1. The short version
- Your lecture audio, transcripts, notes, glossary and imported course materials stay on your computer. We never upload or store them.
- Speech recognition runs on your device. Audio never leaves it.
- When you ask for a translation or AI notes, the text involved passes through our gateway to an AI provider to answer that request. We do not keep it.
- Our servers hold your account, plan, usage counters and, if you use the study-social features, your profile and safety records. Never lecture content.
- Product analytics are off unless you turn them on, and they contain no content.
- We do not sell personal information and there is no advertising.
2. What stays on your device
LecMate processes and stores the following only on your computer:
- Microphone audio, and the speech recognition that turns it into text.
- Transcripts, translations, AI notes, study decks, writing drafts and glossary terms.
- Course materials you import from Canvas, Moodle, PDFs or slides, and anything you add yourself.
- Access tokens for your university's learning system, held in the operating system's secure store (macOS Keychain; Windows Credential Manager) and used only for connections made directly from your computer to your university.
Deleting a session, clearing the app's data, or uninstalling removes this content. We hold no copy.
3. What our servers hold
| Category |
What it is |
Where |
Why we need it |
| Account |
Email address, verification state, plan |
Supabase, Sydney |
Sign-in and subscription |
| Usage metering |
Credits and seconds consumed, request counts, which service was used, timestamps, outcome codes |
Supabase, Sydney |
Billing, quotas, preventing abuse |
| Abuse reference |
A one-way SHA-256 digest of a device identifier, salted with a secret only we hold |
Supabase, Sydney |
Stops repeat free trials. It cannot be reversed to identify a device |
| Payment |
Subscription status and a Stripe customer reference. We never receive or store card numbers |
Stripe |
Taking payment |
| Study-social profile, if you use those features |
Your handle, discoverability setting, friend connections, group memberships, and the university course verification derived from signing in to your university |
Supabase, Sydney |
Friends, study groups, course-verified sharing |
| Safety records, if a report is made |
Reports, moderation decisions, enforcement actions and standing changes, recorded against pseudonymous references rather than your name |
Supabase, Sydney |
Keeping shared spaces safe, and being accountable for our decisions |
| Support and deletion requests |
Notes our support staff write, and deletion requests you make |
Supabase, Sydney |
Answering you, and honouring deletion |
| Opt-in analytics |
See section 6 |
Console database, Sydney |
Knowing whether a release is healthy |
We do not store lecture audio, transcripts, translations, notes, imported materials, or your university credentials. This is not only a policy: our servers have no column to put them in, and automated tests fail the build if content ever reaches a log or a database row.
4. Text in transit: translation and AI notes
When you ask for a translation or AI notes, the relevant text, never audio, travels over an encrypted connection to our gateway at api.lecmate.net. The gateway forwards it to an AI provider and returns the answer.
The gateway does not write your content to disk, to a database, or to logs. It keeps only the numbers needed to bill and rate-limit: token counts, seconds, and an outcome code. Automated tests enforce this.
AI processing is performed by providers in the United States, reached through our AI supply partner. Under their terms, content sent through the API is not used to train their models. Because those providers are outside Australia, using translation or AI notes involves disclosing that text overseas, and you consent to that by using the feature.
LecMate also contains an advanced option for using your own provider account and key. If you choose to configure it, your text goes to the provider you chose, under that provider's terms, and our gateway is not involved. That option is off by default.
5. Files the app downloads from us
The app downloads static files from models.lecmate.net: speech models, the current app version manifest, signed academic-calendar data, and signed safety controls. These requests carry no account identifier, no device identifier and no content.
The safety controls let us switch a feature off remotely, for example when a provider is failing or a bug is found. They are signed, and the app verifies the signature before accepting them. They can only restrict features. They can never switch on something you turned off, and they never touch your local content.
6. Product analytics, off by default
Analytics are off until you turn them on. When on, the app sends one summary a week containing:
- a resettable anonymous installation identifier,
- the app version and platform,
- the week the summary covers,
- counts such as sessions started, features used and errors seen.
The complete, machine-readable field list is published at https://console.lecmate.net/v1/trust/telemetry-fields, and summaries are kept for 13 months. A summary contains no lecture content, no transcript text, no file names, no email address and no device fingerprint. You can reset the identifier or switch analytics off at any time in the app, and we cannot link a reset identifier to the previous one.
7. Error monitoring
Technical error reports from our servers are sent to Sentry so that we can fix faults. Request bodies, secrets and any content are removed before a report leaves our systems, which is enforced in code and tested. Error reports contain no lecture content.
8. Email
Account email, such as verification and support replies, is delivered through Resend and Supabase's email service. Your email address is disclosed to them for that purpose.
9. Backups
Our database is backed up nightly. Each backup is encrypted before it leaves the database host and stored in Cloudflare R2. Backups hold the same metadata described in section 3 and no lecture content. They are kept for 30 days, after which they are deleted automatically, so deleted records disappear from backups within that window.
10. Features designed but not switched on
We describe these for transparency. None is active today, and we will update this policy before any is switched on.
- Cloud sync of your own study data between your own devices. It will be off by default.
- Post-lecture refinement on the Max plan, which would send one lecture's audio to a speech service through a relay that retains nothing, only after you confirm that specific lecture, with every transfer shown in the app.
- Corpus sharing, which would be an explicit, per-item opt-in in exchange for rewards. Nothing would be uploaded silently, and withdrawing consent would stop any future use.
11. Who processes data for us
| Sub-processor |
What they do |
Where |
| Supabase |
Database, authentication, file storage |
Australia (Sydney) |
| Fly.io |
Hosting for the gateway and the operations console |
Australia (Sydney) |
| Cloudflare |
DNS, website, and R2 storage for downloads and backups |
Global, with data stored in the Asia-Pacific region |
| Stripe |
Payments |
United States and global |
| Our AI supply partner and the AI providers it reaches |
Translation and AI notes |
United States |
| Sentry |
Error monitoring |
United States |
| Resend |
Account and support email |
United States |
12. How long we keep things
- Billing and usage records: seven years, to meet Australian tax and audit requirements.
- Study-social profile: until you delete your account.
- Safety records: kept after account deletion, but only as pseudonymous references that cannot be linked back to you.
- Analytics: 13 months.
- Backups: 30 days.
- Content on your device: entirely under your control. We hold nothing to delete.
13. Deleting your account
Ask in the app or email [email protected]. The request goes into a queue that our staff work through. Deletion removes your account and cascades through your profile, friend connections, group memberships and support notes. Records we must keep for accounting are retained in a form that no longer identifies you. We aim to complete deletion within 30 days and always within the time the law allows.
14. Your rights
Under the Australian Privacy Principles you can ask us for access to the personal information we hold about you, and ask us to correct it. Write to [email protected].
If you are unhappy with how we handled your privacy, tell us first. If we do not resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
If you are in the European Economic Area or the United Kingdom, you also have the rights to access, correction, erasure, restriction, objection and portability, and you may complain to your local supervisory authority. We rely on your consent for optional features such as analytics, and on the necessity of performing our contract with you for everything needed to run the service.
15. Age
LecMate is made for university students. You must be at least 16 to hold an account.
16. Recording is your responsibility
LecMate records only when you press record. You are responsible for following your university's policies and the recording laws where you are before recording a lecture or any person. This is repeated in our Terms of Service.
17. Changes to this policy
We will tell you in the app before a material change takes effect, and we will update the date at the top.
