Data and privacy
How you control your data and exercise your rights.
Self-service account deletion
Profile → Advanced settings → Delete account permanently removes your saved sessions and transcripts, every document you uploaded or translated (deleted from storage, with a follow-up sweep once any outstanding upload link expires), team membership and sign-in account, and cancels web subscriptions billed through Stripe.
Session deletion
Any saved session can be deleted on its own from the app at any time.
Data subject requests
To request access to, correction of or deletion of your personal data, email support@getseagull.com.
Data Processing Agreement
A DPA is available to customers on request.
Data minimization
Each service provider receives only the data it needs to perform its function. Analytics never include audio recordings or transcript text.
No sale of personal data
Seagull does not sell personal data or use Seagull data for third-party advertising.
One-click email unsubscribe
Marketing emails include a signed one-click unsubscribe link and work with mail apps' built-in unsubscribe buttons.
Data security
What we keep, what we discard, and how it moves.
Audio is never stored
Audio is streamed in real time to our speech provider for transcription and translation, then discarded. It is never used to train models. When you save a session, Seagull stores only the text transcript.
Encryption in transit
The Seagull API only accepts HTTPS, and live audio, captions and speech travel over encrypted WebSocket (WSS) connections.
Short-lived file links
Documents and images for translation are uploaded and downloaded through signed links that expire after 15 minutes.
Upload retention limit
Original files uploaded for document or image translation are automatically deleted from storage 7 days after upload. Translated results are kept for you to download until you delete your account.
AI and speech processing
Which models see your content, and on what terms.
No training on your content
Quick Translate, document and image translation, and automatic session titles run on Google Gemini through OpenRouter. Every request denies provider data collection, so your content is not used to train models. Google may retain request content for up to 90 days, solely for abuse monitoring.
PDFs processed on our own servers
PDF pages are rendered, read and rebuilt on Seagull's servers. Gemini receives page images and extracted text, never the original file, and no third-party OCR service is used.
Website translation on Cerebras
The Seagull browser extension, which is rolling out now, translates website text with Cerebras, which retains no data by default. Seagull runs inference on both OpenRouter and Cerebras.
Server-held provider keys
Speech and AI provider credentials stay on Seagull's servers. Apps connect through the Seagull API and never receive provider keys.
Product security
How the Seagull API authenticates and limits access.
Authenticated API
Every account endpoint requires a verified sign-in session from our authentication provider, Clerk.
Single-use streaming tickets
The desktop app opens live audio connections with single-use tickets that expire after 60 seconds, so its sign-in credentials never appear in streaming URLs. The mobile app still authenticates live audio with its session token over an encrypted connection.
Session expiry
App sign-in sessions expire after 30 days without use and after 90 days at most.
Rate limiting and request limits
Sign-in and write endpoints are rate limited, and request bodies have size limits.
Authenticated billing webhooks
Stripe events are signature-verified, and RevenueCat events must present a shared secret before any plan changes.
Browser hardening
API responses block framing to prevent clickjacking, and cross-origin requests are accepted only from Seagull's own domains.
Separated administration
Administrative operations run on separate endpoints that require a dedicated key.
Infrastructure security
Where Seagull runs and how changes reach production.
EU primary region
The Seagull API runs on Fly.io with Amsterdam as its primary region, plus machines in Tokyo and Dallas to reduce latency.
Automated testing before release
Automated test suites run on every pull request, and production deploys run from the main branch through CI.
Pinned CI dependencies
Third-party GitHub Actions are pinned to exact commit hashes.
Secrets kept out of source code
Production credentials live in hosting and CI secret stores. The repository contains only empty placeholders, and website sync refuses environment and key files.