Encrypted connections
Every page, upload and download travels over HTTPS. The site also tells your browser to connect to kotosay.com over HTTPS only, so a typing mistake or an old link cannot open an unencrypted page.
Work done in your browser
Before an upload, your browser takes the audio out of a video and compresses it. Only that audio leaves your device, and the picture stays with you. If your browser cannot do this, it sends the original file instead.
The MP4 to MP3 converter and the audio converter do all their work in your browser. Files you convert there are never uploaded.
Storage and deletion
Uploaded audio and transcripts are stored on servers in the USA. We delete the audio automatically 24 hours after the transcription is finished. Transcripts stay in your account until you delete them. You can delete a single file at any time, delete your account, which removes all its files and transcripts at once, or write to us through the contact form and ask us to delete them.
Access through your account only
Each file is tied to the account that uploaded it, or to the browser that uploaded it if you have no account. The file, its transcript and its exports open only there. An uploaded file and its transcript reach other people only when you export and send them yourself. A finished, unedited transcript from a YouTube link is also given to the next person who pastes the same link, as the privacy policy describes.
Sign-in
You sign in with a link sent to your email address. Each link works once and expires after 30 minutes. Your session is kept in a cookie that the pages' scripts cannot read, and it is sent over HTTPS only. Signing out or deleting the account ends the session.
Protections in the page
The browser receives a set of rules with every page:
- Only scripts that Kotosay serves itself, plus the analytics and bot protection scripts, may run.
- No other website may show Kotosay inside a frame, which stops pages that try to trick you into clicking.
- The site has no access to your camera, microphone or location.
- Forms send their data to kotosay.com only.
Protection against abuse
Uploads and sign-ins pass a bot protection check. The free limits are counted per account, IP address and device, which keeps automated misuse away from the service.
Payments
Card payments run through a secure checkout. Your card number goes to the payment processor and stays there.
Report a security issue
If you find a weakness in Kotosay, write to us through the contact form with the steps to reproduce it. We answer within 24 hours.