Security
Built to hold as little as possible
Live audio never touches Newey servers, and captions render in your browser. What you choose to save stays under your control — exportable, deletable, and optionally end-to-end encrypted.
Live audio never passes through our servers
Your browser connects straight to the speech recognition engine using a short-lived key, and the live transcription and translation stream comes back the same way. Newey servers handle authentication, temporary key issuance, and usage metering — they never receive, store, or relay the audio you speak or capture. Two opt-in features route different material through our servers by design: audience sharing relays caption text, and Voice to Voice relays the translated sentence and the synthesized audio it generates — both transit-only, never stored. See the data lifecycle table below for the full accounting.
Newey server
Authentication · key issuance · usage metering
Your browser
Speech recognition engine
Direct connection, least-privilege keys
The server issues a temporary key restricted to real-time transcription only, valid just long enough to open the connection. Key contents are never stored in our database; only issuance metadata is kept for auditing.
Server responsibilities kept to a minimum
For the live path, server responsibilities end at sign-in, key issuance, and heartbeat-based usage metering. Keeping live audio and the live caption stream off our servers is a design invariant of the codebase — not a configuration flag.
Opt-in features follow the same principle
Even with audience sharing on (off by default), caption text only passes through server memory for delivery — nothing is written to the database or logs, and it is discarded the moment the session ends. AI context suggestions, titles, and notes send the minimum text to an AI provider that processes it for that request only: under our data-processing agreements it is not retained on their side either, and our servers store none of it. Whatever you turn on, the principle stays the same: keep as little on the server as possible.
Data lifecycle
The categories of data the service touches — where each is processed, how it is protected, and how long it stays.
Encryption
In transit: TLS everywhere
All service traffic is encrypted with TLS — the site over HTTPS and the speech engine connection over wss, audio transmission included.
At rest on the server
Session records saved to your account are stored on managed database infrastructure, and every read and write is scoped to your account — no other user can access them. With opt-in end-to-end encryption, the server stores ciphertext only.
At rest on your device
The local cache of your records and your glossary are encrypted in this browser with AES-256-GCM. The key is a non-extractable WebCrypto key held in IndexedDB — no script can read it out, and the key never leaves your device. A fresh 12-byte IV is generated on every write. One exception to 'local only': the glossary is also mirrored to your account so the browser extension and new devices can read it.
Opt-in end-to-end encryption
Turn it on and transcript and translation bodies — the substance of your records — are encrypted on your device before upload, so the server stores ciphertext only. A random 256-bit AES-GCM master key with a fresh IV per record does the encrypting; the key is wrapped with a 6-word recovery phrase (drawn uniformly from the BIP39 wordlist) via PBKDF2-SHA512 at 600,000 iterations, a floor the server enforces. Without your phrase, the server cannot unwrap the key.
Your data, your controls
Saving is a choice, not a default — and everything you do save can be exported or erased at any time.
Private sessions
Flip the private-session toggle before you start and nothing is saved — the storage path is simply never invoked. Only ended sessions you choose to save are kept in your account.
Export everything
Download any transcript as TXT or SRT, or export your server-side data as a single JSON file — profile, connected accounts (tokens excluded), passkey metadata, session metadata, usage records, your glossary, saved records with the AI notes made from them, marketplace installs, subscription and invoice records, and key-issuance audit entries.
Delete at any granularity
Remove records one by one or all at once. Deleting your account erases everything in a single database transaction — including every sign-in credential we hold, whether OAuth tokens, passkeys, or email codes — and writes a minimal deletion audit entry (email, time) that is retained. If you signed in with Google, we also revoke Newey's Google OAuth permission at Google itself; Microsoft offers third-party apps no equivalent API, so there we delete the tokens we hold and you can remove Newey from your Microsoft account's app list whenever you like. What stays after that is only what the law requires us to keep — the deletion audit entry above and, if you bought a paid plan, the record of that purchase; the Privacy Policy sets out each one and for how long.
Rights, implemented in the product
Export implements GDPR access and portability (Art. 15, 20); deletion implements erasure (Art. 17). For anything the product doesn't cover, write to support@newey.ai.
Platform practices
Strict Content Security Policy
A CSP is enforced in production — default-src 'self', object-src 'none', frame-ancestors 'none' — blocking any origin not explicitly allowed.
Security headers
HSTS (2 years, includeSubDomains), X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy, and a Permissions-Policy that blocks camera and geolocation and limits microphone and screen capture to the app itself.
Secrets never reach the client
Master API keys and database credentials live in the server environment only, behind server-only module guards — nothing secret ships in client bundles.
No passwords to leak
We store no passwords, and there is no password to set — you sign in with Google, Microsoft, a passkey, or a one-time code emailed to you. Passkey biometrics never leave your device (only a public key and an identifier are stored), and email codes are stored hashed and expire in minutes. Authentication cookies are HttpOnly and Secure, and API requests are origin-verified.
Consent-gated analytics
Analytics are off by default in every region and run only after you consent. Ad signals are permanently denied — there are no ad cookies — and there is no session replay; you are identified only by a pseudonymous internal ID, never email or name.
Compliance posture
GDPR data-subject rights are implemented in the product itself — access and portability through export, erasure through deletion — and the service is designed and operated to comply with the data-protection law that applies where our users are: the GDPR and UK GDPR, the CCPA and CPRA in California, Korea's Personal Information Protection Act, and equivalent laws elsewhere. Details on processing, international transfers, and retention periods are disclosed in the Privacy Policy.
Our internal security program is continuously reviewed and aligned against the ISO/IEC 27001:2022 controls. We run regular internal security reviews, including adversarial testing, and confirmed findings are fixed and deployed promptly.
The control we lean on most is architectural: the less sensitive data our servers can touch, the less there is to protect. Minimizing the server's surface for sensitive data has been the design principle from day one.
Assessed by us against those laws and against the ISO/IEC 27001:2022 controls; independent certification is in progress and not yet issued.
Reporting a vulnerability
Report a vulnerability by email with enough detail to reproduce it. In scope: newey.ai, the app, the browser extension, and the desktop app. We do not pursue legal action against anyone who reports in good faith, stays within their own account and data, and gives us reasonable time to fix the issue before publishing. Our security.txt carries the same contact.
Related pages
Whatever you watch, whoever you talk to
Whoever you talk to, wherever you are, connect with people everywhere in your own language.