Trust centre
Trust is the product.
playbakk records real conversations, so privacy and security are not features we add later. This page brings together how we protect your account, your media and the people you talk to — and links to the detail.
At a glance
MFA for every account
An authenticator app (TOTP) is required before anyone can open the workspace. There is no way to switch it off.
Local-first media
Recordings, edits and captions are stored in your browser on your device. They are never uploaded automatically.
Guests excluded by default
The other person is removed from clips unless they approve inclusion through a consent link, backed by a signed receipt.
No tracking
No advertising or analytics cookies on the website or in the app.
Account protection
- Two steps to sign in: ChatGPT sign-in, then a six-digit code from your authenticator app. playbakk never sees your ChatGPT password.
- Authenticator secrets are encrypted with AES-256-GCM before they are stored, bound to your account so they cannot be moved to another one.
- Recovery codes and session tokens are stored only as SHA-256 hashes. You get eight single-use recovery codes; each works once.
- Replay and guessing protection: a code that has already been used is rejected, and repeated attempts are rate-limited.
- Sessions you control: a verified browser session lasts up to 12 hours. You can see and revoke sessions — one or all — from your account.
- Hardened cookie: the verification cookie is HTTP-only, HTTPS-only, and SameSite=Strict. Account changes are rejected if they come from another site.
Your media
- Recordings live in a separate local workspace for each signed-in account, in your browser’s storage. They are not synced between devices and we cannot see them.
- This is separation, not encryption: anyone with access to your computer account or browser profile could access them. Keep your device locked.
- Face detection for auto-framing runs on your device. The detection software is downloaded from public CDNs; no media is sent to them.
- Cloud transcription and AI editing are switched off. If they are introduced, they will need your explicit choice each time.
- You can move your workspace between browsers with a portable
.playbakkarchive whose contents are checksummed with SHA-256.
The other person
Consent receipts are signed with Ed25519 and checked before every export that includes someone else. They expire (30 days by default, 90 at most) and can be withdrawn by the other person at any time. We store no guest email and no media for a consent request. Rules for recording and including others are in the acceptable use policy.
Infrastructure
- All traffic uses HTTPS, with HTTP Strict Transport Security.
- The app sends a strict Content Security Policy, restricts camera, microphone and screen-sharing permissions to itself, and blocks content-type sniffing.
- Secrets such as encryption and signing keys are held as server-side environment secrets, never in source code or in the browser. Automated checks scan the browser bundle for leaked secrets.
What we don’t claim
playbakk has not yet had an independent security audit or penetration test, and holds no certifications such as ISO 27001 or SOC 2. We will publish results here when that changes. Automated privacy checks help, but they are not a guarantee of anonymity — review every clip before you share it.
Documents and contacts
- Security — how the account system works and how to report a vulnerability.
- Privacy notice and cookie policy.
- Sub-processors and our Data Processing Addendum.
- security.txt for researchers.
- Service status.
- Security: security@playbakk.com · Privacy: privacy@playbakk.com