Security, permissions and what leaves your device
Everything below describes the product as it is built, not as we hope to build it. Where something is not done yet, it says so.
The permissions the app asks for
Microphone
Your own voice, so the two sides of the conversation can be told apart and so the drafts know what you already said. Denied by default until you grant it.
Screen and system audio recording (macOS)
The only way macOS lets an app read the sound another app is playing. Subtl uses ScreenCaptureKit for audio only and does not capture the picture of your screen.
Accessibility
Not requested. Call detection, when you enable it, looks at which applications are running, not at what is inside their windows.
Network
For transcription, translation and drafting, and for your subscription. Nothing is uploaded when a session is not running.
What leaves your device
Call audio
Streamed over TLS to the transcription provider while a session runs. Not written to disk anywhere in the pipeline, not stored on our servers.
Kept: not at all
Transcribed text and translations
Sent to the translation and drafting models for the duration of the call. Written into a database on your own machine.
Kept on our servers: only with cloud sync on
Context files
Uploaded, parsed into text chunks and embedded so an answer can quote the right paragraph. Encrypted at rest.
Kept: 30 days after the last meeting that used them
Account and billing
Email address, devices, subscription state. Card details go to Stripe and never reach us.
Kept: until you delete the account
Product telemetry
Counters and latency measurements, with no call content in them. Can be switched off in settings.
Kept: 12 months
About “hidden from screen sharing”
The overlay window sets the operating system's content-protection flag, which is what excludes it from window and screen capture in the meeting apps we have tested. That is a strong, well-defined mechanism and it is not a guarantee of secrecy. It does not stop a camera pointed at your screen, a person standing behind you, a capture path that operates below the window server, or a host recording their own view. If a rule that binds you forbids assistance, this feature does not change that rule.
Not done yet
- Local history on the device is not encrypted at rest yet; that is planned and documented rather than quietly skipped.
- The desktop build is notarised but not distributed through the App Store.
- There is no third-party security audit. When there is one, it will be linked here.
Reporting a problem
Write to us with the details and, if you have one, a proof of concept. We will confirm receipt and tell you what we are doing about it. hello@subtl.me