How your recordings are protected
Hold the Dot is built so that the people who run it can't listen to your recordings. This page explains how that works, what the servers do see, and where the limits are.
Encrypted on your device
- Recording, speech detection (when you're speaking) and compression (Opus) happen in your browser. No audio is sent anywhere to be analysed.
- Every recording is encrypted in your browser with AES-256-GCM before it's stored, with a key that belongs to your account (the vault key). Its length and its place on the screen are encrypted the same way.
- Each encrypted recording is bound to its ID, so the server can't swap recordings without it being noticed.
Your key never leaves your device readable
- The vault key is created in your browser. The server only keeps locked copies of it: one that only your passkey can open (WebAuthn, PRF extension), or one that only your passphrase opens (stretched in the browser with Argon2id: 64 MiB, 3 passes), and one that your recovery key opens. You see the recovery key once; it isn't stored anywhere.
- There are no passwords. Signing in by email link only proves who you are; it doesn't unlock anything. Your recordings stay locked until you use your passkey, passphrase or recovery key.
- "Keep this device unlocked" stores the key in your browser in a form that can be used but not read out (a non-extractable Web Crypto key).
Before you sign up
As a guest, your recordings are encrypted with a key that exists only in this browser, and they're never sent to a server. When you create an account or sign in, they're encrypted again with your vault key and saved to your account; the device key is then deleted.
What the servers hold
| Data | Readable by us? |
|---|---|
| Your email address, when you signed up and last signed in | yes, to sign you in |
| For each recording: an ID, when it was recorded, its encrypted size | yes |
| How many recordings, and the storage they use | yes, for the limits per account |
| The audio, its length, its place on the screen | no, encrypted |
| Locked copies of your key | stored, but useless without your passkey, passphrase or recovery key |
The data is kept by Google Cloud in the Netherlands (region europe-west4): sign-in and accounts in Identity Platform (which also sends the emails), account data in Firestore, the encrypted audio in Cloud Storage. Audio travels directly between your browser and storage, through links that work for one file and a few minutes only. The page and your account's requests reach Google Cloud through our web server at holdthedot.com, which passes them on. Logs contain requests (such as "a recording was added"), never recordings or keys.
Hold the Dot uses no advertising, no analytics and no tracking cookies. Your browser keeps: the encrypted recordings, your key (only if you keep the device unlocked), your sign-in (by Google's sign-in library) and your settings.
Good to know
- Losing every way in means losing your recordings. If you lose your passkey or passphrase and the recovery key, nobody can recover them, us included.
- You trust the page's code. The encryption happens in code that holdthedot.com delivers to your browser. A changed page could in principle read recordings while they're unlocked.
- Metadata is visible: that you have an account, how many recordings, when they were made and how big they are.
- Shared computers: guest recordings in a browser go to whoever signs up or signs in there next.
Deleting your data
A line dropped on the bin is deleted on the server too. Account menu → Delete account removes your recordings, the locked copies of your key, your account data and your sign-in from our servers, and the copies in this browser. Passkeys you made for Hold the Dot stay in your password manager; you can remove them there.