Privacy Policy

Private Recap ("we", "us", or "our") is a privacy-focused meeting transcription and notes application. This Privacy Policy explains how we collect, use, and protect your information when you use our application.

Our core principle is simple: your meeting data stays on your device. All audio recording, transcription, and AI-powered note generation happens locally in your browser. We do not have access to your meeting content.

The following data is processed and stored entirely on your device using your browser's IndexedDB storage. We never have access to this data:

• Audio recordings of your meetings
• Transcripts generated from your recordings
• Meeting notes, action items, and follow-up emails
• Voice fingerprints used for speaker identification
• AI models downloaded for local processing
• Custom templates you create
• Application settings and preferences

This data is encrypted by default using AES-256-GCM encryption with browser-generated keys. You may optionally set an additional passphrase for extra protection.

While your meeting data stays local, we do collect limited information to provide account and subscription services:

Account Information

• Email address (used for authentication and communication)
• Display name (optional, set by you)
• Avatar URL (optional)

Subscription & License Data

• Subscription status and plan type
• License key and associated features
• Device fingerprint (a hash of browser and device properties, used to enforce device limits)

Support Requests

• Messages you submit through our support form
• Your email address (for responding to requests)

• To authenticate you and manage your account
• To process and manage your subscription
• To validate your license and enforce device limits
• To respond to support requests
• To send transactional emails related to your account

Stripe (Payment Processing)

We use Stripe to process payments and manage subscriptions. When you make a purchase, Stripe collects payment information (such as your card number and billing address) directly. We do not store your full payment details on our servers.

Stripe may collect additional data including your IP address, browser information, and device identifiers for fraud prevention. Stripe processes this data as both a data processor (on our behalf) and a data controller (for their own fraud detection and service improvement purposes).

For more information, see Stripe's Privacy Policy.

Supabase (Authentication & Database)

We use Supabase for user authentication and to store account-related data (profiles, subscriptions, and licenses). Supabase does not have access to your meeting content, which remains on your device.

Vercel (Hosting & Analytics)

Our application is hosted on Vercel. We use Vercel's privacy-respecting analytics to collect basic, anonymous usage data (such as page views). This analytics service does not use cookies and does not collect personal information.

Hugging Face (AI Models)

AI models for transcription and note generation are downloaded from Hugging Face's content delivery network. Once downloaded, models are cached locally and all inference runs entirely on your device. Hugging Face may log standard access information (IP address, request metadata) when models are downloaded.

We use minimal browser storage for essential functionality:

• Authentication token — stored by Supabase in localStorage to keep you signed in
• Application settings — stored in localStorage and IndexedDB for your preferences
• Encryption keys — browser-generated keys stored locally for data encryption

Stripe may place cookies on your device when you interact with our payment pages for fraud detection and analytics purposes.

• Local data — Meeting recordings, transcripts, and notes remain on your device until you delete them. You have full control over this data.
• Account data — We retain your profile and subscription information for as long as your account is active. If you delete your account, all associated server-side data is permanently removed.
• Payment records — Transaction records are retained as required by tax and accounting regulations (typically 7 years).

We take security seriously:

• Meeting data is encrypted at rest on your device using AES-256-GCM
• Optional passphrase encryption provides an additional layer of protection
• All network communication uses HTTPS/TLS encryption
• Payment processing is PCI DSS Level 1 compliant (via Stripe)
• Strict Content Security Policy headers prevent unauthorized script execution
• Row Level Security on our database ensures data isolation between users

You have the right to:

• Access your data — Your meeting data is already fully accessible to you on your device. You can request a copy of your server-side account data at any time.
• Delete your data — You can delete local meeting data at any time through the app. You can delete your account and all server-side data through Settings.
• Export your data — You can export meetings and notes from the app at any time.
• Manage your subscription — You can manage, cancel, or modify your subscription through the Stripe customer portal.

Account and subscription data may be processed in the United States through our service providers (Supabase, Stripe, and Vercel). For users in the European Economic Area, these transfers are protected by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Private Recap is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy in the app and updating the "Last updated" date above.

If you have questions about this Privacy Policy or our data practices, please reach out through the Support page in the app or contact us at:

support@privaterecap.com