Why your voice shouldn't transit a US cloud

When you hit record in a typical transcription app, the audio bytes leave your device, traverse a CDN, land in object storage in a US AWS region, and are read by a transcription service hosted in the same region. The app you see in the browser is a thin viewer over that pipeline. The contract you sign in the Terms of Service is the only thing standing between that audio and any other use the host wants to put it to.

A typed document gives away words. A voice clip gives away: words, vocal stress, accent, age, sometimes gender, ambient noise (so the room, possibly the city), background voices (other people in the room, unconsented), and timing patterns that biometrically identify the speaker. We are collectively unprepared for how much information an unrehearsed 90-second voice memo contains.

GDPR is strong when both the data subject and the controller are in the EU. It gets weaker the further the data physically travels. The post-Schrems-II legal landscape technically allows EU-to-US transfer under a patchwork of mechanisms, but the practical recourse if something goes wrong - notification, takedown, damages - depends on which jurisdiction's court you're in front of and how much money you can spend. The cheaper option is: don't let the data leave.

Sprachmemo runs on Hetzner in Falkenstein, Germany. The Vosk transcription model runs in the same datacentre as your audio file - no network hop between storage and inference. The transcription engine is open source so anyone can audit what it does and doesn't send anywhere. There's nothing exotic about this; we just chose a stack where 'audio stays where you put it' is the default instead of a paid feature.