Legal

Privacy Policy

Last updated August 20, 2026

AuthentiCast helps podcasters, audiobook producers, audio-drama creators, and authors detect when their work is copied or re-uploaded without permission — for audio, and for books, articles, and manuscripts. This policy explains what data we collect, how the detection actually works, and the choices you have. We've written it in plain language on purpose.

1. Who we are

AuthentiCast ("AuthentiCast", "we", "us") provides an audio content-authenticity and theft-detection service. You can reach us any time at info@authenticast.org. This policy covers the AuthentiCast marketing site, the customer dashboard, and the AuthentiCast API.

2. Information we collect

Account information

Your email address (used to sign in and to send account and detection notifications)
Your name or account/display name
Authentication data managed by our infrastructure provider (Supabase) — including a hashed password if you sign up with email, or a provider identifier and the basic profile details they release (name and email address) if you sign in with Google, Apple, or Spotify. We do not receive your password from those providers, and signing in with Spotify does not give us access to your Spotify listening data, playlists, or library
API keys you generate (we store a one-way hash and a short non-secret prefix, never the full key after it's shown to you once)

Audio you submit

When you add a track to your catalog or run a check, you provide audio — either as an uploaded file or as a public URL we fetch. We compute an acoustic fingerprint (a compact numeric signature) and store it along with its duration and a reference label you choose (for example an episode name). We do not retain the original audio file after processing, and the fingerprint is not a reconstructable copy of your audio. We also use a "script match" detection method — comparing a short transcript of the opening portion of your audio against other content (your own catalog, the shared corpus, and other customers' catalogs, as described in Section 3) to catch work re-recorded in a different or AI-generated voice, which the fingerprint alone can't detect. We generate this transcript using a third-party transcription API (OpenAI — see Section 5); we store the transcript and a derived text-matching signature so future checks can be compared against it, and separately cache transcripts keyed to the audio's checksum (not to your account) to avoid re-transcribing identical audio — entries in that cache are automatically deleted 90 days after they are created, by a scheduled job that runs daily, and a cached transcript that has passed 90 days is never used even in the window before the job removes it. This method compares literal repeated word sequences — it's built to catch verbatim reuse of a script, not a paraphrased retelling of the same story.

Books, manuscripts, and other text you register

If you use AuthentiCast's book and text protection, you can register written works — published books, articles, or unpublished manuscripts — so we can detect copying of them. What we store depends on the registration mode you choose for each work:

Full-text registration — we store the work's text, split into passages, together with the fingerprints used for matching. This lets us show you which passage matched when we find a copy.
Hash-only registration — we store only the fingerprints, not your text. This is always how an unpublished manuscript is registered — it is not a default you can override. If you register a work as a manuscript and explicitly ask for full-text registration, the request is refused rather than quietly downgraded, and our database independently rejects any attempt to store a manuscript with its text. Detection works the same way; what you give up is that we can't show you the matching words (only which passage matched and roughly where), and the excerpt-based search described below can't run for that work, since there's no stored text to search with.

Scanned documents and OCR. If a PDF you register has no readable text layer — a scan or a photographed page — we can only match it by first converting the image to text. When that happens, the document's contents are sent to Anthropic's API to be read back as text (see Section 5), and the resulting text then re-enters the ordinary pipeline above and is stored according to the registration mode you chose. This applies to unpublished manuscripts too, including hash-only ones: hash-only governs what we keep afterwards, not whether the document had to be read in the first place. OCR is spend-capped per account and per document, and runs only for accounts that have an OCR budget set — if yours doesn't, a scanned PDF is refused rather than silently sent anywhere.

What hash-only does and doesn't mean. It means we don't keep your text — the field is left empty, not encrypted. It is not a claim that your text is cryptographically protected: the fingerprints are fast, non-cryptographic hashes of short word sequences, chosen for matching speed, not secrecy. Someone holding the stored fingerprints couldn't read your work from them, but could check whether a phrase they already guessed appears in it. If that distinction matters to you, treat hash-only as "we do not store your text" rather than "your text is encrypted."

