Private transcription, by design

Privacy is in the architecture, not a paragraph in a policy. Three things make it real: video stays on your device, the transcription-audio copy isn’t kept after processing, and private mode lets you avoid saving the transcript to your account.

Private mode: choose not to save the transcript

Turn on private mode before you start and set an archive password that lives only in your browser. We never receive or store it, so if you lose it, the archive cannot be recovered by anyone, including us. Private mode then runs speech recognition only: no transcript is saved to your account and no post-processing Insights run. The result comes back as a short-lived encrypted result, and your browser packages it into a password-protected .husharchive using the password you set.

Private mode keeps most transcription context available, with two exceptions: medical mode and translations aren’t available. Saved dictionaries, prompt presets, one-off keyterms, speaker detection, multichannel, and merged uploads all still work the same way. You’re transcribing under the same options otherwise, just receiving a different kind of result at the end. None of that depends on file size or type either: those two exceptions aside, private mode changes what happens after transcription, not what you’re allowed to upload.

Normal mode is the better default for most work: the encrypted transcript remains in your account, where you can search and edit it and choose to generate the complete free Insights result. Reach for private mode when a specific recording should not sit in your library at all, such as a one-off sensitive call rather than your everyday workflow.

Retention on your terms

Normal transcripts, the ones private mode skips, follow a retention window you control. Set an account-wide default: keep everything until you delete it yourself, or auto-remove it after 7, 30, 90, or 365 days. Any single transcript can also carry its own auto-delete date that overrides the account default, for the one recording that needs a shorter (or longer) shelf life than everything else. You might set a 90-day default so old recordings clear out on their own, then override it to keep-until-delete for the one transcript you still need on hand. When you delete one transcript through its dedicated flow, download the returned deletion receipt: a JSON record of what was removed and when. Scheduled and bulk transcript deletion do not return a receipt yet.

Deletion, on the record

Two more layers sit underneath retention. Transcripts and any Insights artifacts generated from them are encrypted at rest, so leaked storage would expose ciphertext, not your words. That protection holds whether it’s a five-minute voice memo or your largest transcript, with no tier where it’s weaker. Your audio doesn’t wait for a retention window at all: it’s deleted the moment your transcript is saved, on every mode, private or not. And residency follows you: if you’re in the EU, EEA, Switzerland, or the UK, your audio is processed in the EU; everywhere else, it’s processed in the US. For supported deletion flows, the receipt is Hushscript’s timestamped record of what it removed, not independent or cryptographic proof.

Open your archives anywhere

A .husharchive isn’t a dead end. Open one you generated (or one somebody else sent you) right in your browser: verify its manifest and checksums, then extract the files inside, no extra software required. That check is worth doing to confirm an archive wasn’t altered before you rely on what’s inside it. If the tool on the other end doesn’t handle .husharchive files, export as a standard AES-encrypted ZIP instead; either way, the contents are protected by the password you set, not by trusting whoever’s holding the file. Normal transcripts export as TXT, SRT, VTT, CSV, TSV, Markdown, HTML, RTF, XML, JSON, DOCX, PDF, XLSX, ODS, ODT, ASS, TTML, SBV, LRC, FCPXML, or EDL (21 formats total) alongside the password-protected archive option; private mode returns the archive directly, with no separate export step.

Who this is for

Private mode and retention controls exist because some recordings are too sensitive to sit on a server, however briefly: a source interview, a confidential meeting you’d rather not route through a notetaker bot, a clinical conversation.

• Journalists can run a source interview through private mode and walk away with a password-protected archive that only they can open, without a saved transcript in their account.
• Legal teams can set a short retention window on client and case recordings and keep the receipt returned when they delete a single transcript through its dedicated flow.
• Researchers handling interview or field-recording data can combine merged uploads with private mode to process related sessions without adding them to a searchable account history.
• Health-adjacent users recording sensitive conversations, such as medical dictation or patient interviews, can use private mode’s speech-recognition-only path to skip saved transcript storage and post-processing.

These are capabilities, not certifications. If your organization has specific compliance requirements, check them against what’s described here.