Last updated: August 2026
CaptionPass processes uploaded subtitle files in memory for the duration of a single request on the public converter. We do not persist file contents on disk or in any database.
To enforce the free-tier limit, we increment a coarse per-client daily usage counter (a salted identifier derived from network signals such as the viewer address when present). The counter contains no file contents and resets on UTC calendar days.
Anonymous public converter runs do not save your caption text after the response completes. Workspace accounts do save projects — what that means, in full, is the next section.
A workspace account stores more than a public converter run does. This table is the complete list, generated from the same registry the deletion code walks — so it is what the software actually does, not a description of it written once and left behind.
Deleting your account removes the rows and objects marked Deleted immediately, not at the end of a grace period. Your API keys stop working before anything else happens.
| What we store | On account deletion |
|---|---|
| Uploaded caption files, source media, the stored timeline, and every export artifact. | Deleted |
| Project titles, settings, and cached readiness. | Deleted |
| The record of each delivered file. | Deleted |
| Client names and contact notes saved in the library. | Deleted |
| Saved handoff pack configurations. | Deleted |
| Custom export scripts written in the workspace. | Deleted |
| A monthly count of conformance receipts issued. | Deleted |
| The hosted copy of each signed conformance receipt. | DeletedThe hosted copy is removed, so we hold nothing. Receipts already issued to a third party keep verifying: the signature travels with the JSON, so anyone holding the file can still confirm it is unaltered without us. Their /verify link stops resolving; their evidence does not stop being evidence. |
| The link from an export to the receipt issued with it. | Deleted |
| Public delivery-report links shared with a client. | Expires on its ownKeyed by an opaque token with no owner index, so it cannot be found from a user key. Every share carries a 30-day DynamoDB TTL, which is shorter than the deletion grace period — so a share created the day an account is deleted has expired before the purge would have run anyway. |
| Email, tier, account status, and sign-in history. | Deleted |
| Password hash and linked sign-in providers. | Deleted |
| Trial and admin-granted add-ons. | Deleted |
| Subscription status and the Stripe customer reference. | DeletedThe row here is removed. Stripe holds its own records under its own retention, and an invoice history is a legal record neither of us can delete on request. |
| The export webhook URL and its signing secret. | Deleted |
| API key metadata and the hashed secret. | DeletedAlready revoked before the purge runs, so a key stops working immediately rather than at the end of the grace period. |
| The reverse lookup that turns a bearer token into an account. | DeletedRemoved with its key. Left behind it would be a row pointing at an account that no longer exists. |
| Per-request API log lines: status, preset, byte count, duration. | Deleted |
| A per-day count of successful conversions. | Expires on its ownKeyed by a salted hash of a client identifier rather than by account, and carries a TTL. It cannot be traced back to a person, which is why it cannot be found from a user key either. |
One thing worth reading twice: conformance receipts you have already sent to somebody else keep verifying after you leave. We delete our copy, so the hosted link stops resolving — but the signature travels with the file itself, so whoever you gave it to can still confirm it is unaltered without us being involved. Their evidence is not ours to destroy.
We do not run third-party analytics on this site at the time of writing. If that changes, this page will be updated and the new behavior will go live in the same release.
Questions? Email support@captionpass.com.