We claim no rights in what you register. You keep every right in any work you register with us. AuthentiCast claims no ownership of it, no license to publish, display, distribute, adapt, sell, or excerpt it, and no right to use it to train any model, ours or anyone else's. The only thing we do with your work is process it to detect copying of it, on your behalf, for as long as you keep it registered — and that permission ends the moment you delete the work or close your account. You may only register a work you own or are otherwise authorized to protect, as described in our Terms of Service.

Deleting a registered work. You can delete any registered work from your dashboard or via the API at any time, and you don't need to contact us. Deleting a work removes its stored text, its passages, its match history, and any search excerpts taken from it, immediately — and also removes it from the comparison corpus, so it can no longer be matched against. This immediate deletion applies to our live database; our infrastructure provider retains backups for disaster recovery for a limited period before they age out, the same as for every other type of data in this policy.

Content sources you ask us to watch

If you set up a "content source," you give us the titles and creator/show names you want us to watch for. We use these as search terms for the automated sweep described in Section 3.

Detection results

We store the matches we find for your account — what was matched, where, a similarity score, and when — so you can review them in your dashboard.

Billing information

Payments are processed by Stripe. We store a Stripe customer identifier, your plan, prepaid credit balance, and a record of purchases and renewals. We never receive or store your full card details — those go directly to Stripe.

Usage & technical data

API and dashboard usage (which operations you call and how often, for metering and limits)
Standard request metadata such as IP address (used for rate-limiting and abuse prevention) and server logs

3. How our detection works (and what that means for data)

Detecting stolen audio requires us to look beyond your own account. This is the part of our service most different from an ordinary app, so we want to be explicit about it.

AuthentiCast operates automated crawlers that scan publicly available sources to build a shared reference corpus and to look for possible unauthorized copies of customer audio:

Legitimate audio hosts — podcast RSS feeds, Archive.org, and similar public catalogs. We fetch enough of each file to compute a fingerprint, which is added to a shared corpus.
Title sweep (text only) — for the specific titles and creator names you ask us to watch, we search public results across YouTube, TikTok, and, on a search-only basis, known piracy/file-sharing domains. This sweep is text only — titles, handles, search-result snippets, and URLs. We do not download, stream, or fingerprint any media from these sites.
Known piracy / file-sharing sources — fetch-and-fingerprint (not yet active) — a separate mechanism, built but paused pending legal review, that would fetch and fingerprint publicly reachable audio from sites associated with pirated content, the same way we do for legitimate hosts above. It is not currently running against any real site.
Book & manuscript discovery (text only, optional per work) — if you turn this on for a registered work, we search the web for pages that quote a short excerpt (about 14 words) from it, and for listings that offer it for sale or download under its title and author. This uses a search engine and, for retail listings, the Google Books catalog (see Section 5). This is text only — search queries, result titles, snippets, and URLs. We do not fetch, download, or read the pages a search returns; we only see what the search engine tells us about them. The excerpt-based search can't run for a hash-only manuscript, since there's no stored text to search with — those works can still be searched by title and author.

Separately, when you register catalog content or a text work, or run a check, its fingerprint (or, for text, its passage-level signature — and, where script matching applies to audio, its derived text-matching signature) is also compared against every other AuthentiCast customer's registered catalog or works — not just the shared public corpus above — to catch cases where two customers' registered content appears to be the same work. Neither party's identity is revealed to the other from this comparison alone. If our review finds enough evidence that one party's content was copied from the other's, both parties are notified and can provide context or appeal before any final decision is made; only a confirmed, human-reviewed finding can result in permanent enforcement action. See our Terms of Service for what that enforcement can include.

The reference corpus (fingerprints from crawled legitimate hosts) is shared across all AuthentiCast customers — that shared library is what makes detection work. Your own catalog fingerprints and content sources are private to your account and are never shown to other customers directly. As described above, they are compared against other customers' catalogs to detect likely duplicate registrations — but no other customer ever sees your account details, and neither party's identity is revealed to the other unless and until a match is confirmed through review.

4. How we use your information

To provide the service — fingerprint your audio, run checks, and surface matches
To run the automated sweeps for the content sources you configure
To send you notifications — match alerts, and account/billing emails (payment failed, renewal, cancellation, approaching your usage limit)
To meter usage, enforce plan limits, and process billing
To prevent abuse, secure the service, and comply with law

We do not sell your personal information, and we do not use your audio, text, or matches to train models for unrelated purposes.

