What happens when you paste a link.
The link you paste is sent to this site’s Cloudflare-hosted functions. A usable cached result may be returned before we contact the source platform or run speech recognition; otherwise, the request follows the processing steps below. For YouTube, if YouTube asks for verification or refuses the first request, the video ID may also be sent to a relay server we operate; that relay makes its outbound request to YouTube through a third-party ISP proxy. For TikTok and Instagram, the request is made from Cloudflare.
If captions already exist
For YouTube and TikTok, the site asks the platform for an available caption file and reads the text. YouTube requests go directly from Cloudflare first; if YouTube asks for verification or refuses the request, they may be retried through our relay. TikTok requests go directly from Cloudflare. The captions may have been uploaded by the creator or generated by the platform.
When speech recognition is used
For TikTok without captions and for Instagram videos, the site downloads the video, keeps only its audio track, and sends that audio to Whisper, a speech recognition model running on Cloudflare Workers AI. The words come back as text.
When we fetch from the source platform, we can retrieve only material it makes available to us. A previously cached YouTube, TikTok or Instagram transcript may still be returned until its cache expires or access is disabled through this service, even if the source video later becomes private or is removed. A report does not automatically purge cached results. To report material you believe should no longer be available through WatchToText, use our copyright complaint instructions.
If you upload a file, your browser turns its audio into short pieces and sends each piece to our server, which passes it to Cloudflare Workers AI for speech recognition and returns the text. We do not store the audio or the text. A transcript you paste from YouTube stays in your browser and is never sent to us.
What is kept and for how long.
- No accounts or sign-up, so there is no user profile to store.
- No per-user history of pasted links or list of past jobs. The edge cache described below is not tied to an account.
- Uploaded audio, video and uploaded-file transcript text are processed for the request and are not stored. Audio fetched from TikTok or Instagram is not retained after processing. Public YouTube captions and successful TikTok/Instagram transcript results, including basic metadata such as the video identifier, title, caption tracks and public creator name when supplied, may be cached at the edge for up to 24 hours. These caches use the platform and video identifier (or a TikTok short-link code), with language and track type where applicable; they are not keyed by the visitor. A request for the same video may be served from that cache. Download buttons create a file on your device.
- For YouTube only, responses reporting no caption track, empty captions or an unplayable video may be cached for up to 6 hours. An unplayable response means the video could not be checked; it does not establish that captions do not exist. Other YouTube failures and failed TikTok/Instagram requests are not stored in this result cache.
- Nothing is sold, and there is no user profile to sell.
Hosting and network providers may keep standard request logs, such as the time of a request, the address it came from, and the request URL; the URL for a YouTube request to this site contains the video ID. These logs are used for security and troubleshooting.
Our rate-limit counters use an identifier derived by hashing the requesting IP address, rather than storing the raw address in the counter key. Minute counters expire after 2 minutes; per-file upload counters include a random upload ID and expire after 10 minutes; upload-frequency counters expire after 20 minutes.
Daily request counts, first-success markers and per-network usage allowances use the same IP-derived identifier with the UTC date. Their entries expire at the end of that UTC day plus one minute, at most 24 hours and 1 minute after creation. Changing the date changes the counter key; it does not change the hash itself. These daily counters help enforce usage limits and estimate how many networks receive a transcript, rather than identifying individual people.
A separate site-wide speech-seconds total contains no visitor identifier and expires 48 hours after its last update.
The services involved.
Cloudflare
Cloudflare hosts the site and runs the Pages functions, result caches, usage counters and the Workers AI speech-recognition step. It also carries the tunnel connection to the relay described below.
Our server-side usage events in Cloudflare Workers Analytics Engine record the platform, result category, processing route, error category, production or preview environment, daily request-count bucket, first-success marker, processing time and speech seconds. They do not include the requesting IP address or its hash, video identifiers or links, file names, audio or transcript text. These events are used to measure reliability and capacity. Cloudflare currently retains Analytics Engine events for three months; this is separate from the shorter cache and counter periods above.
