We treat your audio, transcripts, and credentials as the most sensitive things we handle. This page explains how — and how to report a problem.
ClassEve-hosted website and API traffic uses HTTPS, with HSTS on the public web origins. Self-hosted developer tools that deliberately bind to loopback HTTP are outside that statement and must not be exposed as remote services without a separate TLS and authentication boundary.
Browser sessions use short-lived signed access tokens. Paired native apps also receive per-device refresh credentials that can be revoked separately or in bulk from the dashboard. Current native clients do not yet enforce hardware-bound device proof, so a copied refresh credential remains a bearer credential until it is rotated, expires, or the device is revoked.
On native apps, credentials are kept in the strongest secure store the operating system provides. If no hardened store is available, the app fails closed rather than writing tokens to disk in plaintext.
The current Lven Android betas use an Accessibility Service for cross-app text insertion. Android grants that service window-content access; Lven examines the focused editable field and related text-change events locally so it can insert a transcript and monitor short-lived corrections. It does not upload that screen content. A complete manual-copy mode that works without Accessibility is still a launch requirement.
Lven Instant (flagship): Audio is captured and transcribed entirely on your device by a speech model downloaded during setup. The audio never leaves your machine. Transcription history is stored locally on each device — nothing is sent to or stored by ClassEve. We physically cannot read what you dictated because we never receive it.
Lven Cloud (server-side product): Audio is captured locally and uploaded over TLS to our transcription subprocessor (Groq) for the duration of the request only. Once the text is returned, the audio is discarded — never stored on the server. The returned transcript text is kept only on your device — ClassEve stores no Cloud transcript text on its servers.
earslate (live translation): earslate is free and has no ClassEve account or subscription. Our Worker receives an anonymous installation ID, provider preference, and target language to mint a short-lived credential. Audio then streams directly from the device to Gemini or OpenAI. ClassEve never receives or stores the audio or translated transcript. The full detail is in our Privacy Policy.
One answer per product, so nothing here needs cross-referencing:
Lven Instant — audio never leaves your device; no one processes it but your own machine; transcript history lives only on your device. ClassEve stores nothing.
Lven Cloud — audio streams over TLS to our transcription provider (Groq; Cloudflare Workers AI as automatic failover), is transcribed in real time, and is discarded. No audio kept, no transcript text stored by anyone — the returned text goes to your device and history lives only there.
Lven Cloud Premium Realtime — same rules, different engine: audio streams to ElevenLabs for the duration of the session. ClassEve retains nothing.
earslate — device → Gemini or OpenAI using a short-lived credential minted by the ClassEve Worker. The Worker retains no audio or transcripts, and earslate has no account.
Folio PDF — not applicable by construction: the app does not request internet permission, so no document can leave the phone.
All payment processing is performed by Paddle, a PCI-DSS Level 1 certified Merchant of Record. We never receive or store full card numbers. Billing webhooks are cryptographically signature-verified with replay protection and deduplication before any account change is applied.
Apple in-app billing is not classified as production-ready: its server-side certificate-purpose validation and retry ledger must be hardened before an Apple purchase can be used as a launch entitlement path.
You can download the account records available through self-service — profile, paired devices, subscription, consent, and usage records — from the dashboard, or request a broader access package by emailing security@classeve.com. Account deletion revokes devices first, purges database records in a transaction, then removes the Auth user; external billing cancellation is a separate operation and the UI reports a warning if it cannot be confirmed. Transcript history never enters the picture because it exists only on your own device.
If you find something we should fix, please report it directly to security@classeve.com rather than opening a public issue. We’ll acknowledge within 72 hours and work with you on a coordinated disclosure timeline.
Our machine-readable contact lives at /.well-known/security.txt.