What leaves your device
Last updated 20 September 2026.
This is the long form of the privacy centre inside the app. Everything on this page is checkable with a browser network panel rather than taken on trust — the application’s own test suite asserts it on every build, and fails the build if a request appears that is not listed here.
Every host the application can contact
| Host | When | What is in the request |
|---|---|---|
huggingface.co and its CDN |
The first time you transcribe with a given model, and never again | Nothing of yours. It is a download — the model weights come to you |
| The site itself | Loading the page, ONNX Runtime’s WebAssembly binary, and a page-view count | Nothing of yours |
auth.opennotetaker.app |
When you open the Account page, and while signed in | Your sign-in method and your credit balance. No transcripts, ever |
gateway.opennotetaker.app |
Only when you press a button that shows a price | The text that button names, and nothing else |
There is no third-party analytics, no tag manager, no error reporter and no font CDN, on this page or in the application; page views are counted by our own server, as described under This website. The fonts are served from this origin, and so is ONNX Runtime’s binary — specifically so that it is not a second, silent third party. You can confirm all of that in view-source.
This website
This site counts page views with a self-hosted, privacy-preserving analytics service that runs on our own server and is served from this origin. It sets no cookie, records no personal data, and does not follow you to other sites. It counts which pages are opened, not what you do in the application, and it never sees your audio or your transcripts.
The meeting detector extension contacts nothing at all
It has no network code in it. On four meeting platforms it draws a prompt and
hands a tab to the application. It does not read what is said in the
meeting, the chat or any documents. It looks only at the tab's address and
title, and whether the page has a “leave call” button; nothing it
reads leaves the browser. It is seven small source files in all, and
grep -r fetch over them comes back empty.
Audio never goes anywhere
Not as an upload, not as a sample, not to improve a model. The three paid routes take text — the transcript you already have and can read on screen.
That is a property of the wire format rather than a policy that could be revised. The request bodies have no field for audio, the application shows you the exact body before sending it, and the backend’s test suite includes a case that smuggles base64 audio into an extra field and asserts it never reaches the vendor.
What is stored, and where
In your browser’s own storage, on the device you recorded on. Nothing syncs. There is no server-side copy to subpoena, breach or lose.
- Transcripts, titles and speaker names — kept until you delete them.
- The audio — discarded when you close a note, unless you turn on “keep the audio”, which is off by default.
- Your settings — interface language, model choice, and whether to keep audio.
Clearing site data for this origin removes all of it, immediately and permanently. We cannot recover it, because we never had it.
If you make an account
An account is needed for exactly three things: AI-written minutes, questions across your meetings, and translating a finished transcript. It holds a sign-in method and a credit balance. It does not hold recordings, transcripts or titles.
Signing in with Google visibly passes through our account provider’s own domain on the way back, and Google’s consent screen names it. That is how the OAuth hop works and we would rather say so here than have you find it in the address bar.
Consent to record
Whether you may record a meeting depends on where everyone in it is, and this application cannot answer that for you. It does not try. Every recording opens on a consent screen with words you can read out, and there is no way to skip it or ask it to stop appearing.
Contact
Open an issue — the source is public, and a privacy claim you can read the code for is worth more than one you can only email about.