Whisperframe

Privacy Policy

Last updated: December 1, 2025

Overview

Whisperframe is operated by Christopher Moravec, a sole proprietor based in Portland, Oregon.

Whisperframe is designed with privacy as a core principle. We minimize data collection and never store your audio recordings or conversation transcripts. This policy explains what data we collect, how we use it, and your rights regarding your data.

Audio and Transcription Data

We do not store your audio or transcripts. When you use Whisperframe:

  • Audio is captured by your browser and sent to OpenAI's Whisper API for transcription
  • We discard the audio immediately after receiving the transcription
  • OpenAI states they don't use API data for training, but may retain it for up to 30 days for abuse and misuse monitoring
  • Text transcripts are held temporarily in your browser's memory only
  • Once an image is generated, the transcript text is deleted from your browser
  • We never store your conversations on our servers

Data We Collect and Store

We store the following data:

  • Email address: Used for authentication via magic links
  • Generated images: The AI-generated artwork created from your conversations
  • Image metadata: Title, artist name, and AI-generated prompt (not your original transcript)
  • Account data: Credit balance and account creation date

Image Privacy

Important information about your generated images:

  • Your gallery (list of images) is private - only you can see it when logged in
  • Image URLs are technically public (similar to most image hosting services)
  • Anyone with a direct link to an image can view it
  • You control sharing through our share link feature
  • Images are stored on Cloudflare R2 (cloud storage)

Third-Party Services

We use the following third-party services:

  • OpenAI Whisper API: Audio transcription. Per OpenAI's API data policy, they don't use API data for training, but may retain it for up to 30 days for abuse monitoring.
  • Anthropic Claude API: Generating artistic prompts from transcripts
  • Google Gemini / OpenAI DALL-E: Image generation
  • Cloudflare R2: Image storage
  • Resend: Sending authentication emails
  • Plausible Analytics: Privacy-focused website analytics. Plausible does not use cookies, does not collect personal data, and is fully GDPR compliant. All data is aggregated and anonymized.

Each of these services has their own privacy policies. We use API-tier access which typically means your data is not used for model training.

Cookies

We use minimal cookies:

  • Authentication cookie: Keeps you logged in (essential, 30-day expiry)
  • We do not use tracking cookies or advertising cookies
  • We use Plausible Analytics, which operates without cookies

See our Cookie Policy for more details.

EU AI Act Compliance

Whisperframe uses AI systems and we are committed to transparency about how they work. Under the EU AI Act (Article 50), we qualify for the artistic/creative exception, which allows disclosure in a manner that does not hamper enjoyment of the work:

  • AI-Generated Content: All images created by Whisperframe are AI-generated artwork. This is clearly disclosed on all public share pages.
  • Visible Disclosure: Shared images display an "AI-generated artwork" label in the footer, providing clear human-readable notice.
  • Machine-Readable Metadata: Images generated by Google Gemini include SynthID (an invisible watermark embedded in the pixels) and C2PA metadata indicating AI generation. OpenAI images include C2PA metadata. We preserve this metadata when storing images.
  • Transparency: We disclose that we use OpenAI, Anthropic, and Google AI services for transcription and image generation.
  • Purpose: AI is used solely for creative/artistic purposes (transcription and image generation).
  • Risk Category: We believe Whisperframe falls under minimal/limited risk as it's used for creative expression, not decision-making that affects individuals.
  • Human Oversight: Users control when to record and can delete their generated content at any time.
  • No Biometric Processing: We do not identify individuals from audio - we only transcribe speech to text.

Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data (data portability)
  • Object to processing
  • Withdraw consent

To exercise these rights, contact us at the email below.

Data Retention

  • Audio: Not stored by us (sent to OpenAI, discarded after transcription)
  • Transcripts: Held in browser memory only, deleted after image generation
  • Images: Stored until you delete them from your dashboard
  • Account data: Stored until you request account deletion

Contact

For privacy-related questions or to exercise your data rights, email [email protected] or contact Christopher Moravec through his website.

Changes to This Policy

We may update this policy from time to time. We will notify users of significant changes via email or a notice on our website.