Cookie Policy

We use one login cookie, a Cloudflare bot-protection cookie, and browser storage keys that remember choices you made or keep the feature you are using working. Stripe sets its own cookies on its checkout pages, and Google's sign-in script loads on the sign-in pages. We run analytics, but it is our own software on our own server in Bulgaria and it sets no cookies at all.

For marketing attribution we store nothing on your device unless you press Accept on the advertising-cookie banner, which lets Meta's pixel set two cookies (section 6A). The referral cookie and the first-touch source key were removed in October 2026 (section 6). Section 1 onwards is the binding text.

This Cookie Policy explains what Audexum stores on your device, or reads from it, when you use audexum.com. It supplements our Privacy Policy.

"Cookies" here is shorthand. The law that applies — Article 5(3) of the ePrivacy Directive (2002/58/EC), transposed in Bulgaria by Article 4a of the Electronic Commerce Act (Закон за електронната търговия) — covers any storing of information on your device or access to information already stored there, and, as European regulators read it, a script on the page reading information from your browser and sending it to us even when nothing is stored. That includes browser localStorage. So this Policy lists our localStorage keys next to our cookies, in one table, instead of hiding them.

This is everything. If something is stored on your device by us or by a third party we embed, it is in this table.

Our analytics script also reads one localStorage key, umami.disabled, to check whether you have switched analytics off. It never writes it. You set it yourself — see section 4.

The Dictation Studio keeps a local history of what you dictated in the dictation-history key in your browser's localStorage. That is your own device, not our server. Anyone who can use your browser profile can read it, and clearing your browser storage deletes it permanently — we cannot recover it for you.

This is separate from the transcripts we hold server-side when you are signed in. Those are covered by the retention table in our Privacy Policy.

Every page on audexum.com loads Umami, an open-source web-analytics tracker. We used to say we ran no product analytics platform. That was wrong, and this section replaces it.

Facts, so you can judge it for yourself:

• It is self-hosted. The software and its database run on our own hardware in Bulgaria. The script is served from audexum.com itself, at /_umami, and the measurements are sent back to the same path. No analytics company receives your data, because there is no analytics company involved.
• It sets no cookies and writes nothing to your device. We have checked the served script; it contains no storage writes.
• What each measurement contains: the page address you are on, the page title, the referring address, your screen size, your browser language, and the name of the event (for example, a page view, or that a generation finished).
• Only if you accept "Analytics & recording", measurements made while you are signed in carry your account's internal ID (a random string, not your email address). Without that consent our server removes any account ID, cuts the referring address to its site name, and drops every link parameter except the utm_ campaign tags that say which ad or post brought you.
• Your IP address is passed to the analytics component but not stored by it. The beacon goes through our own server, which hands the analytics component your IP address and browser user-agent. It uses them to work out your approximate location (country, region and city), your browser, operating system and device type, and an anonymous session identifier, and it stores those results, not the IP address. Our web-server logs still see your IP, as any web server does; that is covered by the Privacy Policy.
• It does not follow you to other websites, does not build a profile, and is not shared with advertisers.

Turning it off. One button switches off all measurement on this browser, the anonymous kind included:

It stores the localStorage key umami.disabled, which the tracker, our event trail and session recording all check. Any browser content-blocker that blocks the script also works; nothing in the Service breaks when it is blocked.

Our own server-side records. Separately from Umami, our server keeps two records of how the site is used, so we can see where people get stuck — for example, signing up and never making a first generation. Neither stores anything on your device:

• a request log: for each request your browser makes to our servers, the address it asked for (without the parts that identify a specific file or record), whether it succeeded, and how long it took. Kept for 30 days;
• an event trail: named product events such as "opened the Studio" or "ran out of credits", plus how you moved through the site — which pages you opened and for how long, how far down you scrolled, which buttons and links you clicked (by their label, such as "Generate"), repeated or unanswered clicks, the name of the form field you reached (never what you typed in it), errors the page hit, and a few signals of attention: how long until your first click or scroll, whether the pointer moved at all, which sections of the page came into view, how fast the page loaded, and the size of the window. Labels are never taken from your own content: inside your generations, transcripts and chat we record only that a click happened. With "Analytics & recording" accepted it also records how long you rest the pointer on a button or card and how long each video plays, and is kept for 13 months.

How much of this depends on your answer. If you accept "Analytics & recording", the event trail follows your visit, recognises you on later visits for up to 13 months, and is attached to your account if you sign up. If you reject it or never answer, and you are in the European Economic Area, the United Kingdom or Switzerland (or we cannot tell), the trail is anonymous audience measurement only: it never carries your account ID, is never attached to an account, we look at it only as totals, and the random ID that ties one tab's pages together is erased within 24 hours. Outside those countries, without consent, we keep the per-visit trail on the basis of our legitimate interest in finding where the site fails people (Privacy Policy, section 6); you can object with the button above.

We never record keystrokes or anything you type.

Session recordings, only if you accept. If you accept "Analytics & recording" and are not signed in, we may also record how the page changed during your visit — what was on screen, scrolling, pointer movement and clicks — so we can replay where people get stuck. Every form field is masked in your browser before anything is sent, your own transcripts and generations are masked, and recording stops for good as soon as you open the Studio, library or dashboard. Recordings stay on our own servers, are never shared or sold, and are deleted after 30 days. Without your consent nobody is recorded, in any country.

