature of the product: if minors play at your table, their voices will be in the recordings you upload. Obtaining the agreement of a parent or guardian before recording a minor is your responsibility as the person making the recording.
We will update this policy as the product changes. The "last updated" date at the top reflects the current version.
If a change materially affects how your information is used, we will give notice by email or in the application before it takes effect.
DM Scribe has apps for iPhone and Android. They sign in to the same account and send recordings to the same service, so everything else in this policy applies to them too. This section covers what is specific to the apps: what they ask before sending anything, what they ask your permission for, what they keep on your device, and what deleting your account from an app does there.
AI processing needs your agreement in the app. Before an app sends anything for transcription — your first upload, or retrying or re-checking one — it asks, once for each account on that device. The question names OpenAI, which transcribes the recording and writes its recap, and Microsoft Azure, where recordings and transcripts are stored; section 5 describes that processing in full. If you choose "Not now", the recording stays on your device and nothing is sent. You can withdraw your agreement at any time in the app's Account settings, under "AI transcription" → "Turn off": nothing more is sent from that device until you turn it on again. Turning it off does not delete what was already uploaded; deleting those recordings, or your account, does.
The microphone and notifications are optional, and each is asked for only when it is about to be used: the microphone the first time you tap Record, notifications when you start a recording (Android) or an upload (both apps), so the app can tell you when a session is ready (on Android, a recording in progress also keeps its controls in a notification). Without the microphone the app cannot record, and without notifications it cannot tell you when a session is ready; everything else works, and you can change either in your device's settings at any time.
The apps contain no analytics, advertising, tracking or crash-reporting SDKs — the third-party kits that usually collect that kind of data — and they do not use your device's advertising identifier. Apple and Google may still give us crash reports and overall statistics about the apps if you have allowed your device to share them with app developers; those come from the operating system under Apple's and Google's own terms, not from anything in the apps.
Accounts that use the apps are kept out of the server-side advertising measurement described in section 7. Requests from the apps say that they come from the iPhone or Android app, and our servers note on your account the first time it is used in one. For an account created in an app our servers send Reddit no sign-up event, and once an account has been used in an app they never report its purchases to Reddit or OpenAI, including a purchase made later on the website. If they cannot confirm that an account has never been used in an app, they send nothing. A sign-up that was reported before the account was first used in an app is not withdrawn. The website's own tags, also described in section 7, still apply when you use the website in a browser.
You can delete your account in the app: open Account settings and choose "Delete my account". It erases the account on our servers exactly as section 12 describes, and also deletes that account's recordings, queued uploads and settings from the device you delete it on. The app first lists any recording that has not been uploaded, so you can save a copy. Other accounts' recordings on the same device are not touched. Deleting the account on the website cannot reach your device, so any recordings it left there stay until they are deleted in the app or the app is removed.
If your account uses Sign in with Apple, deleting it — in the app or on the website — also tries to revoke DM Scribe's Sign in with Apple authorization with Apple, which takes DM Scribe off your Apple ID's list of apps that use Sign in with Apple. On iPhone the app first asks Apple for a fresh authorization for exactly this purpose. If the revocation cannot be completed, your account is still deleted, and an app you deleted it from tells you how to remove DM Scribe yourself (on iPhone: Settings → your name → Sign-In & Security → Sign in with Apple).
What the apps keep on your device is listed below, down to the small records in the last row. All of it is in the app's private storage, where other apps cannot read it. Recordings, the upload queue, the saved lists and transcripts, and the per-account settings are excluded from device backups, and the sign-in token never moves to another device. The small records are excluded too, except two yes-or-no settings on iPhone — whether you have been asked about notifications, and whether an earlier installation's sign-in has been cleared — which a device backup can include. Neither says anything about your account.
| What | Why, and when it is deleted |
|---|---|
| Recordings you make in the app | Kept until the recording's transcript is ready, then deleted by the app; a recording you discard is deleted straight away. Not deleted when you sign out, because until it is uploaded it may be the only copy of a session — and it is only ever uploaded for the account that made it. |
| The upload queue | Recordings waiting to be sent, and those sent but not yet transcribed, so an upload interrupted by a lost connection or a closed app carries on later. Kept when you sign out, like the recordings. |
| Campaign and session lists, and recent transcripts and recaps | The lists, and the transcripts and recaps of up to five sessions you read most recently, so the app can open them without a connection. They belong to the signed-in account and are deleted every time you sign out. |
| The campaign you last opened, and your AI transcription answer | So the app can reopen that campaign, and knows whether it may send recordings for transcription. Kept for each account, and deleted when you delete that account in the app. |
| Your sign-in token and account details | Keeps you signed in, together with the basic details of the account it belongs to: email address, username, name and plan (and on iPhone, for an account that uses Sign in with Apple, Apple's identifier for it). Held in the device's secure storage — the iOS Keychain, or on Android storage encrypted with a key in the Android Keystore — and deleted when you sign out. |
| A transcript you share, or on iPhone a data export you save | Written to a temporary file for the share sheet, and deleted the next time the app opens or when you sign out. A data export is deleted sooner, once the share sheet is finished with it; on Android it is written straight to the place you choose, with no copy in the app. |
| Small records the apps use to remember where they are | Whether the app has already asked about notifications. A note that a deletion you asked for has been sent, removed once its outcome is known. A note that an account was just created, so the app can welcome it with its bonus hours, removed when the welcome is shown, another account is created on the device, or the account is deleted. The two notes hold only the account's identifier. On iPhone, the app also remembers whether this installation has already cleared any sign-in an earlier installation left in the Keychain. |
For any privacy question, or to make a request about your data, use the contact page. Tell us what you are asking for and which account it concerns, and we will come back to you.