← Back to RecATab

Privacy Policy

Last updated: April 2026

Overview

RecATab is a screen and audio recorder with microphone mixing and webcam overlay capabilities. Recording and processing happen entirely in your browser. You can optionally share recordings via a temporary link, which uploads the recording to our servers.

Recording (Local Processing)

When you record, all capture and processing happens locally in your browser using ffmpeg.wasm. No data is transmitted to any server during recording. Your recordings never leave your device unless you explicitly choose to share them.

Sharing (Optional Upload)

If you choose to share a recording, the video file and a thumbnail image are uploaded to Cloudflare R2 storage. Shared recordings are automatically deleted after 7 days. You can also manually delete a shared recording at any time from the “Shared Videos” panel. When a shared recording is deleted, all associated data (video, thumbnails, comments, and reports) are permanently removed.

If you enable password protection on a shared recording, the password is hashed using PBKDF2 before storage and is never stored in plaintext.

Comments

Viewers can leave comments on shared recordings. Comments include a display name (chosen by the commenter) and the comment text, anchored to a timestamp in the video. Comments are stored alongside the shared recording and are deleted when the recording expires or is manually deleted. We do not store the IP addresses of people who leave comments.

Transcripts (Local Processing)

Viewers of shared recordings can generate a transcript by clicking the Transcript button in the player. Transcription runs entirely in your browser using an open-source Whisper speech-recognition model. The audio is never sent to any transcription service. The model file is downloaded from Hugging Face's CDN on first use and cached by your browser for subsequent runs. Transcripts are held only in the current browser session and are not persisted on our servers; you can optionally download them as plain-text or WebVTT files.

Abuse Prevention

To prevent spam and abuse, we temporarily use your IP address (as provided by Cloudflare via the CF-Connecting-IP header) for rate limiting on upload, comment, and report requests. This use is in-memory and ephemeral — IP addresses are not written to our database and are not retained between server restarts.

Browser Permissions

RecATab may request access to your screen (via Screen Capture API), microphone, and camera through standard browser permission prompts. These streams are processed entirely on your device and are never transmitted to any server. Camera and microphone access is only activated when you explicitly enable the corresponding toggle, and streams are released as soon as recording stops.

Local Storage

RecATab uses your browser's Origin Private File System (OPFS) to temporarily store recording data during processing. This data is stored locally and automatically cleaned up after use. RecATab also uses localStorage to remember your shared video links, display name for comments, per-comment deletion tokens (so you can remove your own comments later), and theme preference. The browser's Cache Storage holds the downloaded Whisper model used for local transcription. No cookies are used for tracking.

Third-Party Services

RecATab uses the following third-party services:

  • Cloudflare Pages, R2, and D1 — hosting, file storage, and database for the sharing feature. Subject to Cloudflare's Privacy Policy.
  • Cloudflare Turnstile — captcha verification to prevent abuse when sharing recordings and posting comments. No personal data is collected beyond what is necessary for bot detection.
  • ffmpeg.wasm — loaded from a CDN for media processing. Does not transmit any of your data.
  • Hugging Face — hosts the open-source Whisper speech-recognition model that is downloaded to your browser on first transcript generation. Only the model weights are fetched; no audio or personal data is sent. Subject to Hugging Face's Privacy Policy.

Data Retention

  • Local recordings: stored only on your device, never transmitted unless shared.
  • Shared recordings: automatically deleted after 7 days.
  • Comments: deleted when the associated recording expires or is deleted.
  • Abuse reports: deleted when the associated recording is deleted.

Contact

If you have questions about this privacy policy, please contact us at support [at] recatab.com.