5. Third-party services

Stripe — payment processing and billing. Governed by stripe.com/privacy.
Resend — delivery of our transactional and alert emails. Your email address is shared with Resend to send you those messages.
Supabase — our hosting, authentication, and database provider, where account data, fingerprints, transcripts, and match records are stored.
OpenAI — powers our "script match" detection (see Section 2): we send the opening portion of your audio to OpenAI's API to generate a transcript. OpenAI processes that data to provide the transcription service and, under its API terms, does not use it to train its models. Governed by openai.com/policies/privacy-policy.
Anthropic — powers two things. First, the in-app help assistant: when you use it, your messages in that conversation, together with your plan name and current usage figures, are sent to Anthropic's API to generate a reply. Second, OCR for scanned documents (see Section 2): if a PDF you register has no readable text layer, that document's contents are sent to Anthropic's API to be converted to text — this includes unpublished manuscripts, and it is the one case where a work you registered leaves our infrastructure. Anthropic processes that data to provide the service and, under its API terms, does not use it to train its models. Governed by anthropic.com/legal/privacy.
Serper — powers the title, excerpt, and retail-listing searches described in Section 3. We send short search queries — a title and author, or up to about a 14-word excerpt from a work's text — to look for matches. We never send a whole work, and never an excerpt from a hash-only manuscript.
Google Books — used for the retail-listing search in Section 3, to check whether a registered book's title and author appear in book-selling listings elsewhere.
Public sources we crawl or search — described in Section 3. We only access publicly reachable pages and files, or query search engines about them; we don't fetch pages found through book/manuscript discovery.

6. Cookies & local storage

The dashboard uses your browser's local storage to keep you signed in. We do not use third-party advertising or cross-site tracking cookies.

7. Data sharing & disclosure

We share personal data only: with the service providers above so they can perform their function; when required by law or valid legal process; to protect the rights, safety, and property of AuthentiCast, our customers, or the public; and in connection with a merger, acquisition, or sale of assets (you'll be notified). We never sell your data.

8. Data retention

Two kinds of data are deleted on a fixed schedule regardless of your account status:

Cached transcripts — 90 days. The checksum-keyed transcript cache described in Section 2 is swept daily and entries are deleted 90 days after they are created. This cache exists only to avoid paying to transcribe the same audio twice; deleting an entry costs nothing but a re-transcription, and removes no detection ability and no record you can see.
Search excerpts in sweep results — 180 days. For each title or excerpt sweep hit we record, the search text we sent and the snippet the search engine returned are cleared after 180 days. The hit itself — what was found, where, how closely it matched, and when — is part of your match history and is kept as described below.

Everything else — your account data, fingerprints, registered works, and match results — we keep for as long as your account is active. You can export your data or close your account at any time from the dashboard. Closing your account deactivates it — it cancels billing, deactivates your API keys, and stops all processing — but does not itself erase your stored data. To request full deletion of your personal data, email info@authenticast.org and we'll act on it, subject to what we're required to keep for legal, tax, or fraud-prevention purposes.

Registered books, articles, and manuscripts work differently, and it's a stronger guarantee: as described in Section 2, deleting a registered work from your dashboard or via the API removes its stored text, passages, match history, and search excerpts immediately — you don't need to close your account or contact us to do it.

9. Your rights (GDPR & CCPA)

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. You can access and export most of your data yourself from the dashboard, or contact us at info@authenticast.org and we'll respond within the time your law requires.

10. Security

We use encryption in transit, hashed passwords and API keys, scoped access to each customer's own data, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your data and to limit what we collect in the first place.

11. Children's privacy

AuthentiCast is a business tool intended for creators and companies, and is not directed to children. We do not knowingly collect personal information from anyone under 16.

12. Changes to this policy

We may update this policy as the service evolves. We'll change the "last updated" date above and, for material changes, notify you by email or in the dashboard.

13. Contact us

Questions about privacy or your data? Email info@authenticast.org.