If your browser sends Global Privacy Control, or you have switched analytics off with umami.disabled, neither the page-movement part of the event trail nor session recordings are collected at all.

With your consent, both are linked to your account when you are signed in, and otherwise to the visitor ID above; if you create an account, that visit's records are attached to it. Without consent, see "How much of this depends on your answer" above. Both are included in your data export (Dashboard → Download my data) and deleted with your account.

Our sign-up form, and our feedback form when you are not signed in, can show a Cloudflare Turnstile human check to keep automated abuse out. Turnstile is a third-party browser embed: when it is shown, your browser loads code from Cloudflare, and Cloudflare receives your IP address and information about your browser in order to decide whether you are a person. It may keep a short-lived token on your device for the rest of that browsing session.

Cloudflare is listed on our /subprocessors page. We treat this as strictly necessary: without an abuse check, open sign-up and an open feedback form are not safe to run.

Article 5(3) of the ePrivacy Directive lets us store something on your device without asking only where it is strictly necessary to provide the service you asked for. Everything else needs your prior, freely given, specific and informed consent.

Until 5 October 2026 one item did not meet that test: aff_ref, a 30-day referral cookie. We removed it. A referral code from a ?ref= link is now held only in the page's memory and sent with your signup; nothing is stored on your device for it.

Until 4 October 2026 a second one did: aud_signup_source, a localStorage key that remembered where you first came from. We removed it. Where you came from is now held only in the page's memory for the visit, and the old key, together with two companions that recorded the landing page and its link parameters and a random visitor ID, is deleted from your browser the next time you open the site.

Everything left in section 2 except Meta's two cookies is, in our assessment, strictly necessary for something you asked for, or remembers a choice you made. Meta's pixel and the "Analytics & recording" features are not, so they sit behind the banner, each with its own switch, and run only if you accept. If you think an item does not meet that test, tell us at the address in section 10.

We advertise on Facebook and Instagram. The banner asks whether we may measure those ads. If you press Accept, we load Meta's pixel, which tells Meta which of our public pages you open: the home page, pricing, about, download, our comparison, blog and free-tool pages. It never sends a page view from sign-in, password reset, verification, your dashboard, the app, share pages, or our TikTok and Discord voice tools. Once loaded, Meta's script stays in that browser tab until you close or reload it, but nothing is sent from those other pages. On those public pages the pixel also tells Meta when you click to download our desktop or Android app, and when you join the Android waitlist (not the email address you enter).

Our server tells Meta when you create an account, when you open a checkout, and when you buy a plan or a credit pack (with the amount and currency), together with your IP address, your browser user-agent, the _fbp and _fbc identifiers and an SHA-256 hash of your email address, which Meta matches to its own accounts (hashing does not make it anonymous). If you start a monthly subscription after accepting, our server also reports each renewal payment (amount, currency and the email hash only) for 180 days after the day you subscribed, or until you press Reject in Cookie settings while signed in, whichever comes first; if you reject while signed out, write to us at the address in section 10 and we stop. Signups that start from our TikTok and Discord voice tools are never reported. We never send Meta your text, audio, prompts, transcripts or anything you generate.

Meta may link this to your Facebook or Instagram account and use it for its own purposes, including choosing which ads to show you, under its own privacy policy. You can control the ads Meta shows you in your Meta ad preferences and opt out of interest-based advertising more broadly at youronlinechoices.eu. The Privacy Policy, sections 6, 8 and 9, explains the legal side.

If you press Reject, or your browser sends Global Privacy Control, none of this happens and Audexum works exactly the same. You can change your answer at any time with Cookie settings, at the bottom of every public page, in your account menu, or right here: Cookie settings. If you withdraw, we delete Meta's two cookies from your browser.

We do not set, and do not knowingly let any third party set:

• advertising cookies, retargeting pixels or social-media tracking pixels, except Meta's pixel after you press Accept (section 6A);
• the TikTok pixel, LinkedIn Insight tag, X / Twitter pixel, or any other ad-network pixel;
• Google Analytics or Google Tag Manager;
• cross-site behavioural tracking or browser fingerprinting, except by Meta after you press Accept (section 6A);
• keystroke-recording tools. The session recordings in section 4 mask every form field and never run for visitors from the EEA, the UK or Switzerland;
• anything that shares data with data brokers or ad exchanges.

We do run analytics — see section 4. We are not claiming otherwise; we are claiming that it is ours, cookieless, and does not follow you off this site.

Every browser can block cookies, block scripts, and clear site data. On audexum.com, "clear site data" removes the cookies and the localStorage keys in section 2. Before you do, note the consequences:

• blocking or clearing audexum_session signs you out, and you cannot sign back in while it stays blocked;
• blocking Stripe's cookies stops checkout from completing;
• blocking Turnstile may stop you creating an Account or sending feedback while signed out;
• clearing dictation-history permanently deletes the dictation history held on your device — see section 3;

Do Not Track and Global Privacy Control. If your browser sends Global Privacy Control, we switch off the page-movement trail described in section 4, treat it as Reject for advertising cookies, and do not show you the banner. We do not act on Do Not Track. You can also use the analytics opt-out in section 4, or a content-blocker.

When what we store on your device changes, we update this page and the "Last updated" date at the top. Anything that needs your consent is asked for in the banner before it runs.

Questions about anything on this page, or about the consent position in section 6: [email protected]. Who we are, and how to reach us for other matters, is on /imprint.