Privacy notice for transkribierBAR
This notice supplements the privacy policy of Osnabrück University. It describes what data is processed when you transcribe and edit recordings with transkribierBAR.
Your recordings and texts
transkribierBAR runs on servers of Osnabrück University, and so do its speech recognition and its AI features. Your files and texts are not passed on to external providers.
For transcription, transkribierBAR creates a new MP3 file from your file. It contains only the audio track, without your file's metadata such as the title, cover image or recording location, and does not carry your file's name. transkribierBAR sends this MP3 file and your transcription settings (language, model, minimum and maximum number of speakers, initial prompt and hotwords) to the university's speech recognition server (whisperx.virtuos.uni-osnabrueck.de). The server processes the file, returns the transcript to transkribierBAR and then deletes the audio file; it does not store the transcript. If the connection drops during processing, for example because transkribierBAR restarts, the server stops processing and deletes the file as well.
The AI features send text to a language model on university servers, which transkribierBAR reaches through the university's AI gateway (litellm.uni-osnabrueck.de). After every successful transcription, transkribierBAR sends the beginning of the transcript (up to 2,000 characters) to the model to generate a title. For analysis, refinement and translation, it sends the transcript text, what you enter for it, such as your own instructions, and, where applicable, the names you have given the speakers. transkribierBAR does not send your username or your email address with these requests.
In the AI gateway and at the model, the content of the requests and the answers is not stored, not analyzed and not used to train or fine-tune models. transkribierBAR stores the results as described below.
Consent
If other people speak in your recordings, transkribierBAR also processes data of these third parties: their voices, what they say and the names you give them. Only record conversations, and only upload recordings, if everyone who speaks in them has agreed.
What we store
- Your account: your username and email address from the Uni-Login, and the time when you first uploaded a file or created an API token.
- Per transcription: the uploaded file, unchanged (including a recording made in the browser), with its file name, size and format, and the MP3 file for speech recognition; your transcription settings; the transcript with its title; the speaker names; analyses, translations and refinements.
- Presets and bundles: everything you set in them.
- API tokens: name, the beginning of the token, and when it was created, expires, was last used and was revoked. transkribierBAR stores the token itself only as a hash.
In the app, only you can see your transcriptions.
Every uploaded file is deleted automatically 3 days after the upload, together with all transcriptions of that file and their results (analyses, refinement, translation, speaker names). If you archive a transcription, a period of 180 days from archiving applies instead to its file and all transcriptions of that file. If you delete a transcription yourself, transkribierBAR removes it immediately with its results and speaker names, and the file as well if no other transcription uses it. If transkribierBAR cannot read the audio of an uploaded file, it deletes the file immediately. transkribierBAR overwrites deleted entries in its database.
transkribierBAR deletes revoked API tokens 30 days after revocation and expired ones 90 days after expiry. You can delete presets and bundles yourself. transkribierBAR does not delete your account, your presets or your bundles automatically.
Technical logs and metrics
The web server keeps no access log. Only when it cannot handle a request because of a server error, or when sending a response is cut off, for example because you skip ahead in the player or leave the page, does it log that request with your IP address, the requested address and the technical request headers, such as the browser type, without cookies and without login credentials.
The login service logs neither individual requests nor logins.
transkribierBAR logs one line per request with the method, the requested address and the status code, without content, without API tokens and without your IP address. For errors, internal identifiers, such as that of the transcription, and the error message are added; the error message may contain short excerpts of the text concerned, including speaker names.
Each of these services writes its log to at most three files of 50 MB each. When that limit is reached, the oldest entries are deleted. So the logs are limited in size, not in how long they are kept.
The university's monitoring server collects aggregated metrics, such as the number and duration of transcriptions, errors and the server load. They contain no content and no information about individual people.
Cookies
transkribierBAR sets only technically necessary cookies for logging in: the login cookie __Host-oauth2_proxy (at most 24 hours; if it is too large, it is split into __Host-oauth2_proxy_0, __Host-oauth2_proxy_1 and so on) and, while you log in, the cookie __Host-oauth2_proxy_csrf, which protects the login process (at most 15 minutes). Your browser sends both cookies only to transkribierBAR, not to other university websites. The login cookie is deleted when you log out.
Beyond that, transkribierBAR sets no cookies and stores nothing in your browser. The interface language follows your browser's language setting; if you switch it in the app, this is not saved.
The user guide and this privacy notice can be reached without logging in, set no cookies and load nothing from other servers.
Access
Access to this data for a specific reason is limited to what is strictly necessary for operating and maintaining the platform, and is possible and permitted for technical staff only within the legal framework.