Relay on Vultr
When YouTube asks for verification or refuses the first request for a caption track, we may retry it through a small relay server we operate, hosted by Vultr. The relay receives the video ID and the caption URL from our code; we do not send your IP address, uploaded files, or TikTok/Instagram audio to it. Its logs contain only the time, endpoint, upstream status and elapsed time, not IP addresses, video IDs or caption text.
IPRoyal
The relay makes its outbound request to YouTube through an ISP proxy operated by IPRoyal. The connection is HTTPS; IPRoyal carries it but does not receive your uploaded files or TikTok/Instagram audio.
YouTube, TikTok, or Instagram
YouTube receives the request for the video either directly from Cloudflare or through the relay and proxy described above. TikTok and Instagram receive the request from Cloudflare.
Google Analytics 4
Google Analytics 4 runs on the site’s public pages (the 404 page does not load it). It records page views and these interaction events: transcript_request, transcript_success, transcript_error, upload_start, upload_error, fallback_shown, daily_cap_reached, copy_transcript and download_transcript. Event parameters are limited to platform, mode, transcript source, interaction path, error code, reason, duration or segment bucket, and file format; our custom events do not include the video link, video ID, file name, or transcript text. GA4 sets its own cookies (the _ga family) to tell repeat visits apart. Google says GA4 does not log or store individual IP addresses. If enhanced measurement is enabled in the GA4 property, Google may also record outbound clicks, scrolls, file downloads and form interactions; a click on the “Open the video on YouTube” link sends a target URL that contains the video ID.
Advertising and affiliate links.
WatchToText has integrated Google AdSense and may display ads supplied by Google and its advertising partners. We do not currently use affiliate links.
Google is a third-party advertising provider. Google and other third-party vendors may use cookies to serve ads based on your earlier visits to WatchToText or other websites. Google's advertising cookies allow Google and its partners to personalise ads based on those visits. Cookies and similar technologies may also be used to measure advertising performance and help prevent fraud, depending on your settings and any required consent.
When Google's advertising services are loaded, your browser may share information with Google, including the page URL, your IP address, cookies and other identifiers. Read how Google uses information from sites and apps that use its services for more information.
You can manage or turn off personalised advertising through Google Ads Settings. You can also use Digital Advertising Alliance consumer-choice tools to opt out of personalised advertising from participating companies. Opting out of personalisation does not remove all ads. Your browser settings also let you manage, delete or block cookies.
Your data rights and privacy requests.
Depending on your location and the law that applies, you may be able to ask us to confirm whether we hold personal information about you, access it or receive a copy, correct it, ask us to delete it, restrict or object to certain processing, or receive it in a portable format where that right applies. You may also withdraw consent where we rely on it for the relevant processing. Where applicable, you may complain to your local data-protection supervisory authority.
To make a privacy request, email [email protected] or use our contact page. Briefly describe your request and include an email address or other contact detail so we can reply. Send only information reasonably needed to locate the data you mean. Do not send passwords, identity documents, full recordings, or complete redemption codes. We may ask for the minimum additional information needed to verify a request or protect another person's rights.
We can act only on information we actually hold and can reasonably associate with your request. We cannot provide or erase information we do not retain; see the storage section for what is kept and for how long. Content that remains only in your browser can be removed there. A request to us does not remove information held independently by YouTube, TikTok, Instagram or another provider. We may need to retain limited information to meet legal obligations, protect service security or resolve disputes. Where this limits a request, we will explain why.
We respond without undue delay and within the time required by applicable law, normally within one month. If a lawful extension is needed, we will explain why and when to expect a response. If we cannot act on a request, we will explain the reason and any available complaint or review options.
Copyright reports and support messages.
If you email us, we receive the message, your contact details and any supporting information you choose to send. A copyright report may include your signature, mailing address, telephone number, email address and the work or material at issue. We use this information to review and respond to the request, address misuse and handle disputes.
We keep correspondence while the request is being handled and for as long as reasonably needed to document the response, resolve related disputes or meet legal obligations. Necessary details may be shared with affected parties, service providers or authorities when needed to handle the report or comply with law. Do not send passwords, identity documents or full recordings unless specifically requested; use email rather than the public issue tracker for private reports.
A policy that follows the product.
If the way the site handles data changes, this page changes with it, and the date at the top is updated.
Questions about this policy can go to the address on our contact page.