Audio transcription without uploading: how to check it yourself
Audio transcription without uploading is a claim you can check. What a deletion promise covers, how to verify it in the network panel, and what stays yours.
Audio transcription without uploading means the file is read from your disk by code running in your own browser tab, and no copy of it is sent anywhere. That is a claim you do not have to take on trust. Open your browser’s network panel, run a transcription, and watch what goes out. One large download arrives, the speech model. Nothing of comparable size leaves.
A deletion promise is a promise about what happens afterwards
“We delete it after processing” is a sentence about one stretch of time: the period that starts once the file has arrived. It is a real commitment, and narrower than it sounds when the file is a recording of somebody else.
Read it as a scope rather than a reassurance. The promise begins after transfer, so it says nothing about the trip. It describes deletion, so on its own it does not tell you whether a backup snapshot exists, how long access logs live, or whether the filename and duration stay in an account history after the audio is gone. None of that is sinister. It is outside the sentence.
The useful follow-ups are all requests for specifics: a number of days rather than “promptly”, a written agreement rather than a support reply, and explicit wording about copies and backups. Article 5(1)(e) of the GDPR requires personal data to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”, and Article 5(2) says the controller “shall be responsible for, and be able to demonstrate compliance with” that principle. The controller here is you. Our post on uploading client calls has the full list of questions to send.
Audio transcription without uploading removes the question instead of answering it
There is a second route, and it changes the shape of the problem. If the audio never becomes the body of a network request, there is no retention period to ask about, no transit to secure, no sub-processor list to read, and nothing to chase in six months.
The mechanism is ordinary browser machinery. You pick a file in the page, and the browser gives the page a handle to bytes already on your disk. The page decodes the audio and runs a speech model on your graphics card through WebGPU, the browser API that lets a web page use the GPU for general computation. The transcript is assembled in the tab and written out when you click an export. There is more in what WebGPU is and why your browser can run a speech model.
One thing does travel, and it travels inwards. The model has to reach the tab before it can run, so a first transcription pulls roughly 200 MB of weights down. That is the opposite direction from an upload, and it is the easiest thing to spot in the check below, because it is large and nothing else is.
Verifying it yourself takes about two minutes
Chrome and Edge both include DevTools, and its Network panel logs the requests a page makes. Open DevTools with Control+Shift+J, or Command+Option+J on a Mac, and click the Network tab. DevTools only logs network activity while it is open, so reload the page once with the panel showing, and leave the resource type filter on All so nothing is hidden. Then run a real transcription and keep the panel open throughout.
Type your audio file’s name into the Filter box. It filters requests by properties such as the domain or size of the request, and a request carrying your recording would show the name in the Name column. Nothing should match.
Type larger-than:1000k into the same box. The filter takes a size in bytes, so that leaves only requests above a megabyte, which on a first run is the model arriving in a handful of pieces and on a later run is usually nothing at all.
Click Fetch/XHR to narrow the list to requests made by script, and watch it while the transcription runs. The row count should stop climbing once the model is in. Then click a request and open its Headers. The Size column in the request table is “The combined size of the response headers plus the response body, as delivered by the server”, so it describes what came back; what you want here is the other direction, no request with your audio in its payload.
The status bar along the bottom totals the requests and the transferred resources since DevTools opened. On a first run that total is one download, and a second file in the same tab barely moves it. The same check as a table:
| Where to look | What you should see | What it tells you |
|---|---|---|
| Filter box, your file’s name | No matching request | The recording was never the body of a request |
Filter box, larger-than:1000k |
Model pieces arriving, nothing leaving | The only large transfer is a download |
| Fetch/XHR, during the run | No new rows once the model has loaded | The transcription itself makes no calls |
| A request’s Headers tab | No audio in any request payload | Nothing was tucked into a small request |
| Status bar, transferred total | Large on the first run, near flat on the second | The model is cached, so it arrives once |
Local processing moves the risk, it does not delete it
Keeping the audio off the network settles one question and leaves several open, all of them on your side of the line.
The recording is still on your disk, in whatever folder it landed in. The transcript joins it the moment you export: a TXT or SRT file in your downloads folder, which is often the same folder a backup or sync client is watching. A transcript is personal data in the way the audio was, and it is easier to read, copy and search. Our post on what counts as personal data in a transcript covers which parts carry the risk.
The model sits on your disk too. Open the Application panel in DevTools, go to Storage, and expand Cache Storage to list what the site has stored. Ticking Cache Storage and clicking Clear site data removes those 200 MB, and the next run fetches the model again.
Then there is the machine. A family computer, a hot desk, or a laptop your employer manages is still a shared machine. If somebody else can log in, or an administrator can push software and pull backups, the audio and the transcript are within reach whether or not anything was uploaded. Article 5(1)(f) of the GDPR requires personal data to be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage”, and that duty follows the file onto your hard drive.
The practical version: disk encryption on, a login nobody else uses, exports kept out of a synced folder, and the audio deleted once the transcript has done its job.
Where our tool stops
FreeTranscribe runs OpenAI’s open-source Whisper model in the tab, and its boundaries matter. It needs desktop Chrome or Edge with a working WebGPU adapter, so Firefox, Safari and phones are out for now. English only. It uses the base model, about 200 MB downloaded once and then cached, and the reasoning is in speech model sizes explained. Names, technical terms, strong accents and noisy rooms are where it slips, so read the transcript through before relying on it. It does not label speakers, and what that means in practice is a post of its own. Speed was about 1.5x real time on a desktop with a graphics card in our test, and roughly the length of the recording on a thin laptop.
If that fits your file, open the transcriber and run the network check on your own audio. Two minutes watching the panel is worth more than any sentence on a policy page, ours included.
Frequently asked questions
Does the network panel prove that nothing was ever uploaded? It proves what happened during the run you watched, on the version of the page you were served, which is the strongest evidence most people can gather without reading source code. It is not an audit. What makes it useful is that you can repeat it whenever you like, on any file, and a page that started sending audio would have to do it in front of you.
Do I have to download the model every time? No. The browser caches it after the first run, which is why the status bar total barely moves on a second file. Clearing it, as described above, means the next run fetches the roughly 200 MB again.
Does local processing mean I can skip a data processing agreement? Such an agreement governs a third party processing personal data on your behalf. If no third party receives the recording, there is generally no processor in the chain to contract with. You are still the controller of the file and the transcript on your own machine, and any professional duties you already had are unchanged.
What if my laptop is managed by my employer? Treat the machine as part of the question. If a recording is sensitive enough for the network check to matter, ask your IT team what backup, sync and monitoring software runs on the device, because files on disk are not purely yours even when nothing left the tab.
This post is general information about what the regulation says, not legal advice for your situation.
Sources, checked 15 September 2026
- https://developer.chrome.com/docs/devtools/network : Chrome DevTools Network panel, opening DevTools with Control+Shift+J and why you reload with the panel open
- https://developer.chrome.com/docs/devtools/network/reference : Network panel reference, the Filter box, the Name and Size columns, the
larger-thanfilter, the Fetch/XHR button and the status bar totals - https://developer.chrome.com/docs/devtools/storage/cache : Chrome DevTools Application panel, the Cache storage pane and Clear site data
- https://gdpr-info.eu/art-5-gdpr/ : GDPR Article 5, storage limitation, integrity and confidentiality, accountability